Anything that takes personal data outside Nigeria is a transfer, including a backup in a foreign region and a support desk somebody logs into from abroad. The transfers register records where the data goes, who receives it, and the safeguard that makes it lawful.
Who can do this
An owner, editor or contributor of your workspace can register transfers and write risk checks. A risk check has to be approved by someone other than its author. A viewer can see the register.
Find the register
Open Records & controls → Data transfers. The figures at the top include Active, No safeguard, Expiring and Risk checks open. You can also open Where it all goes, By country and The contracts.
When you record a supplier that processes data abroad, a draft transfer is created for each foreign location. It appears here.
Register a transfer
Press Register a transfer. The steps are Where to, What travels, Safeguard and Check and save.
- Choose the Destination country. Asiri checks it against the adequate list straight away, and tells you whether the later steps apply.
- Under Transfer details, say What to call it, Who receives it and Exactly what goes.
- Choose the Legal grounds, such as standard clauses, group-wide rules or a one-off exception, and the date it was Signed on.
- Check and press Register it.
A transfer to a country that is not adequate, with no signed safeguard, is saved with Register it as a draft. Nothing may travel until the safeguard is in force.
On the transfer
The page shows whether the transfer is protected, and the sections This transfer, The risk check, What protects it, What depends on it and History.
What protects it lists five checks, each held, missing or not applicable: the destination is adequate, a safeguard is signed and on file, the risk check is approved, the extra protections are written down, and the safeguard has not lapsed. A check that cannot apply is not a failure.
Name the supplier at the far end. Without it, the transfer cannot be joined to the terms that govern it, or to the activities that depend on it.
The transfer risk check
If the destination is not on the adequate list, someone has to answer four questions about it.
- On the transfer, press Start the risk check.
- Under Record a transfer risk check, give the Transfer reference, and describe Government access, Oversight, Redress and the Extra protections you have added.
- Choose the Verdict: Do not send it, Go ahead, or Go ahead, with the extra protections. Press Record check.
- Someone else approves it on the transfer: they write Why you are approving it and press Approve it. It can also be approved from Approvals in Impact assessments.
When a safeguard lapses
On the day a safeguard lapses, the transfer stops being lawful, and so do the activities that depend on it. Watch Expiring, and start renewals early.
Common questions
"Does the destination being adequate end the work?" No safeguard of its own is owed, but record what travels and who receives it.
"Is no end date the same as no expiry?" No. Somebody has to establish which it is.