[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AF6007BNB43V1RMB1WTKZF":3,"skill-same:01M6AF6007BNB43V1RMB1WTKZF":90},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":36,"linkOnly":37,"markdownContent":38,"markdownBody":39,"frontMatter":40,"refName":45,"commitSha":46,"skillDirectory":47,"forksCount":48,"repositoryHtmlUrl":49,"repositoryHomepageUrl":6,"ownerHtmlUrl":50,"ownerBlogUrl":51,"ownerDescription":52,"updatedAt":53,"install":54,"resources":67},"01M6AF6007BNB43V1RMB1WTKZF","transfer-records",null,"Guides maintenance of cross-border transfer registers, audit trails, and compliance documentation under GDPR Art. 30 and Art. 46, EDPB record-keeping guidance, and supervisory authority expectations. Keywords: transfer register, audit trail, Art. 30, Art. 46, documentation, compliance records.","mukul975\u002FPrivacy-Data-Protection-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADNKWX1HF4Q5DKEXT5M774",337,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Ftransfer-records\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000015","视觉设计","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[29,30,31,32,33,34,35],"transfer","transfer records","documentation","audit","compliance","gdpr","privacy","2026-11-10 10:12:30",false,"---\nname: transfer-records\ndescription: >-\n  Guides maintenance of cross-border transfer registers, audit trails, and\n  compliance documentation under GDPR Art. 30 and Art. 46, EDPB record-keeping\n  guidance, and supervisory authority expectations. Keywords: transfer register,\n  audit trail, Art. 30, Art. 46, documentation, compliance records.\nlicense: Apache-2.0\nmetadata:\n  author: mukul975\n  version: \"1.0\"\n  domain: privacy\n  subdomain: cross-border-transfers\n  tags: \"transfer-register, audit-trail, art-30, art-46, documentation, compliance-records\"\n---\n\n# Managing Transfer Records and Documentation\n\n## Overview\n\nMaintaining comprehensive transfer records and documentation is a foundational obligation under the GDPR and a practical necessity for demonstrating compliance with cross-border data transfer requirements. Articles 5(2) and 24 impose a general accountability obligation, while Article 30 mandates specific records of processing activities — including details of international transfers. Beyond these baseline requirements, each transfer mechanism (SCCs, BCRs, adequacy reliance, derogations) carries its own documentation expectations. This skill provides a structured approach to building, maintaining, and auditing transfer records across all mechanisms.\n\n## Transfer Register: Core Fields\n\n### Mandatory Fields per Transfer Entry\n\nEvery cross-border transfer must be documented with the following information:\n\n| Field | Description | Legal Basis |\n|-------|-------------|-------------|\n| Transfer ID | Unique identifier for the transfer entry | Internal governance |\n| Data Exporter | Identity and contact details of the transferring entity | Art. 30(1)(a) |\n| Data Importer | Identity and contact details of the receiving entity | Art. 30(1)(a) |\n| Exporter Country | Country from which data is transferred | Art. 30(1)(e) |\n| Importer Country | Destination country or international organisation | Art. 30(1)(e) |\n| Categories of Data Subjects | Types of individuals whose data is transferred | Art. 30(1)(c) |\n| Categories of Personal Data | Types of personal data transferred | Art. 30(1)(c) |\n| Special Category Data | Whether Art. 9 special categories are included | Art. 9(1), Art. 30(1)(c) |\n| Purpose of Transfer | Business and legal purpose for the transfer | Art. 30(1)(b) |\n| Legal Basis for Processing | Lawful basis under Art. 6 (and Art. 9 if applicable) | Art. 30(1)(b) |\n| Transfer Mechanism | The Chapter V mechanism relied upon | Art. 30(1)(e), Art. 46 |\n| Mechanism Reference | SCC execution date, BCR approval reference, adequacy decision reference, etc. | Art. 46 |\n| TIA Reference | Reference to the Transfer Impact Assessment (if applicable) | EDPB Rec. 01\u002F2020 |\n| Supplementary Measures | Technical, contractual, and organisational measures applied | EDPB Rec. 01\u002F2020 |\n| Data Retention Period | How long