Skill · Version 1.0.0

Review vendors and data transfers

Maps external services and their data flows to prepare a grounded review of responsibilities, contracts and international transfers.

vendor-international-transfer-review

See how it helps

When is it useful?

Use when adding a hosting, analytics or AI provider, or checking whether your vendor documentation reflects the actual system.

What does it help you do?

Identifies services handling personal data and distinguishes their processing roles.
Compares contractual coverage and public vendor lists with the services actually used.
Examines storage locations, remote access and the transfer mechanisms that need verification.

Try asking this

Map our hosting, email and AI providers. List the data each receives, access locations and missing contractual evidence for a data-protection specialist to review. Trace one uploaded document and one notification through actual vendors. Compare declared locations and contracts with observed configuration, leaving unsupported transfer claims as open questions.

Detailed documentation

Read the skill’s original instructions, examples and checks in their authored language.

Details…Show less

Vendor & International Transfer Review

Evaluate every external vendor and infrastructure service integrated into the product to ensure accurate role classification, valid contractual coverage, and lawful cross-border data transfers.

Vendor & Role Audit

Build a Complete Vendor Register from the System:
- Cross-reference code dependencies, environment variables, infrastructure configs, and billing records to list every external service handling personal or customer data (cloud hosting, managed DBs, CDN/WAF, auth, payments, analytics, crash reporting, email/SMS, support desks, AI/LLM APIs).
Qualify Data Protection Role per Vendor:
- Subprocessor (or Processor): Processes personal data strictly on behalf of the product provider (e.g., cloud hosting, transactional email, enterprise LLM API).
- Independent Controller: Determines its own purposes and obligations (e.g., regulated payment institutions/banks for AML/fraud, telecom carriers).
- Joint Controller (Art. 26 GDPR): Jointly determines purposes and means with the provider (e.g., certain embedded social plugins or shared ad-tech pixels per CJEU case law).
Verify Article 28 DPA & Subprocessor Flow-Down:
- Check whether a binding Art. 28 Data Processing Agreement is executed with each processor/subprocessor.
- Ensure the B2B customer DPA and public Subprocessor List match the actual vendor stack, including processing locations and advance change-notification timelines.

International Data Transfers (GDPR Chapter V)

Map Geographic Data Flows & Remote Access:
- Record both where data is stored at rest and where vendor personnel or sub-subprocessors can access it remotely (since remote access from a third country constitutes a transfer under EDPB Guidelines 05/2021).
Verify Transfer Mechanisms (Arts. 44–49):
- Adequacy Decision (Art. 45): Verify whether the destination country (or a certified US organization under the EU-US Data Privacy Framework) holds an active European Commission adequacy decision.
- Standard Contractual Clauses (Art. 46(2)(c)): Select the correct Commission SCC Module:
  - Module 1: Controller to Controller (C2C)
  - Module 2: Controller to Processor (C2P)
  - Module 3: Processor to Processor (P2P)
  - Module 4: Processor to Controller (P2C)
- Transfer Impact Assessment (TIA) & Supplementary Measures: Where relying on SCCs, document whether destination-country laws impinge on effectiveness and what technical (e.g., strong encryption in transit/at rest, pseudonymization) and organizational measures apply.

Included files 1

SKILL.md