Map data locations and cross-border flows from the vendor DPA
Key facts
- Human involvement
- YellowClose supervision
- How AI is used
- Extract stated data residency, subprocessors and transfer mechanisms from the DPA and architecture paper into a flow table with gaps marked.
- What the lawyer must review
- Confirm locations against the vendor's current DPA, not a marketing page
- Apply the transfer rules of the governing privacy law
- Written for / version
- US
Open a jurisdiction version of this task to see which instruments apply: US
Who does what
| Role | What they do |
|---|---|
| Assistance | Potential support includes extracting and organising information. Confirm the tool’s capability and permitted scope. |
| Lawyer | Set the scope, supervise the work closely, verify every part relied on, resolve omissions and exceptions, and approve the exact output. |
Checklist
- Confirm that the actual tool, feature and processing terms permit use of this information, including access, retention, training and disclosure conditions.
- Verify the applicable jurisdiction and the version of each relevant law, rule or instrument in force at the material time.
- Confirm the output against the client’s instructions and the complete relevant source material, including omissions or contradictions.
- Resolve exceptions and record the responsible lawyer’s approval of the exact output and intended use.
Forms and precedents for this task
| Form or precedent | Kind | AI use | Summary |
|---|---|---|---|
| Cross-border disclosure assessment for a technology vendor (APP 8 and s 16C checklist and record) | Checklist | AI use Yellow | A checklist and file record for deciding whether sending personal information to an overseas or offshore-hosted vendor is a use or a disclosure under APP 8, which exception (if any) applies, and the contractual and monitoring steps that count as reasonable steps. |
Signed-in accounts can read the full text of each one. All precedents.