# ANNEX I **Commission Implementing Decision (EU) 2021/914 · binding on its addressees · dated 4 Jun 2021 [in force]** *In force · Commission Implementing Decision (EU) 2021/914, OJ L 199, 7.6.2021 · Checked against EUR-Lex on 26 Oct 2026 · [Official source](https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj/eng)* A. LIST OF PARTIES MODULE ONE: Transfer controller to controller MODULE TWO: Transfer controller to processor MODULE THREE: Transfer processor to processor MODULE FOUR: Transfer processor to controller Data exporter(s): \[Identity and contact details of the data exporter(s) and, where applicable, of its/their data protection officer and/or representative in the European Union\] 1. Name: ... Address: ... Contact person’s name, position and contact details: ... Activities relevant to the data transferred under these Clauses: ... Signature and date: ... Role (controller/processor): ... 2. ... Data importer(s): \[Identity and contact details of the data importer(s), including any contact person with responsibility for data protection\] 1. Name: ... Address: ... Contact person’s name, position and contact details: ... Activities relevant to the data transferred under these Clauses: ... Signature and date: ... Role (controller/processor): ... 2. ... B. DESCRIPTION OF TRANSFER MODULE ONE: Transfer controller to controller MODULE TWO: Transfer controller to processor MODULE THREE: Transfer processor to processor MODULE FOUR: Transfer processor to controller Categories of data subjects whose personal data is transferred ... Categories of personal data transferred ... Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures. ... The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis). ... Nature of the processing ... Purpose(s) of the data transfer and further processing ... The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period ... For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing ... C. COMPETENT SUPERVISORY AUTHORITY MODULE ONE: Transfer controller to controller MODULE TWO: Transfer controller to processor MODULE THREE: Transfer processor to processor Identify the competent supervisory authority/ies in accordance with Clause 13 ...