transferred data will be retained by the importer | Art. 30(1)(f) |\n| Review Date | Next scheduled review date for the transfer | Accountability (Art. 5(2)) |\n| Status | Active, Under Review, Suspended, Terminated | Internal governance |\n| Risk Rating | Overall risk assessment (Low, Medium, High, Critical) | Accountability (Art. 5(2)) |\n\n### Extended Fields for Specific Mechanisms\n\n**For SCC-based transfers:**\n\n| Field | Description |\n|-------|-------------|\n| SCC Module | Module 1 (C2C), 2 (C2P), 3 (P2P), or 4 (P2C) |\n| SCC Execution Date | Date the SCCs were signed by both parties |\n| SCC Annex I Completed | Whether the transfer description annex is completed |\n| SCC Annex II Completed | Whether the technical\u002Forganisational measures annex is completed |\n| SCC Annex III Completed | Whether the sub-processor list is completed (Modules 2\u002F3) |\n| Clause 7 Docking | Whether a docking clause has been used for additional parties |\n\n**For BCR-based transfers:**\n\n| Field | Description |\n|-------|-------------|\n| BCR Approval Authority | Lead supervisory authority that approved the BCRs |\n| BCR Approval Date | Date of BCR approval |\n| BCR Version | Current version of the BCRs |\n| Entity Coverage | Whether the specific entities are listed in the BCR member list |\n| BCR Audit Date | Date of last BCR compliance audit |\n\n**For adequacy-based transfers:**\n\n| Field | Description |\n|-------|-------------|\n| Adequacy Decision Reference | EC decision number and date |\n| Adequacy Scope | Full or partial adequacy; any sector\u002Ftype limitations |\n| Adequacy Review Date | Date of next EC review of the adequacy decision |\n| Monitoring Status | Whether developments in the destination country are being tracked |\n\n**For Art. 49 derogation-based transfers:**\n\n| Field | Description |\n|-------|-------------|\n| Derogation Relied Upon | Specific Art. 49 paragraph |\n| Necessity Assessment | Documentation of why the transfer is strictly necessary |\n| Frequency | Whether the transfer is occasional or repetitive |\n| DPA Notification | Whether the supervisory authority has been informed (Art. 49(1)(2)) |\n\n## Audit Trail Requirements\n\n### What Must Be Logged\n\nThe audit trail for transfer records must capture:\n\n| Event Type | Details to Log | Retention |\n|------------|---------------|-----------|\n| Transfer Created | Creator identity, creation date, all initial field values | Life of transfer + 5 years |\n| Transfer Modified | Modifier identity, modification date, field changed, old value, new value | Life of transfer + 5 years |\n| Mechanism Changed | Old mechanism, new mechanism, reason for change, approver | Life of transfer + 5 years |\n| TIA Completed\u002FUpdated | TIA reference, assessment date, outcome, assessor | Life of transfer + 5 years |\n| Review Conducted | Reviewer identity, review date, outcome, next review date | Life of transfer + 5 years |\n| Transfer Suspended | Suspension date, reason, authoriser | Life of transfer + 5 years |\n| Transfer Terminated | Termination date, reason, data return\u002Fdeletion confirmation | Life of transfer + 5 years |\n| Document Attached | Document type, filename, upload date, uploader | Life of transfer + 5 years |\n| SA Inquiry Received | Inquiry reference, SA identity, date, scope | Life of transfer + 10 years |\n\n### Audit Trail Integrity\n\n- Each audit log entry must be immutable once created\n- Entries must include a timestamp (UTC) and authenticated user identity\n- The audit trail must be protected against tampering (hash chains, write-once storage, or equivalent)\n- Access to the audit trail must be restricted to authorised personnel (DPO, privacy counsel, internal audit)\n\n## Documentation Packages by Mechanism\n\n### SCC Documentation Package\n\nA complete SCC documentation package for each transfer includes:\n\n1. **Executed SCCs** — Signed copy with all Annexes (I, II, III where applicable)\n2. **Transfer Impact Assessment** — Completed TIA per EDPB 6-step methodology\n3. **Supplementary measures record** — List of technical, contractual, and organisational measures with effectiveness assessment\n4. **Due diligence