Compliance handovers: transferring files that remain open

Draft date: 8 November 2026. Author: Redazione X20 Digital Trust.

A compliance handover works when the new owner can distinguish completed activities, open issues and upcoming deadlines while locating the relevant documents. Providing folder access is insufficient: explain which version is current and which decisions remain necessary. The transfer should make it possible to continue work without reconstructing every case from the beginning.

This guide concerns an organisational method rather than a mandatory procedure for every function. Formal responsibilities and required communications must be assessed in the business's context. Replacing an assigned person does not extinguish organisational duties or automatically authorise disclosure of every document to everyone participating in the handover.

Define the activities being transferred

Describe the scope, identifying companies and processes concerned. A professional may serve several clients while the incoming owner receives only some. The summary should prevent general access being mistaken for assignment of every case. Clarify which activities remain with other people.

State when the new appointment takes effect and how work is handled during transition. A date in the summary does not replace any act required for appointment or delegation. If formalisation remains open, keep that visible and verify who may make decisions meanwhile. The practical handover and formal allocation of authority should support each other rather than leaving an unexplained gap.

Prepare a case status overview

Give each file an identifier and its actual status. Distinguish collecting a document from completing an assessment. A client file may contain all attachments while awaiting further enquiries; a contract may have been analysed but not yet approved. Avoid broad categories concealing the next step.

For open issues, specify the question, the person asked and the latest follow-up. A list of messages does not always explain what is awaited. The incoming owner must understand whether to request a document, assess a response or refer a question to the competent body. References should lead to the actual material rather than a message that mentions an unavailable attachment.

Connect deadlines with their sources

Keep external deadlines separate from internal preparation dates. Link each entry to its supporting rule or document and relevant version. If applicability is uncertain, identify the outstanding assessment rather than making the entry appear an unquestionable requirement inherited from the previous owner.

State the materials needed for near-term activities and who must provide them. Handovers are particularly fragile when a deadline falls during transition. Explicit assignment is needed instead of assuming either predecessor or successor will handle it. The summary should identify the actual owner and make clear who follows up if the materials arrive late.

Identify versions and decisions

Link the policy in force and distinguish it from a proposed revision. For contracts or changes, identify the text actually agreed and requests still under discussion. A recently updated draft may contain changes never approved; its later date does not make them binding.

Connect decisions with available reasons and relevant sources. If the reasoning is undocumented, state that it is missing rather than confidently reconstructing it from a remembered conversation. A handover note can collect useful information, but should distinguish recollection, documentation and matters requiring confirmation. This prevents the incoming owner from treating an informal explanation as an established approval.

An entirely fictional example

The imaginary company “Olmo Operations” changes its compliance contact. An initial summary marks a supplier case complete because a report was uploaded. Opening the file reveals an unanswered enquiry about the signatory's powers. A policy review also falls due during the same period.

The handover is corrected: the case remains open on that specific point with an assigned follow-up owner; the policy review has a designated owner during transition. The new contact receives more than a general folder list. This invented case does not introduce a universal legal rule governing the organisation of functions.

Transfer access according to need

Check the repositories actually required and allocate permissions consistent with activities. Do not share personal credentials to speed up work. Any temporary access should follow organisational measures. Also check removal or adjustment of permissions no longer needed after the handover, avoiding old rights remaining through inertia.

Where personal information is involved, the transfer must respect purposes and authorisations. Provide references without indiscriminately duplicating restricted archives. An external copy may become difficult to update and control. Define where official documentation remains and how working copies are handled. An accessible reference is useful only if the authorised recipient can retrieve it without exposing the file more broadly.

Check that the incoming owner can find documents

A short practical check can reveal broken links or missing permissions. Select an open case and reconstruct its next step using only the summary. If this is impossible, complete the information before treating handover as finished. The aim is actual continuity rather than a receipt signature alone.

The EDPB compliance guide provides references for documentation and data protection. AgID's document management resources help distinguish organisation from preservation without automatically extending every rule to businesses. Applicable sources still require assessment for the specific context.

To compare tools connecting cases, decisions and deadlines with documents, you can view the X20 Digital Trust apps.