International Data Transfer File for AI Services

How to use this document

• Use it to document, service by service, personal data sent to AI vendors located in or operating from other countries: what data leaves, where it goes, under which mechanism, with which destination-country assessment and with which supplementary measures.
• Suggested owners: the data protection officer (DPO) or privacy function, with legal for contracts and procurement for the vendor relationship. IT and security provide the technical information for each flow.
• Before adopting it, decide which AI services may be used with personal data, who approves a new transfer and which level of residual risk rules out a service.
• Open one file per AI vendor (or per service, if a vendor offers several under different terms). Complete parts A to G in order: the data-flow map feeds everything else.
• Use the vendor annex (part E) as a questionnaire before contracting and file it with the answers.
• Keep only the variants for the countries the data leaves from. If data leaves several countries, several variants apply at once.
• [COMPLETE] fields marked "confirm with your advisor" flag points worth checking, such as adequate-country lists, approved clause templates, registrations with the authority and transition deadlines.
• Ask internal legal or an outside advisor to review the chosen mechanism and the destination-country assessment before the first transfer.
• Approve each file with the signature of the person with authority over the service, keep it under version control and link it to the record of processing activities.

International Data Transfer File for AI Services

Field	Content
Exporting organization	[LEGAL ENTITY NAME] ([ORGANIZATION NAME])
Importing AI vendor	[VENDOR]
AI service or system	[AI SYSTEM]
Country or countries of origin of the data	[COUNTRY]
File owner	[OWNER]
Function	[RESPONSIBLE FUNCTION]
Reference in the record of processing activities	[COMPLETE]
Version and date	[COMPLETE] / [DATE]
Status	Draft / Under review / Approved / Suspended
Privacy contact	[PRIVACY EMAIL]

1. Purpose and scope

1.1. [ORGANIZATION NAME] keeps this file to document that every transfer of personal data to an AI service vendor outside the country of origin has a valid mechanism, an assessment of the risk in the destination country and proportionate measures.

1.2. For the purposes of this file, an international transfer occurs, among other cases, when:

• staff enter personal data into an AI assistant, chatbot or API processed in another country;
• documents, recordings or datasets are uploaded to an AI service hosted abroad;
• the vendor keeps prompts, outputs, logs or telemetry containing personal data abroad;
• staff of the vendor or its sub-processors access data remotely from another country, for example for support or abuse review;
• data is sent to train, fine-tune or evaluate a model on foreign infrastructure.

1.3. Data that, before leaving, has been anonymized so that people are no longer identifiable by reasonable means is excluded. The anonymization is documented in part D.

1.4. This file complements, and does not replace, the data processing agreement (DPA) with the vendor, vendor due diligence and the data protection impact assessment where one is needed.

2. Definitions

• Exporter: the entity that sends the data or allows access to it from another country. In this file, [LEGAL ENTITY NAME].
• Importer: the entity that receives or accesses the data, usually the AI vendor or its sub-processor.
• Transfer: disclosure of data to a third party in another country that decides how the data is used. Some laws distinguish it from disclosure to a processor acting on the exporter's behalf (for example, disclosure to a processor (persona encargada) in Mexico or "transmisión" in Colombia).
• Transfer mechanism: the ground that permits the international transfer: a country with recognized adequate protection, standard or model contractual clauses, binding corporate rules, certification, authorization by the authority, consent or a legal exception.
• Transfer impact assessment: an analysis of whether the laws and practices of the destination country allow the chosen safeguards to work in practice.
• Supplementary measures: technical, contractual or organizational measures added to the mechanism to address the risks identified.