A DPIA for a new analytics platform leaves the international-transfer section blank even though EU personal data will be hosted and accessed from outside the EEA. What accountability expectation is unmet?
Select an answer to reveal the explanation.
Short Explanation
If data are leaving the EEA, the risk story has a boarding-pass chapter—you don’t leave that page empty. DPIAs and transfer assessments should talk about where data go and what could go wrong abroad. A random encryption shout-out in an appendix is not the same as analysing the transfer.
Full Explanation
Accountability for international transfers means assessing and documenting risks when personal data leave the EEA, including through DPIA content and/or a dedicated transfer impact analysis as appropriate. Leaving the international-transfer section of a DPIA blank while EU personal data will be hosted and accessed from outside the EEA fails that expectation. Analytics platforms used by municipalities or businesses often combine high volume with third-country tooling—exactly when transfer risk belongs in the assessment file.
DPIAs should not ignore transfers forever as a paperwork silo excuse. Mentioning encryption somewhere in a security appendix does not fill a blank transfer chapter. There is no rule that only residual-risk scores above 99 require transfer discussion.
Exam caveat: DPIA and TIA can be coordinated documents; the exam point is that transfer risks are analysed, not that a particular filename is mandatory. High-risk processing plus third-country access is a classic DPIA trigger cluster.
Operational check: complete the DPIA transfer section with destinations, tools, access patterns, legal mechanisms, and residual risks; attach or cross-reference the TIA; and gate go-live on documented mitigations rather than an empty heading.