The Court of Justice of the European Union's Schrems II judgment (C-311/18) confirmed that organisations must consider whether the laws and practices of the destination country may undermine the level of protection required under EU data protection law. Where necessary, appropriate supplementary measures must be implemented.
This guide explains how to assess international transfers, when a Transfer Impact Assessment (TIA) is appropriate, how the EDPB methodology works, and how to document the outcome.
Important: This guide is for general compliance information and does not constitute legal advice. Transfer requirements depend on the specific data, parties, destination country, transfer mechanism and processing activities.
§What Did Schrems II Change?
The Schrems II judgment of 16 July 2020 invalidated the EU-US Privacy Shield while confirming that Standard Contractual Clauses remain a valid transfer mechanism in principle.
However, organisations relying on SCCs cannot treat the clauses as sufficient by themselves. They must consider whether the legal system and practices in the destination country allow the protections contained in the SCCs to operate effectively.
Where necessary, additional safeguards may be required.
The EDPB subsequently developed a six-step methodology for assessing international transfers and identifying supplementary measures.
The practical principle
- Identify the transfer
- Identify the legal mechanism
- Assess the destination country
- Determine supplementary measures
- Document the decision
- Monitor for change
§What Is a Transfer Impact Assessment?
A Transfer Impact Assessment (TIA) is a documented assessment of an international data transfer designed to determine whether the transfer mechanism provides an appropriate level of protection in the circumstances.
A TIA can examine:
- What personal data is being transferred
- Who is receiving the data
- Where the data is being transferred
- The purpose and nature of the processing
- The transfer mechanism being relied upon
- Laws and practices in the destination country
- Potential government or public-authority access
- Available data-subject rights and remedies
- Technical, contractual and organisational safeguards
- Whether supplementary measures are necessary
- Whether the transfer can proceed and under what conditions
A TIA should be based on the specific transfer scenario, rather than relying only on a generic country assessment.
§When Should an Organisation Assess an International Transfer?
Start by identifying whether personal data is being transferred to, or made accessible from, a country outside the EEA.
Relevant scenarios can include:
- Using a non-EEA cloud provider
- Hosting personal data outside the EEA
- Remote access by personnel located outside the EEA
- Sharing data with an overseas processor or sub-processor
- Using international customer-support teams
- Sending data to an overseas analytics or advertising provider
- International intra-group data access
- Onward transfers by processors
The transfer analysis should be based on the actual processing environment, including cloud regions, remote access arrangements, backups and sub-processors.
§Step 1 — Map and Understand the Transfer
You cannot adequately assess a transfer that you have not identified.
Create an inventory covering:
Data
- Categories of personal data
- Special-category data
- Sensitive or confidential information
- Volume and frequency
- Number and location of data subjects
Parties
- Controller
- Processor
- Sub-processors
- Affiliates
- Service providers
- Other recipients
Locations
- Origin of the data
- Destination country
- Hosting location
- Backup locations
- Remote-access locations
- Onward-transfer destinations
Processing
- Purpose
- Nature of processing
- Retention period
- Access requirements
- Encryption arrangements
- Authentication and access controls
Your Article 30 records, vendor register, data-flow diagrams and cloud architecture can provide useful starting points, but they should be validated against the actual technical environment.
§Step 2 — Identify the Transfer Mechanism
Chapter V of the GDPR provides several mechanisms for international transfers.
Adequacy Decisions
Under Article 45, the European Commission may recognise that a country or specified framework provides an adequate level of protection.
Where a transfer is properly covered by an adequacy decision, organisations do not need to rely on SCCs for that transfer.
However, organisations should document:
- The destination
- The applicable adequacy decision
- The recipient covered by the decision
- The scope of the decision
- Any relevant limitations
Standard Contractual Clauses
SCCs under Article 46 are one of the most commonly used mechanisms for international transfers.
The appropriate module depends on the relationship between the parties:
- Module 1 — Controller to Controller
- Module 2 — Controller to Processor
- Module 3 — Processor to Processor
- Module 4 — Processor to Controller
Where SCCs are used, the parties should assess whether the destination country's laws and practices could prevent the SCC protections from being effective.
Binding Corporate Rules
Approved Binding Corporate Rules can support transfers within multinational groups.
They do not eliminate the need for organisations to understand the circumstances of the particular transfer and the applicable legal environment.
