Record a legal basis for every transfer

How to do it

Check the region in the data map, including where support staff can read data from. The bases are an adequacy decision under Article 45, contract clauses or binding corporate rules under Article 46, or a narrow exception under Article 49. The European Commission keeps the list of adequate countries. Keep your copy in the code and add a country only after you read its decision. Examples are the UK renewal that runs until 27 December 2031 and Brazil's decision of January 2026. Canada's decision covers only companies under its federal private sector law, so check each Canadian vendor by hand. For clauses, use the 2021 Standard Contractual Clauses (Decision 2021/914) and the module that fits, such as module 2 from controller to processor. Write a transfer impact assessment, as the EDPB recommendations 01/2020 describe.

Example

// "eea" stands for any EEA country. The US is left out on purpose: only DPF-listed companies count.
const EEA_AND_ADEQUATE = new Set(['eea', 'ad', 'ar', 'br', 'ch', 'fo', 'gb', 'gg', 'il', 'im', 'je', 'jp', 'kr', 'nz', 'uy']);
const transferProblems = vendors => vendors.flatMap(vendor => {
  if (EEA_AND_ADEQUATE.has(vendor.country)) return [];
  if (!vendor.transfer?.basis) return [`${vendor.id}: no transfer basis for ${vendor.country}`];
  if (vendor.transfer.basis.startsWith('scc') && !vendor.transfer.assessment) return [`${vendor.id}: clauses without a transfer impact assessment`];
  return [];
});

EEA_AND_ADEQUATE = {"eea", "ad", "ar", "br", "ch", "fo", "gb", "gg", "il", "im", "je", "jp", "kr", "nz", "uy"}

def transfer_problems(vendors: list[dict]) -> list[str]:
    problems = []
    for vendor in vendors:
        transfer = vendor.get("transfer") or {}
        if vendor["country"] in EEA_AND_ADEQUATE:
            continue
        if not transfer.get("basis"):
            problems.append(f"{vendor['id']}: no transfer basis for {vendor['country']}")
        elif transfer["basis"].startswith("scc") and not transfer.get("assessment"):
            problems.append(f"{vendor['id']}: clauses without a transfer impact assessment")
    return problems

How to check

A script reads the country of every vendor and store. It fails when a country outside the EEA and the adequacy list has no basis, or when a clauses basis has no assessment link.