record** — Evidence of importer assessment (questionnaire responses, certifications, audit reports)\n5. **Annex review log** — Record of periodic reviews and updates to Annex content\n6. **Sub-processor management** — Current sub-processor list, notification records, objection process documentation\n\n### BCR Documentation Package\n\n1. **Approved BCR text** — Current version with all amendments\n2. **BCR member list** — All entities bound by the BCRs with accession dates\n3. **Compliance audit reports** — Internal and external audit reports\n4. **Training records** — Evidence of BCR training for relevant personnel\n5. **Complaint handling log** — Records of data subject complaints and resolutions\n6. **Update log** — Record of all BCR amendments with approval dates\n\n### Adequacy Documentation Package\n\n1. **Adequacy decision reference** — Link to the relevant EC decision\n2. **Scope assessment** — Documentation confirming the transfer falls within the adequacy scope\n3. **Monitoring log** — Evidence of monitoring developments in the destination country\n4. **Contingency plan** — Plan for transitioning to alternative mechanisms if adequacy is revoked\n\n### Art. 49 Derogation Documentation Package\n\n1. **Derogation assessment** — Written analysis of why the specific derogation applies\n2. **Necessity analysis** — Documentation of why no alternative mechanism is available\n3. **Data subject information** — Evidence that data subjects were informed per Art. 49(1)(e) where applicable\n4. **DPA notification** — Copy of any notification to the supervisory authority under Art. 49(1)(2)\n5. **Transfer log** — Detailed log of each individual transfer (for occasional transfers)\n\n## Supervisory Authority Expectations\n\n### Information to Produce on Request\n\nSupervisory authorities expect organisations to produce the following within a reasonable timeframe (typically 2-4 weeks):\n\n1. Complete transfer register covering all international transfers\n2. Transfer mechanism documentation for any specific transfer\n3. TIA documentation for transfers to non-adequate countries\n4. Evidence of periodic reviews and updates\n5. Audit trail for any specific transfer entry\n6. Sub-processor chains for processor-based transfers\n7. Records of any transfer suspensions or terminations and the reasons\n\n### Common SA Findings\n\n| Finding | Description | Remediation |\n|---------|-------------|-------------|\n| Incomplete register | Missing transfers or incomplete fields | Conduct full inventory; populate all mandatory fields |\n| Stale TIAs | TIAs not updated after significant legal developments | Establish TIA review triggers and periodic review schedule |\n| Missing execution dates | SCCs without documented execution dates | Obtain signed copies with dates; implement document management |\n| No review schedule | No evidence of periodic transfer reviews | Establish annual review cycle; document in governance framework |\n| Inadequate audit trail | Changes to transfer records not tracked | Implement audit logging; migrate to system with built-in audit trail |\n| Missing sub-processor records | Incomplete or outdated sub-processor lists | Audit sub-processor chains; update SCC Annex III |\n\n## Review and Governance Cycle\n\n### Annual Review Cycle\n\n| Quarter | Activity |\n|---------|----------|\n| Q1 | Full transfer register review: verify all active transfers, close terminated transfers, update mechanism status |\n| Q2 | TIA refresh: reassess all transfers to non-adequate countries against current legal developments |\n| Q3 | Mechanism review: verify SCC execution dates, BCR compliance, adequacy decision status, derogation continuing necessity |\n| Q4 | Governance review: assess documentation completeness, audit trail integrity, SA readiness, update policies |\n\n### Trigger-Based Reviews\n\nIn addition to the annual cycle, reviews must be triggered by:\n\n- Change in destination country legislation or enforcement practice\n- CJEU judgment affecting transfer mechanisms (e.g., Schrems-type ruling)\n- EC adequacy decision adopted, amended, or revoked\n- EDPB guidance or recommendation affecting transfer documentation\n- Organisational