Loading…
The Court of Justice of the European Union's Schrems II judgment (C-311/18) confirmed that organisations must consider whether the laws and practices of the destination country may undermine the level of protection required under EU data protection law. Where necessary, appropriate supplementary measures must be implemented.
This guide explains how to assess international transfers, when a Transfer Impact Assessment (TIA) is appropriate, how the EDPB methodology works, and how to document the outcome.
Important: This guide is for general compliance information and does not constitute legal advice. Transfer requirements depend on the specific data, parties, destination country, transfer mechanism and processing activities.
The Schrems II judgment of 16 July 2020 invalidated the EU-US Privacy Shield while confirming that Standard Contractual Clauses remain a valid transfer mechanism in principle.
However, organisations relying on SCCs cannot treat the clauses as sufficient by themselves. They must consider whether the legal system and practices in the destination country allow the protections contained in the SCCs to operate effectively.
Where necessary, additional safeguards may be required.
The EDPB subsequently developed a six-step methodology for assessing international transfers and identifying supplementary measures.
A Transfer Impact Assessment (TIA) is a documented assessment of an international data transfer designed to determine whether the transfer mechanism provides an appropriate level of protection in the circumstances.
A TIA can examine:
A TIA should be based on the specific transfer scenario, rather than relying only on a generic country assessment.
Start by identifying whether personal data is being transferred to, or made accessible from, a country outside the EEA.
Relevant scenarios can include:
The transfer analysis should be based on the actual processing environment, including cloud regions, remote access arrangements, backups and sub-processors.
You cannot adequately assess a transfer that you have not identified.
Create an inventory covering:
Your Article 30 records, vendor register, data-flow diagrams and cloud architecture can provide useful starting points, but they should be validated against the actual technical environment.
Chapter V of the GDPR provides several mechanisms for international transfers.
Under Article 45, the European Commission may recognise that a country or specified framework provides an adequate level of protection.
Where a transfer is properly covered by an adequacy decision, organisations do not need to rely on SCCs for that transfer.
However, organisations should document:
SCCs under Article 46 are one of the most commonly used mechanisms for international transfers.
The appropriate module depends on the relationship between the parties:
Where SCCs are used, the parties should assess whether the destination country's laws and practices could prevent the SCC protections from being effective.
Approved Binding Corporate Rules can support transfers within multinational groups.
They do not eliminate the need for organisations to understand the circumstances of the particular transfer and the applicable legal environment.
Article 49 contains limited derogations for specific situations, including certain cases involving:
Derogations should not normally be treated as a routine substitute for an appropriate long-term transfer mechanism.
This is the core of the transfer assessment.
The organisation should consider whether the destination country's laws and practices could interfere with the protections required under the chosen transfer mechanism.
Relevant factors can include:
Assess:
Consider whether individuals have meaningful and enforceable rights, including:
The assessment may also consider:
The EDPB's European Essential Guarantees framework provides a useful reference point for analysing surveillance measures.
Where the destination-country assessment identifies risks that are not sufficiently addressed by the transfer mechanism, supplementary measures may be necessary.
The EDPB broadly discusses technical, contractual and organisational measures.
Depending on the transfer, these may include:
The effectiveness of a measure depends on the specific threat and transfer scenario.
For example, encryption may provide strong protection where the recipient cannot access the decryption keys.
Potential measures include:
Contractual provisions cannot, by themselves, override mandatory law in the destination country. Their effectiveness should therefore be assessed in context.
These may include:
A defensible TIA should be written, evidence-based and specific to the transfer.
A practical TIA record can contain:
The organisation should document whether:
A TIA should not be treated as a document that is completed once and forgotten.
Reassessment may be appropriate when there is a material change in:
An organisation may also establish a periodic review cycle as part of its privacy governance programme.
The EDPB methodology specifically calls for re-evaluation at appropriate intervals and when circumstances change.
The EU-US Data Privacy Framework introduced an adequacy framework for transfers to eligible US organisations that participate in the framework.
This is important because a transfer to a covered, certified US organisation can rely on the relevant adequacy decision rather than automatically requiring SCCs.
However, organisations should verify:
The DPF should therefore be assessed at the level of the actual transfer rather than simply treating "the US" as one transfer category.
No — not in the sense that every international transfer must have a standalone document called a "TIA."
The legal analysis depends on the transfer mechanism and circumstances.
For example:
Even where a standalone TIA is not legally required, documenting the transfer basis and assessment can be valuable for accountability and governance.
These documents serve different purposes.
| TIA | Data Transfer Agreement / SCCs |
|---|---|
| Assesses the transfer risk and legal environment | Establishes contractual obligations |
| Examines destination-country law and practice | Sets requirements between the parties |
| Identifies supplementary measures | Allocates responsibilities |
| Supports the transfer decision | Provides the contractual transfer mechanism where applicable |
| Documents the reasoning | Creates enforceable contractual commitments |
A TIA does not replace SCCs where SCCs are the chosen transfer mechanism.
Likewise, signing SCCs does not remove the need to assess whether the transfer can operate effectively in the destination country.
SCCs are important, but the transfer assessment must consider the destination country's legal environment.
A transfer involving encrypted pseudonymised data may present very different risks from a transfer involving identifiable health information.
Remote access from another country can be relevant to the transfer analysis.
A primary vendor may not be the only organisation receiving or accessing the data.
The effectiveness of encryption depends on key management, access rights, technical architecture and the specific threat.
Historical experience can be relevant evidence, but it should not replace an assessment of the applicable legal framework.
A material legal, regulatory, contractual or technical change can affect the original conclusion.
Before closing a TIA, verify that you have documented:
The GDPR does not prescribe a universal standalone document called a "TIA" for every international transfer. However, organisations relying on transfer mechanisms such as SCCs need to assess the circumstances of the transfer and whether the destination country's laws and practices affect the required level of protection.
Yes. Schrems II did not invalidate the SCCs generally. It confirmed that organisations must assess whether they can provide effective protection in the specific transfer circumstances.
Potentially, but not automatically. The effectiveness of encryption depends on the implementation, key management, access arrangements, the data involved and the relevant threat model.
Not necessarily. Organisations may be able to group sufficiently similar transfer scenarios where the factual and legal circumstances are materially similar. The assessment should nevertheless remain specific enough to support the actual transfer decision.
No. The EDPB's Guidelines 05/2021 address the interaction between Article 3 and Chapter V and explain that certain processing activities subject to Article 3(2) can still involve international transfers subject to Chapter V requirements.
If the required level of protection cannot be achieved, the organisation may need to modify, suspend or avoid the transfer, depending on the applicable transfer mechanism and circumstances.
A robust transfer programme should combine:
RegulatoryBridge can support organisations with international transfer assessments, TIA documentation, SCC implementation, supplementary-measure analysis and cross-border privacy governance.
Need help assessing an international transfer? Contact RegulatoryBridge to discuss your transfer scenario.