Article 49 Derogations
Article 49 contains limited derogations for specific situations, including certain cases involving:
- Explicit consent
- Contractual necessity
- Important reasons of public interest
- Vital interests
- Other circumstances specified by the GDPR
Derogations should not normally be treated as a routine substitute for an appropriate long-term transfer mechanism.
§Step 3 — Assess the Destination Country
This is the core of the transfer assessment.
The organisation should consider whether the destination country's laws and practices could interfere with the protections required under the chosen transfer mechanism.
Relevant factors can include:
Government and surveillance powers
Assess:
- Government access powers
- National-security legislation
- Law-enforcement access
- Scope of surveillance powers
- Conditions for access
- Independent oversight
- Judicial authorisation
- Necessity and proportionality safeguards
Data-subject rights
Consider whether individuals have meaningful and enforceable rights, including:
- Access
- Correction
- Objection
- Judicial remedies
- Independent oversight
- Effective redress mechanisms
Rule of law
The assessment may also consider:
- Judicial independence
- Transparency
- Regulatory oversight
- Availability of effective remedies
- Enforcement practices
The EDPB's European Essential Guarantees framework provides a useful reference point for analysing surveillance measures.
§Step 4 — Identify Supplementary Measures
Where the destination-country assessment identifies risks that are not sufficiently addressed by the transfer mechanism, supplementary measures may be necessary.
The EDPB broadly discusses technical, contractual and organisational measures.
Technical measures
Depending on the transfer, these may include:
- Strong encryption
- Encryption with appropriate key-management controls
- Pseudonymisation
- Access controls
- Segmentation
- Split processing
- Confidential computing
- Secure processing environments
- Data minimisation
The effectiveness of a measure depends on the specific threat and transfer scenario.
For example, encryption may provide strong protection where the recipient cannot access the decryption keys.
Contractual measures
Potential measures include:
- Government-access notification commitments where legally permitted
- Transparency obligations
- Challenge obligations for unlawful or disproportionate requests
- Audit rights
- Security requirements
- Data-subject assistance
- Sub-processor controls
- Incident-management requirements
Contractual provisions cannot, by themselves, override mandatory law in the destination country. Their effectiveness should therefore be assessed in context.
Organisational measures
These may include:
- Government-access response procedures
- Internal access restrictions
- Employee training
- Data minimisation policies
- Transparency reporting
- Strict authorisation procedures
- Policies governing disclosure requests
- Regular transfer assessments
§Step 5 — Document the TIA
A defensible TIA should be written, evidence-based and specific to the transfer.
A practical TIA record can contain:
Transfer profile
- Exporter
- Importer
- Data categories
- Data subjects
- Processing purposes
- Destination
- Frequency
- Volume
- Retention
Transfer mechanism
- Adequacy decision
- SCC module
- BCR
- Article 49 derogation
- Other applicable mechanism
Legal assessment
- Relevant destination-country laws
- Government-access powers
- Surveillance framework
- Data-subject rights
- Remedies
- Regulatory environment
Risk assessment
- Identified risks
- Likelihood
- Potential impact
- Existing safeguards
- Residual risk
Supplementary measures
- Technical
- Contractual
- Organisational
Final conclusion
The organisation should document whether:
- A. The transfer can proceed as assessed;
- B. The transfer can proceed subject to specified supplementary measures; or
- C. The transfer should not proceed unless the transfer arrangement is changed.
§Step 6 — Reassess When Circumstances Change
A TIA should not be treated as a document that is completed once and forgotten.
Reassessment may be appropriate when there is a material change in:
- Destination-country law
- Government-access practices
- Regulatory guidance
- Court decisions
- Importer
- Sub-processor
- Processing purpose
- Data categories
- Security architecture
- Transfer mechanism
- Technical safeguards
An organisation may also establish a periodic review cycle as part of its privacy governance programme.
The EDPB methodology specifically calls for re-evaluation at appropriate intervals and when circumstances change.
§EU-US Data Transfers and the Data Privacy Framework
The EU-US Data Privacy Framework introduced an adequacy framework for transfers to eligible US organisations that participate in the framework.
This is important because a transfer to a covered, certified US organisation can rely on the relevant adequacy decision rather than automatically requiring SCCs.
However, organisations should verify:
- Whether the US recipient is currently certified
- Whether the certification covers the relevant service and data
- Whether the transfer is within the scope of the adequacy decision
- Whether onward transfers are appropriately covered
- Whether other recipients or sub-processors are subject to different transfer mechanisms
The DPF should therefore be assessed at the level of the actual transfer rather than simply treating "the US" as one transfer category.