change (new entity, acquisition, divestiture)\n- Data breach involving transferred data\n- Supervisory authority inquiry or investigation\n\n## Athena Global Logistics — Transfer Register Example\n\n### Active Transfers (Extract)\n\n| Transfer ID | Exporter | Importer | Dest Country | Mechanism | TIA Ref | Review Date | Status |\n|------------|----------|----------|-------------|-----------|---------|------------|--------|\n| ATH-INT-001 | Athena GmbH (DE) | TransPacific Ltd (HK) | Hong Kong | SCCs Module 2 | TIA-2024-003 | 2025-06-30 | Active |\n| ATH-INT-002 | Athena GmbH (DE) | CloudVault Pte Ltd (SG) | Singapore | SCCs Module 3 | TIA-2024-005 | 2025-06-30 | Active |\n| ATH-INT-003 | Athena GmbH (DE) | Athena Japan KK (JP) | Japan | EU Adequacy (2019\u002F419) | N\u002FA | 2025-12-31 | Active |\n| ATH-INT-004 | Athena GmbH (DE) | Athena India Pvt Ltd (IN) | India | SCCs Module 1 | TIA-2024-008 | 2025-06-30 | Active |\n| ATH-INT-005 | Athena GmbH (DE) | Pinnacle TH (TH) | Thailand | SCCs Module 3 | TIA-2024-010 | 2025-06-30 | Active |\n| ATH-INT-006 | Athena GmbH (DE) | Athena US Inc (US) | United States | DPF + SCCs fallback | TIA-2024-012 | 2025-06-30 | Active |\n\n### Governance Framework\n\n- **Transfer Register Owner**: Elisa Brandt, Group DPO\n- **Review Frequency**: Quarterly (full register), plus trigger-based\n- **Audit Trail System**: GRC platform with immutable logging\n- **SA Response SLA**: Complete documentation package within 10 business days of request\n- **Escalation Path**: DPO → Head of Legal → Chief Privacy Officer → Board Privacy Committee\n","# Managing Transfer Records and Documentation\n\n## Overview\n\nMaintaining comprehensive transfer records and documentation is a foundational obligation under the GDPR and a practical necessity for demonstrating compliance with cross-border data transfer requirements. Articles 5(2) and 24 impose a general accountability obligation, while Article 30 mandates specific records of processing activities — including details of international transfers. Beyond these baseline requirements, each transfer mechanism (SCCs, BCRs, adequacy reliance, derogations) carries its own documentation expectations. This skill provides a structured approach to building, maintaining, and auditing transfer records across all mechanisms.\n\n## Transfer Register: Core Fields\n\n### Mandatory Fields per Transfer Entry\n\nEvery cross-border transfer must be documented with the following information:\n\n| Field | Description | Legal Basis |\n|-------|-------------|-------------|\n| Transfer ID | Unique identifier for the transfer entry | Internal governance |\n| Data Exporter | Identity and contact details of the transferring entity | Art. 30(1)(a) |\n| Data Importer | Identity and contact details of the receiving entity | Art. 30(1)(a) |\n| Exporter Country | Country from which data is transferred | Art. 30(1)(e) |\n| Importer Country | Destination country or international organisation | Art. 30(1)(e) |\n| Categories of Data Subjects | Types of individuals whose data is transferred | Art. 30(1)(c) |\n| Categories of Personal Data | Types of personal data transferred | Art. 30(1)(c) |\n| Special Category Data | Whether Art. 9 special categories are included | Art. 9(1), Art. 30(1)(c) |\n| Purpose of Transfer | Business and legal purpose for the transfer | Art. 30(1)(b) |\n| Legal Basis for Processing | Lawful basis under Art. 6 (and Art. 9 if applicable) | Art. 30(1)(b) |\n| Transfer Mechanism | The Chapter V mechanism relied upon | Art. 30(1)(e), Art. 46 |\n| Mechanism Reference | SCC execution date, BCR approval reference, adequacy decision reference, etc. | Art. 46 |\n| TIA Reference | Reference to the Transfer Impact Assessment (if applicable) | EDPB Rec. 01\u002F2020 |\n| Supplementary Measures | Technical, contractual, and organisational measures applied | EDPB Rec. 01\u002F2020 |\n| Data Retention Period | How long transferred data will be retained by the importer | Art. 30(1)(f) |\n| Review Date | Next scheduled review date for the transfer | Accountability (Art. 5(2)) |\n| Status | Active, Under Review, Suspended, Terminated | Internal governance |\n| Risk