Data Sharing & Third Parties
Document who you share data with and why.
Types of Third Parties
Identify all parties who receive personal data from you:
Service Providers (Processors)
Companies that process data on your behalf under your instructions.
Business Partners
Partners with whom you share data for joint services or marketing.
Professional Advisors
Experts who need access to data for professional services.
Authorities
Government bodies and regulators when legally required.
International Data Transfers
If you transfer data outside your region (e.g., EU to US), specify:
Transfer Destinations
Countries where data is sent
Transfer Mechanisms
Legal basis for transfers (e.g., SCCs, adequacy decisions)
Safeguards
Protections for transferred data
Recipients
Categories of recipients in each location
💡 Common Transfer Mechanisms
- • Adequacy Decisions: Countries the EU considers "adequate"
- • Standard Contractual Clauses (SCCs): EU-approved contract terms
- • Binding Corporate Rules: For intra-group transfers
Documenting Third Parties
For each third party, document:
Data Processing Agreements
Ensure you have Data Processing Agreements (DPAs) with all processors. These contracts are legally required under DPDPA and establish the processor's obligations regarding your data.