§Does Every International Transfer Need a TIA?
No — not in the sense that every international transfer must have a standalone document called a "TIA."
The legal analysis depends on the transfer mechanism and circumstances.
For example:
- An applicable adequacy decision can provide the transfer mechanism under Article 45.
- SCC-based transfers require appropriate assessment of the destination country's laws and practices.
- BCR transfers require consideration of the applicable circumstances.
- Article 49 derogations have their own specific requirements and limitations.
Even where a standalone TIA is not legally required, documenting the transfer basis and assessment can be valuable for accountability and governance.
§TIA vs. Data Transfer Agreement
These documents serve different purposes.
| TIA | Data Transfer Agreement / SCCs |
|---|---|
| Assesses the transfer risk and legal environment | Establishes contractual obligations |
| Examines destination-country law and practice | Sets requirements between the parties |
| Identifies supplementary measures | Allocates responsibilities |
| Supports the transfer decision | Provides the contractual transfer mechanism where applicable |
| Documents the reasoning | Creates enforceable contractual commitments |
A TIA does not replace SCCs where SCCs are the chosen transfer mechanism.
Likewise, signing SCCs does not remove the need to assess whether the transfer can operate effectively in the destination country.
§Common TIA Mistakes
Mistake 1: Treating SCCs as sufficient on their own
SCCs are important, but the transfer assessment must consider the destination country's legal environment.
Mistake 2: Using a generic country assessment
A transfer involving encrypted pseudonymised data may present very different risks from a transfer involving identifiable health information.
Mistake 3: Ignoring remote access
Remote access from another country can be relevant to the transfer analysis.
Mistake 4: Ignoring sub-processors
A primary vendor may not be the only organisation receiving or accessing the data.
Mistake 5: Treating encryption as automatically sufficient
The effectiveness of encryption depends on key management, access rights, technical architecture and the specific threat.
Mistake 6: Relying only on the absence of previous government requests
Historical experience can be relevant evidence, but it should not replace an assessment of the applicable legal framework.
Mistake 7: Failing to update the assessment
A material legal, regulatory, contractual or technical change can affect the original conclusion.
§TIA Documentation Checklist
Before closing a TIA, verify that you have documented:
- Transfer scenario
- Data categories
- Data subjects
- Exporter and importer
- Destination country
- Sub-processors
- Hosting and remote-access locations
- Transfer mechanism
- Destination-country legal assessment
- Government-access analysis
- Data-subject rights and remedies
- Existing technical safeguards
- Contractual safeguards
- Organisational safeguards
- Supplementary measures
- Residual risk
- Final transfer decision
- Responsible stakeholders/sign-off
- Review triggers
- Next review date
§Frequently Asked Questions
Is a TIA mandatory under GDPR?
The GDPR does not prescribe a universal standalone document called a "TIA" for every international transfer. However, organisations relying on transfer mechanisms such as SCCs need to assess the circumstances of the transfer and whether the destination country's laws and practices affect the required level of protection.
Are SCCs still valid after Schrems II?
Yes. Schrems II did not invalidate the SCCs generally. It confirmed that organisations must assess whether they can provide effective protection in the specific transfer circumstances.
Can encryption solve an international transfer problem?
Potentially, but not automatically. The effectiveness of encryption depends on the implementation, key management, access arrangements, the data involved and the relevant threat model.
Do we need a separate TIA for every processor?
Not necessarily. Organisations may be able to group sufficiently similar transfer scenarios where the factual and legal circumstances are materially similar. The assessment should nevertheless remain specific enough to support the actual transfer decision.
Does GDPR Article 3 territorial scope eliminate Chapter V requirements?
No. The EDPB's Guidelines 05/2021 address the interaction between Article 3 and Chapter V and explain that certain processing activities subject to Article 3(2) can still involve international transfers subject to Chapter V requirements.
What happens if supplementary measures cannot address the risk?
If the required level of protection cannot be achieved, the organisation may need to modify, suspend or avoid the transfer, depending on the applicable transfer mechanism and circumstances.
Build a Defensible International Transfer Programme
A robust transfer programme should combine:
- Transfer Mapping
- Legal Mechanism
- Country Assessment
- Supplementary Measures
- Documentation
- Continuous Monitoring
RegulatoryBridge can support organisations with international transfer assessments, TIA documentation, SCC implementation, supplementary-measure analysis and cross-border privacy governance.
Need help assessing an international transfer? Contact RegulatoryBridge to discuss your transfer scenario.