T04 Data Location and International Transfer Record
Verification required. This is a working template, not a regulator-approved form. Where it cites an article or a date, the citation comes from secondary sources or from memory of the legal text and is a pointer to check. This is not legal advice.
How to use: This is a blank form. Copy it and fill in the empty cells and blanks for your system. To copy it, follow the "Suggest an edit to this page" link in the footer to reach its Markdown source.
Wiki control: AI-CTRL-007. The GDPR Chapter V concepts are [Recalled]. The signer attests facts; legal sufficiency is a separate review.
| Field | Entry |
|---|---|
| System ID | |
| Date; valid until (re-attest on change or at 12 months) | |
| Signer |
1. Locations
| Component | Description | Country | Provider and region | Legal entity | Encrypted | Key holder |
|---|---|---|---|---|---|---|
| Training data | ||||||
| Fine-tuning data | ||||||
| Prompts and inputs | ||||||
| Inference compute | ||||||
| Outputs | ||||||
| Embeddings / vector store | ||||||
| Logs (including AI Act logs) | ||||||
| Telemetry | ||||||
| Backups | ||||||
| Support and admin access | ||||||
| Sub-processors |
2. Transfers outside the EEA
| Flow | From | To | Personal data? | Mechanism (adequacy decision, standard contractual clauses, binding corporate rules, derogation) | Transfer impact assessment done | Supplementary measures | Approved by |
|---|---|---|---|---|---|---|---|
Confirm the current adequacy list, and any framework with the US, from the primary source. These change.
3. Remote access
Can staff or support outside the EEA see the data? Record the controls and the logging.
4. Attestations
- [ ] Components are at the stated locations
- [ ] No replication elsewhere
- [ ] Customer data is not used for supplier training
- [ ] Deletion reaches backups within ___ days
- [ ] Evidence attached (region settings, exports)
- [ ] Data Act cloud-switching or portability terms reviewed where relevant [Recalled]
Exceptions and compensating controls: ______
5. Sign-off
| Role | Name | Date |
|---|---|---|
| Signer | ||
| Privacy and security reviewer |