Manage data transfers

Organizations often transfer personal data between applications, vendors, business units, and regions, which are subject to privacy regulations. Privacy Management captures each movement as a data transfer record on the processing activity to help you comply with privacy regulations.

Overview of data transfer

When personal data moves between nodes in a processing activity, including entities, business applications, business processes, companies, vendors, and locations, privacy teams must track where the data goes, whose data is involved, and which legal safeguards permit each movement. Data transfer records capture this information on the processing activity. Each record represents a specific movement of personal data from one node to another, across regions.

How data transfer records are generated

Data transfer records are generated from hierarchy relationships on a processing activity. When you create a relationship that involves sending or receiving personal data from one node to another, the system generates a transfer record for that movement.

By default, only the following relationship types generate data transfer records:

• Send data to

• Received data from

For information on the different relationship types, see Hierarchy relationship forms in Privacy Management.

• Data transfer example

  Consider a Recruitment processing activity that depends on an HR platform in Australia and a recruiting application in Germany. The recruiting application sends personal data to the HR platform. To capture this data flow, you define a relationship with the following details:

  • Primary record: Recruitment processing activity

  • Primary node: Recruiting application

  • Primary node location: Germany

  • Relationship type: Sends data to

  • Related node: HR platform

  • Related node location: Australia This relationship generates one data transfer record: Germany (Recruiting application) to Australia (HR platform).

The Send data to and Received data from relationship types have data subject selection enabled, which captures whose personal data is involved in the transfer, their locations, and the impacted data elements. When you add this information, the system generates additional data transfer records from each data subject location to each node involved in the movement.

Note: A privacy admin can enable data subject selection in custom relationship types by modifying the sn_privacy.relationship_involving_data_subjects system property. For steps, see Configure data subject selection in hierarchy relationships.

• Data transfer example with data subject selection

  In the same example, consider that the recruiting application sends personal data of employees located in California to the HR platform. So, you add the following data subject information to the above relationship:

  • Data subject type: Employees

  • Data subject location: California This generates two additional transfer records for the same relationship, capturing employee personal data movement from California (Employees) to Germany (Recruiting application), and from California (Employees) to Australia (HR platform).

You can remove transfers that don’t apply during the assessment review. For steps, see Review a privacy assessment.

Adding data transfers to a processing activity

Data transfer records are added to a processing activity in one of the following ways:

• A business user defines hierarchy relationships in a privacy impact assessment (PIA) and submits it. The system generates data transfer records for each movement of personal data between the nodes involved. When an analyst marks the assessment as complete, these records are mapped to the processing activity.

• An analyst creates a Sends data to or Received data from hierarchy relationship directly on the Processing data inventory > Hierarchy tab of the processing activity. Data transfer records are automatically generated in the Regulatory details > Data transfers tab.

• An analyst manually records data transfers on the Regulatory details > Data transfers tab of the processing activity.

Transfer mechanisms

An analyst reviews the data transfer records generated for a processing activity and assigns each one a transfer mechanism. A transfer mechanism identifies the legal safeguard that permits data transfers, such as Binding Corporate Rules (BCRs) or Standard Contractual Clauses (SCCs). To learn about different transfer mechanisms in Privacy Management, see Transfer mechanisms.

• To add a transfer mechanism to a data transfer record, see Add a transfer mechanism to a data transfer record.

• To add new transfer mechanisms in your Privacy Workspace, see Manage transfer mechanisms in the Privacy Workspace.

Role requirements

User Required role Task Business user sn_privacy.business_user and sn_privacy.assessment_responder Defines data flows through hierarchy relationships in a privacy assessment. Privacy analyst sn_privacy.analyst Reviews data transfers and adds corresponding transfer mechanisms. Privacy manager sn_privacy.manager Adds new transfer mechanisms in the application or updates existing ones. Privacy admin sn_privacy.admin Configures the sn_privacy.relationship_involving_data_subjects system property to support data subject selection in custom relationships.

• Create a data transfer
  Record a data transfer directly on a processing activity if it wasn’t captured as part of a hierarchy relationship.

• Delete a data transfer
  Delete a data transfer record from a processing activity.

• Transfer mechanisms
  Transfer mechanisms identify the legal safeguard that permits a specific data transfer between locations.

Parent Topic:Using Privacy Management