Rating | Overall risk assessment (Low, Medium, High, Critical) | Accountability (Art. 5(2)) |\n\n### Extended Fields for Specific Mechanisms\n\n**For SCC-based transfers:**\n\n| Field | Description |\n|-------|-------------|\n| SCC Module | Module 1 (C2C), 2 (C2P), 3 (P2P), or 4 (P2C) |\n| SCC Execution Date | Date the SCCs were signed by both parties |\n| SCC Annex I Completed | Whether the transfer description annex is completed |\n| SCC Annex II Completed | Whether the technical\u002Forganisational measures annex is completed |\n| SCC Annex III Completed | Whether the sub-processor list is completed (Modules 2\u002F3) |\n| Clause 7 Docking | Whether a docking clause has been used for additional parties |\n\n**For BCR-based transfers:**\n\n| Field | Description |\n|-------|-------------|\n| BCR Approval Authority | Lead supervisory authority that approved the BCRs |\n| BCR Approval Date | Date of BCR approval |\n| BCR Version | Current version of the BCRs |\n| Entity Coverage | Whether the specific entities are listed in the BCR member list |\n| BCR Audit Date | Date of last BCR compliance audit |\n\n**For adequacy-based transfers:**\n\n| Field | Description |\n|-------|-------------|\n| Adequacy Decision Reference | EC decision number and date |\n| Adequacy Scope | Full or partial adequacy; any sector\u002Ftype limitations |\n| Adequacy Review Date | Date of next EC review of the adequacy decision |\n| Monitoring Status | Whether developments in the destination country are being tracked |\n\n**For Art. 49 derogation-based transfers:**\n\n| Field | Description |\n|-------|-------------|\n| Derogation Relied Upon | Specific Art. 49 paragraph |\n| Necessity Assessment | Documentation of why the transfer is strictly necessary |\n| Frequency | Whether the transfer is occasional or repetitive |\n| DPA Notification | Whether the supervisory authority has been informed (Art. 49(1)(2)) |\n\n## Audit Trail Requirements\n\n### What Must Be Logged\n\nThe audit trail for transfer records must capture:\n\n| Event Type | Details to Log | Retention |\n|------------|---------------|-----------|\n| Transfer Created | Creator identity, creation date, all initial field values | Life of transfer + 5 years |\n| Transfer Modified | Modifier identity, modification date, field changed, old value, new value | Life of transfer + 5 years |\n| Mechanism Changed | Old mechanism, new mechanism, reason for change, approver | Life of transfer + 5 years |\n| TIA Completed\u002FUpdated | TIA reference, assessment date, outcome, assessor | Life of transfer + 5 years |\n| Review Conducted | Reviewer identity, review date, outcome, next review date | Life of transfer + 5 years |\n| Transfer Suspended | Suspension date, reason, authoriser | Life of transfer + 5 years |\n| Transfer Terminated | Termination date, reason, data return\u002Fdeletion confirmation | Life of transfer + 5 years |\n| Document Attached | Document type, filename, upload date, uploader | Life of transfer + 5 years |\n| SA Inquiry Received | Inquiry reference, SA identity, date, scope | Life of transfer + 10 years |\n\n### Audit Trail Integrity\n\n- Each audit log entry must be immutable once created\n- Entries must include a timestamp (UTC) and authenticated user identity\n- The audit trail must be protected against tampering (hash chains, write-once storage, or equivalent)\n- Access to the audit trail must be restricted to authorised personnel (DPO, privacy counsel, internal audit)\n\n## Documentation Packages by Mechanism\n\n### SCC Documentation Package\n\nA complete SCC documentation package for each transfer includes:\n\n1. **Executed SCCs** — Signed copy with all Annexes (I, II, III where applicable)\n2. **Transfer Impact Assessment** — Completed TIA per EDPB 6-step methodology\n3. **Supplementary measures record** — List of technical, contractual, and organisational measures with effectiveness assessment\n4. **Due diligence record** — Evidence of importer assessment (questionnaire responses, certifications, audit reports)\n5. **Annex review log** — Record of periodic reviews and updates to Annex content\n6. **Sub-processor management** — Current sub-processor