To ensure the approved cross-border transfer management requirements are translated into effective operational activities, controls, and services rather than remaining documented intentions.
Translate the approved cross-border data transfers into plans, workstreams, controls, milestones, resources, and measurable outcomes. Track execution and resolve deviations through formal governance.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| CIS-V8 | CIS Controls CIS Controls are a prioritized set of cybersecurit... Clause: Control 03 – Data Protection: 3.8 – Document Data Flows |
CIS
Best Practice
|
vv8 | View → |
| DORA | Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 9(2) – ICT security policies, procedures, protocols and tools for resilience and data security Article 8(5) – Identification/documentation of ICT third-party dependencies supporting critical or important functions |
EU
Regulation
|
vCurrent | View → |
| DPDP | Digital Personal Data Protection Act The Digital Personal Data Protection Act, 2023 est... Clause: 16(1)-(2) – Processing of personal data outside India / restrictions and higher protection under other Indian law |
India
Law
|
v2023 | View → |
| GDPR | General Data Protection Regulation (GDPR) The General Data Protection Regulation is a bindin... Clause: Article 44 – General principle for transfers; Article 45 – Transfers on the basis of an adequacy decision; Article 46 – Transfers subject to appropriate safeguards |
EU
Regulation
|
vCurrent | View → |
| HIPAA | Health Insurance Portability and Accountability Act HIPAA is a U.S. federal law supported by implement... Clause: § 164.312(g) Standard: Transmission security; § 164.316(a)(1) Policies and procedures documentation |
US
Law
|
vCurrent | View → |
| IRDAI | IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §2.16-3.4 – Transfer and Movement; §2.12-3.1 – Use of Cryptography |
India
Guideline
|
vLatest | View → |
| ISO27001 | ISO/IEC 27001 ISO/IEC 27001 specifies auditable requirements for... Clause: 7.5.1 – General 7.5.3 – Control of documented information |
ISO
Standard
|
v2022 | View → |
| ISO27002 | ISO/IEC 27002 ISO/IEC 27002 is a guidance standard containing a... Clause: 5.33 – Protection of records |
ISO
Standard
|
v2022 | View → |
| ISO27701 | ISO/IEC 27701 ISO/IEC 27701 provides requirements and guidance f... Clause: A.7.5.1; A.7.5.2; A.7.5.3; B.8.5.1; B.8.5.2; 6.5.2.4; A.7.5.1 – Identify basis for PII transfer between jurisdictions; A.7.5.2 – Countries and international organizations to which PII may be transferred; A.7.5.3 – Records of transfer of PII; B.8.5.1 – Basis for PII transfer between jurisdictions; B.8.5.2 – Countries and international organizations to which PII may be transferred; 6.5.2.4 – Information transfer (privacy) |
ISO
Privacy Standard
|
v2019 | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: ID.AM – Asset Management | ID.AM-07 – Inventories of data and corresponding metadata for designated data types are maintained PR.DS – Data Security | PR.DS-01 – The confidentiality, integrity, and availability of data-at-rest are protected |
NIST
Framework
|
v2 | View → |
| NPCI-ISR | NPCI Information Security Requirements NPCI information-security requirements define cont... Clause: Security Measures / Controls; Data Security |
India
Standard
|
vLatest | View → |
| PCI-DSS | PCI DSS PCI DSS is an industry security standard maintaine... Clause: 4.2.1 – Strong cryptography and security protocols; 4.2.2 – PAN is secured with strong cryptography |
PCI
Standard
|
v4 | View → |
| RBI-CSF | RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: 1) Inventory Management of Business IT Assets – 1.3 Protection of data/information across storage, transmission, processing and access, inside/outside the bank; 11) Vendor Risk Management – 11.7 Legal/regulatory requirements for geographic location of infrastructure and cross-border data movement |
India
Regulation
|
vLatest | View → |
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 1.1 GV.OC: Organizational Context; 3.3 PR.DS: Data Security |
India
Regulation
|
vLatest | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: P6.1 – Privacy: Disclosure and Notification – The entity discloses personal information to third parties with the explicit consent of data subjects and such consent is obtained prior to disclosure to meet the entity’s objectives related to privacy. |
AICPA
Audit Framework
|
vLatest | View → |