---
sourceDocument: Australia Governance, Risk, and Compliance
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/governance-risk-compliance

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Governance, Risk, and Compliance

ft:clusterId :

    - grc

bundleId :

    - grc

workflow :

    - Technology


---

# Manage data transfers

# Manage data transfers {#ariaid-title1}

Release version: Australia  
Updated August 17, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Manage data transfers

Organizations often transfer personal data across applications, vendors, business units, and regions, which must comply with privacy regulations.
ServiceNow Privacy Management captures these movements as data transfer records linked to processing activities, helping privacy teams track data flow, involved data subjects, and legal safeguards.
Show full answer Show less  
Data transfer records represent specific personal data movements between nodes (such as entities, applications, or locations) within a processing activity, particularly when crossing regional boundaries.

## How Data Transfer Records Are Generated

Records are automatically generated based on hierarchy relationships in a processing activity. Specifically, relationships of type **Send data to** and **Received data from** trigger creation of transfer records reflecting the movement of personal data between nodes.

For example, if a recruiting application in Germany sends data to an HR platform in Australia, a data transfer record is created for this specific flow.

## Data Subject Selection

The Send data to and Received data from relationship types support **data subject selection**, capturing whose personal data is transferred, their locations, and affected data elements. This enables generation of additional data transfer records detailing the flow from data subject locations to involved nodes, increasing traceability.

Privacy administrators can enable this feature for custom relationship types by configuring the `snprivacy.relationshipinvolvingdatasubjects` system property.

## Adding and Managing Data Transfers

* Data transfer records are added by business users through privacy impact assessments or directly by analysts on the processing activity hierarchy tab.
* Analysts can also manually record transfers on the Regulatory details \> Data transfers tab.
* During assessment reviews, irrelevant or inaccurate transfer records can be removed or adjusted.

## Transfer Mechanisms

Each data transfer record must be assigned a **transfer mechanism** that defines the legal safeguard authorizing the data movement, such as Binding Corporate Rules or Standard Contractual Clauses. Analysts review and assign these mechanisms to ensure compliance.

Privacy managers can add or update transfer mechanisms within the Privacy Workspace to reflect organizational or regulatory needs.

## Roles and Responsibilities

* **Business users**: Define data flows in privacy assessments.
* **Privacy analysts**: Review data transfers and assign transfer mechanisms.
* **Privacy managers**: Manage transfer mechanisms in the system.
* **Privacy admins**: Configure system properties to enable enhanced data subject selection features.

## Practical Usage

* Create data transfer records automatically through relationships or manually if needed.
* Delete incorrect or obsolete data transfer records during assessment reviews.
* Assign appropriate transfer mechanisms to demonstrate legal compliance for each data movement.

This functionality empowers ServiceNow customers to maintain comprehensive, auditable records of personal data flows within their privacy programs, supporting regulatory compliance and informed privacy risk management.  
Organizations often transfer personal data between applications, vendors, business units, and regions, which are subject to privacy regulations. Privacy Management captures each movement as a data transfer record on the processing activity to help you comply with privacy regulations.

## Overview of data transfer {#data-transfers__overview-of-data-transfer}

When personal data moves between nodes in a processing activity, including entities, business
applications, business processes, companies, vendors, and locations, privacy teams must track where the data goes, whose data is involved, and which legal safeguards permit each movement. Data transfer records capture this
information on the processing activity. Each record represents a specific movement of personal data from one node to another, across regions.

## How data transfer records are generated {#data-transfers__data-transfer-process}

Data transfer records are generated from hierarchy relationships on a processing activity. When you create a relationship that involves sending or receiving personal data from one node to another, the system generates a transfer
record for that movement.

By default, only the following relationship types generate data transfer records:

* Send data to
* Received data from

{#data-transfers__ul_yys_qzh_lkc}

For information on the different relationship types, see [Hierarchy relationship forms in Privacy Management](https://www.servicenow.com/docs/_HO1~uUhchx0T2NUeeis0g "When you create a new hierarchy relationship in Privacy Management, you first define how a node is related to another, and then provide details for each related node.").

Data transfer example
:   Consider a Recruitment processing activity that depends on an HR platform in Australia and a recruiting application in Germany. The recruiting application sends personal data to the HR platform. To capture this data flow,
    you define a relationship with the following details:
:
    * Primary record: Recruitment processing activity
    * Primary node: Recruiting application
    * Primary node location: Germany
    * Relationship type: Sends data to
    * Related node: HR platform
    * Related node location: Australia
    {#data-transfers__ul_jqt_113_lkc}
: This relationship generates one data transfer record: Germany (Recruiting application) to Australia (HR platform).  
The Send data to and Received data from relationship types have data subject selection enabled, which captures whose personal data is involved in the transfer, their locations, and the impacted data elements. When you add this information, the system generates additional data transfer records from each data subject location to each node involved in the movement.  
Note:  
A privacy admin can enable data subject selection in custom relationship types by modifying the sn_privacy.relationship_involving_data_subjects system property. For steps, see [Configure data subject selection in hierarchy relationships](https://www.servicenow.com/docs/USQYCWn6dH71~3wNMOBODg "Enable data subject selection in custom relationship types by configuring the sn_privacy.relationship_involving_data_subjects system property.").

