Map each restricted transfer under UK GDPR to adequacy regulations or an appropriate…
Key facts
- Human involvement
- YellowClose supervision
- How AI is used
- List each data flow, recipient country, vendor and the mechanism relied on (adequacy regulations, the UK IDTA, the Addendum or UK BCRs) from the contracts and the data map.
- What the lawyer must review
- Confirm each mechanism against the ICO's current international transfers guidance, including the UK Extension for the US. Check where an AI vendor stores and processes data before client data goes in. Do not rely on Australian APP 8 or an EU-only mechanism without the UK Addendum.
Rules that apply
The document starts from the task name. Change it if this piece of work is different.
Who does what
| Role | What they do |
|---|---|
| Assistance | Consider narrowly defined preparation support after confirming the tool’s capability and permitted scope. |
| Lawyer | Set the scope, supervise the work closely, verify every part relied on, resolve omissions and exceptions, and approve the exact output. |
Checklist
- Verify the applicable jurisdiction and the version of each relevant law, rule or instrument in force at the material time.
- Confirm the output against the client’s instructions and the complete relevant source material, including omissions or contradictions.
- Resolve exceptions and record the responsible lawyer’s approval of the exact output and intended use.