1. The transfer

Quillmarrow sends order and delivery information to DV-01, Tanjung Contoh Logistics Sdn. Bhd., in Johor so that the partner can pick, pack and deliver Malaysia orders. The information is associated with web-shop orders and delivery details, PD-02, and Malaysia delivery records, PD-11. The recipient acts as a data intermediary for the fulfilment service.

A proposed operating description is that the relevant order details are exported from Fictional ShopCloud and sent to the partner. The case file does not confirm the export method, transfer channel, exact fields, volume or frequency. The IT Manager and Warehouse Manager should verify these before treating the description as an established data flow. The volume should be described qualitatively once known; the case file does not establish whether it is low or high.

The purpose suggests that the partner needs sufficient details to fulfil and deliver an order, potentially including delivery contact and address information and the items ordered. The actual fields sent, and whether each is needed, remain to be checked. Quillmarrow does not see full card numbers through Fictional PayGate; no assumption should be made that payment information is included in the fulfilment export.

This is an overseas transfer because the recipient is in Malaysia. The existing contract has a confidentiality clause but no data protection clauses. The adequacy of the overall arrangements has not been established. The DPO should confirm the applicable requirements and proposed safeguards with a Singapore-qualified lawyer.

2. Checklist worked through

Status key: Done means the finding is established for this review; Open means further action or a decision is needed; Missing means the relevant information or evidence was not provided. A completed checklist item does not establish that the whole transfer is appropriately safeguarded.

The DPO should add the missing evidence and actions to B2 under G-09, with related security and retention actions under G-07 and G-08. For the notice and breach arrangements, also track G-04 and G-10. The Warehouse Manager should confirm the operational flow with DV-01, and the IT Manager should test the proposed transfer method rather than relying on a description alone.

3. Conclusion and proposed management decision

Decision owner: Managing Director (MD).
Proposed decision due: 30 November 2026.

The proposed management decision is to continue the Malaysia transfer while a data protection annex with DV-01 is negotiated, subject to the interim controls below. This is a decision for the MD to make, not a record that continuation has already been approved. The DPO should obtain advice from a Singapore-qualified lawyer on the legal sufficiency of both the interim arrangements and the completed contract before the decision is relied on.

Proposed interim controls:

1. Minimise export fields. The Warehouse Manager and IT Manager should document the fields required for fulfilment, remove unnecessary fields from the proposed export and retain an approved field list. Verify the actual file or system output using masked information.
2. Use encrypted transfer. The IT Manager should agree and test an encrypted channel with DV-01, restrict access to authorised recipients and retain evidence of the test. The current channel and encryption are not confirmed.
3. Obtain deletion confirmation. The Warehouse Manager should agree what completed-order information the partner may delete, when, and how confirmation will be provided. Check the instruction against the confirmed RS-20 decision and any documented hold before deletion.
4. Establish contacts and escalation. The DPO should agree named roles and contact routes for suspected breaches and individual requests. Test that requests can be forwarded to Quillmarrow without unnecessary delay.
5. Track the annex and evidence. The DPO should record the negotiation owner, outstanding clauses and review date in B2. Missing partner evidence remains open until received and assessed.

The MD should review the decision if an interim control cannot be implemented, the service or location changes, or the lawyer identifies a material concern. The decision record should state what was approved, any conditions, the evidence considered and the next review date.

4. Second transfer to confirm: Fictional ShopCloud

DV-02, Fictional ShopCloud, is a separate vendor and its hosting region is not yet confirmed. The IT Manager should ask where Quillmarrow’s web-shop data is hosted, accessed, backed up and processed by any subcontractors. A location outside Singapore, or overseas access, may require further transfer assessment; confirm the position with a Singapore-qualified lawyer.

By 30 November 2026, the IT Manager should record the response and supporting evidence in B9 and update the B3 data flow. If the location or safeguards remain unknown, keep G-09 open in B2. Separately, G-07 records that ShopCloud administrator MFA is not in place; its implementation and evidence should be tracked rather than assumed.