list, notification records, objection process documentation\n\n### BCR Documentation Package\n\n1. **Approved BCR text** — Current version with all amendments\n2. **BCR member list** — All entities bound by the BCRs with accession dates\n3. **Compliance audit reports** — Internal and external audit reports\n4. **Training records** — Evidence of BCR training for relevant personnel\n5. **Complaint handling log** — Records of data subject complaints and resolutions\n6. **Update log** — Record of all BCR amendments with approval dates\n\n### Adequacy Documentation Package\n\n1. **Adequacy decision reference** — Link to the relevant EC decision\n2. **Scope assessment** — Documentation confirming the transfer falls within the adequacy scope\n3. **Monitoring log** — Evidence of monitoring developments in the destination country\n4. **Contingency plan** — Plan for transitioning to alternative mechanisms if adequacy is revoked\n\n### Art. 49 Derogation Documentation Package\n\n1. **Derogation assessment** — Written analysis of why the specific derogation applies\n2. **Necessity analysis** — Documentation of why no alternative mechanism is available\n3. **Data subject information** — Evidence that data subjects were informed per Art. 49(1)(e) where applicable\n4. **DPA notification** — Copy of any notification to the supervisory authority under Art. 49(1)(2)\n5. **Transfer log** — Detailed log of each individual transfer (for occasional transfers)\n\n## Supervisory Authority Expectations\n\n### Information to Produce on Request\n\nSupervisory authorities expect organisations to produce the following within a reasonable timeframe (typically 2-4 weeks):\n\n1. Complete transfer register covering all international transfers\n2. Transfer mechanism documentation for any specific transfer\n3. TIA documentation for transfers to non-adequate countries\n4. Evidence of periodic reviews and updates\n5. Audit trail for any specific transfer entry\n6. Sub-processor chains for processor-based transfers\n7. Records of any transfer suspensions or terminations and the reasons\n\n### Common SA Findings\n\n| Finding | Description | Remediation |\n|---------|-------------|-------------|\n| Incomplete register | Missing transfers or incomplete fields | Conduct full inventory; populate all mandatory fields |\n| Stale TIAs | TIAs not updated after significant legal developments | Establish TIA review triggers and periodic review schedule |\n| Missing execution dates | SCCs without documented execution dates | Obtain signed copies with dates; implement document management |\n| No review schedule | No evidence of periodic transfer reviews | Establish annual review cycle; document in governance framework |\n| Inadequate audit trail | Changes to transfer records not tracked | Implement audit logging; migrate to system with built-in audit trail |\n| Missing sub-processor records | Incomplete or outdated sub-processor lists | Audit sub-processor chains; update SCC Annex III |\n\n## Review and Governance Cycle\n\n### Annual Review Cycle\n\n| Quarter | Activity |\n|---------|----------|\n| Q1 | Full transfer register review: verify all active transfers, close terminated transfers, update mechanism status |\n| Q2 | TIA refresh: reassess all transfers to non-adequate countries against current legal developments |\n| Q3 | Mechanism review: verify SCC execution dates, BCR compliance, adequacy decision status, derogation continuing necessity |\n| Q4 | Governance review: assess documentation completeness, audit trail integrity, SA readiness, update policies |\n\n### Trigger-Based Reviews\n\nIn addition to the annual cycle, reviews must be triggered by:\n\n- Change in destination country legislation or enforcement practice\n- CJEU judgment affecting transfer mechanisms (e.g., Schrems-type ruling)\n- EC adequacy decision adopted, amended, or revoked\n- EDPB guidance or recommendation affecting transfer documentation\n- Organisational change (new entity, acquisition, divestiture)\n- Data breach involving transferred data\n- Supervisory authority inquiry or investigation\n\n## Athena Global Logistics — Transfer Register Example\n\n### Active Transfers (Extract)\n\n| Transfer ID | Exporter | Importer | Dest Country | Mechanism | TIA Ref | Review Date | Status |\n|------------|----------|----------|-------------|-----------|---------|------------|--------|\n| ATH-INT-001 | Athena GmbH (DE) | TransPacific Ltd (HK) | Hong Kong | SCCs Module 2 | TIA-2024-003 | 2025-06-30 | Active |\n| ATH-INT-002 | Athena GmbH (DE) | CloudVault Pte Ltd (SG) | Singapore | SCCs Module 3 | TIA-2024-005 | 2025-06-30 | Active |\n| ATH-INT-003 | Athena GmbH (DE) | Athena Japan KK (JP) | Japan | EU Adequacy (2019\u002F419) | N\u002FA | 2025-12-31 | Active |\n| ATH-INT-004 | Athena GmbH (DE) | Athena India Pvt Ltd (IN) | India | SCCs Module 1 | TIA-2024-008 | 2025-06-30 | Active |\n| ATH-INT-005 | Athena GmbH (DE) | Pinnacle TH (TH) | Thailand | SCCs Module 3 | TIA-2024-010 | 2025-06-30 | Active |\n| ATH-INT-006 | Athena GmbH (DE) | Athena US Inc (US) | United States | DPF + SCCs fallback | TIA-2024-012 | 2025-06-30 | Active |\n\n### Governance Framework\n\n- **Transfer Register Owner**: Elisa Brandt, Group DPO\n- **Review Frequency**: Quarterly (full register), plus trigger-based\n- **Audit Trail System**: GRC platform with immutable logging\n- **SA Response SLA**: Complete documentation package within 10 business days of request\n- **Escalation Path**: DPO → Head of Legal → Chief Privacy Officer → Board Privacy Committee\n",{"name":5,"license":15,"metadata":41,"description":7},{"tags":42,"author":9,"domain":35,"version":43,"subdomain":44},"transfer-register, audit-trail, art-30, art-46, documentation, compliance-records","1.0","cross-border-transfers","main","9b2ef9eae161c00a17241d42a388571321b33e9f","plugins\u002Fprivacy-skills-complete\u002Fskills\u002Ftransfer-records",68,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-03-17 04:06:52",{"source":8,"skillName":5,"commands":55,"prompt":65,"zipAvailable":66},[56,59,62],{"tool":57,"command":58},"npx","npx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill transfer-records",{"tool":60,"command":61},"bunx","bunx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill transfer-records",{"tool":63,"command":64},"pnpm","pnpm dlx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill transfer-records","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Ftransfer-records\u002FSKILL.md",true,[68,74,80,84],{"path":69,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":72,"sourceHtmlUrl":73},"assets\u002Ftemplate.md","ASSET","资产文件",6332,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Ftransfer-records\u002Fassets\u002Ftemplate.md",{"path":75,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":78,"sourceHtmlUrl":79},"references\u002Fstandards.md","REFERENCE","参考文档",8191,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Ftransfer-records\u002Freferences\u002Fstandards.md",{"path":81,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":82,"sourceHtmlUrl":83},"references\u002Fworkflows.md",9404,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Ftransfer-records\u002Freferences\u002Fworkflows.md",{"path":85,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":88,"sourceHtmlUrl":89},"scripts\u002Fprocess.py","SCRIPT","脚本",16892,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Ftransfer-records\u002Fscripts\u002Fprocess.py",[91,113,129,142,158,171],{"skillNo":92,"name":93,"nameZh":6,"description":94,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":95,"categories":96,"keywords":104,"publishedAt":36},"01M6AG6K8R3XW10ENWH2FH18RH","workplace-email-privacy","Implements email and internet monitoring compliance in the workplace per Barbulescu v Romania (ECHR Grand Chamber), EDPB guidance, and national labour law. Covers acceptable use policies, legitimate expectation of privacy, proportionality testing, and content vs metadata monitoring. Keywords: email monitoring, Barbulescu, workplace privacy, internet monitoring, acceptable use policy, ECHR, proportionality.