Data transfer example with data subject selection
:   In the same example, consider that the recruiting application sends personal data of employees located in California to the HR platform. So, you add the following data subject information to the above relationship:
:
    * Data subject type: Employees
    * Data subject location: California
    {#data-transfers__ul_yl2_gb3_lkc}
:   This generates two additional transfer records for the same relationship, capturing
    employee personal data movement from California (Employees) to Germany (Recruiting application), and from California (Employees) to Australia (HR platform).

You can remove transfers that don't apply during the assessment review. For steps, see [Review a privacy assessment](https://www.servicenow.com/docs/NM0CwMbfFoS4b9ic1ge56Q "Review a privacy assessment after the business user submits it. You can either close the assessment after a review or request a revision if you determine that the assessment requires more information.").

## Adding data transfers to a processing activity {#data-transfers__section_mrf_f2k_hkc}

Data transfer records are added to a processing activity in one of the following ways:

* A business user defines hierarchy relationships in a privacy impact assessment (PIA) and submits it. The system generates data transfer records for each movement of personal data between the nodes involved. When an analyst marks the assessment as complete, these records are mapped to the processing activity.
* An analyst creates a Sends data to or Received data from hierarchy relationship directly on the Processing data inventoryHierarchy tab of the processing activity. Data transfer records are automatically generated in the Regulatory detailsData transfers tab.
* An analyst manually records data transfers on the Regulatory detailsData transfers tab of the processing activity.
{#data-transfers__ul_l2w_5zj_hkc}

## Transfer mechanisms {#data-transfers__section_transfer_mechanisms}

An analyst reviews the data transfer records generated for a processing activity and assigns each one a transfer mechanism. A transfer mechanism identifies the legal safeguard that permits data transfers, such as Binding Corporate Rules
(BCRs) or Standard Contractual Clauses (SCCs). To learn about different transfer mechanisms in Privacy Management, see [Transfer mechanisms](https://www.servicenow.com/docs/bqxbSkctbHKr1MPncT3i2Q "Transfer mechanisms identify the legal safeguard that permits a specific data transfer between locations.").

* To add a transfer mechanism to a data transfer record, see [Add a transfer mechanism to a data transfer record](https://www.servicenow.com/docs/sqxZmZh_zVrI6s9jOrD~Yw "Assign a transfer mechanism to a data transfer record to document the legal safeguard that permits the transfer of personal data.").
* To add new transfer mechanisms in your Privacy Workspace, see [Manage transfer mechanisms in the Privacy Workspace](https://www.servicenow.com/docs/JrvlLr~EPwveWq9BNYvuvg "Add or update the existing transfer mechanisms in your Privacy Management application, so that privacy analysts can add them to data transfer records.").
{#data-transfers__ul_ktd_ybk_hkc}

## Role requirements {#data-transfers__section_roles}

{#data-transfers__table_hql_hdk_hkc__entry__3}

| User | Required role | Task |
|-|-|-|
| Business user | sn_privacy.business_user and sn_privacy.assessment_responder | Defines data flows through hierarchy relationships in a privacy assessment. |
| Privacy analyst | sn_privacy.analyst | Reviews data transfers and adds corresponding transfer mechanisms. |
| Privacy manager | sn_privacy.manager | Adds new transfer mechanisms in the application or updates existing ones. |
| Privacy admin | sn_privacy.admin | Configures the sn_privacy.relationship_involving_data_subjects system property to support data subject selection in custom relationships. |
[ ]

{#data-transfers__table_hql_hdk_hkc}
* **[Create a data transfer](https://www.servicenow.com/docs/sBVQAAVeQ_OhsmAS12NMaA)**   
  Record a data transfer directly on a processing activity if it wasn't captured as part of a hierarchy relationship.
* **[Delete a data transfer](https://www.servicenow.com/docs/Cf0_sXjauIAX4NqH3LnGRQ)**   
  Delete a data transfer record from a processing activity.
* **[Transfer mechanisms](https://www.servicenow.com/docs/bqxbSkctbHKr1MPncT3i2Q)**   
  Transfer mechanisms identify the legal safeguard that permits a specific data transfer between locations.

*[\>]: and then