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fworkplace-email-privacy\u002FSKILL.md",[97,100,103],{"categoryNo":98,"categoryName":99,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000005","邮件与沟通",{"categoryNo":101,"categoryName":102,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},[105,106,35,33,107,108,109,110,111,112],"email","workplace email privacy","content","data","policy","testing","monitoring","metadata",{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":117,"categories":118,"keywords":123,"publishedAt":36},"01M6AG6FRCBJY7D061BJZMNV49","whistleblower-data","Implements data protection compliance for whistleblowing systems under EU Directive 2019\u002F1937 and GDPR. Covers anonymous reporting channels, identity protection for whistleblowers and accused persons, retention limits, access restrictions, and retaliation prevention. Addresses national transpositions and DPA guidance. Keywords: whistleblower, Directive 2019\u002F1937, anonymous reporting, identity protection, retaliation, retention, reporting channel.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fwhistleblower-data\u002FSKILL.md",[119,122],{"categoryNo":120,"categoryName":121,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000033","数据分析师",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},[108,124,125,126,33,127,34,35,128],"whistleblower data","identity","reporting","data protection","prevention",{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":136,"publishedAt":36},"01M6AG6CJP0PW3X65HC7VP9SR9","vendor-termination-data","Vendor termination data return and deletion procedures per GDPR Article 28(3)(g). Covers data extraction formats, deletion certification requirements, transition planning, residual data handling, and post-termination verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-termination-data\u002FSKILL.md",[135],{"categoryNo":120,"categoryName":121,"taxonomyType":26,"taxonomyTypeDesc":27},[108,137,138,139,140,34,35,141],"vendor termination data","planning","verification","extraction","certification",{"skillNo":143,"name":144,"nameZh":6,"description":145,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":146,"categories":147,"keywords":149,"publishedAt":36},"01M6AG69E277DXZB2NF6KV17ZA","vendor-risk-scoring","Vendor privacy risk tiering methodology for processor management. Covers scoring factors including data volume, sensitivity, transfer locations, certifications, breach history, and control maturity with weighted risk calculation and tier assignment.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-risk-scoring\u002FSKILL.md",[148],{"categoryNo":120,"categoryName":121,"taxonomyType":26,"taxonomyTypeDesc":27},[150,151,152,153,154,155,29,156,35,108,157],"vendor risk scoring","risk","risk scoring","methodology","risk-scoring","assessment","certifications","processor",{"skillNo":159,"name":160,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":165,"publishedAt":36},"01M6AG6655ABFKT2BBWHCP4PAT","vendor-privacy-due-diligence","Pre-contract vendor privacy due diligence per GDPR Article 28(1). Covers risk questionnaires, technical controls assessment, certification review, data flow analysis, and documented sufficiency decisions for processor engagement.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-due-diligence\u002FSKILL.md",[164],{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},[35,166,34,167,155,168,169,108,157,151,141,170],"vendor privacy due diligence","review","onboarding","flow","analysis",{"skillNo":172,"name":173,"nameZh":6,"description":174,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":175,"categories":176,"keywords":184,"publishedAt":36},"01M6AG62C3VD8SYNGH4N7RHZTE","vendor-privacy-audit","On-site and remote vendor audit procedures per GDPR Article 28(3)(h). Covers audit planning, evidence collection methodologies, finding classification, remediation tracking, and audit report generation for processor compliance verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-audit\u002FSKILL.md",[177,180,183],{"categoryNo":178,"categoryName":179,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":181,"categoryName":182,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000036","内容创作者",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},[185,32,35,186,139,187,33,34,188,157,189,190,191,138],"vendor privacy audit","report","audit report","remediation","collection","remediation-tracking","classification"]