Part of the GDPR guide
Transfer Impact Assessment (TIA): How to Do One After Schrems II
If you send personal data outside the EEA under standard contractual clauses, you must check whether the law and practice of the destination country let the importer actually honour them. That check is the transfer impact assessment. It sounds daunting, but for most small companies it is a documented, repeatable analysis per transfer. Here is how to do it.
Why it exists
In Schrems II (C-311/18, 16 July 2020) the Court of Justice held that standard contractual clauses remain valid, but that the exporter must verify, case by case, whether the law and practice of the third country ensure a level of protection essentially equivalent to the EU's, and add supplementary measures where needed. Contracts bind the importer, not the authorities of its country.
The Commission's standard contractual clauses (Implementing Decision (EU) 2021/914) build this in: under Clause 14, both parties warrant that they have no reason to believe the destination country's laws and practices prevent the importer from complying, and they must document the assessment and make it available to the supervisory authority on request (Clause 14(d)).
When you need one
| Transfer basis | TIA needed? |
|---|---|
| Adequacy decision (Article 45 GDPR), for example to Switzerland, Japan, or a US organisation on the Data Privacy Framework List | No. The EDPB confirms that no further steps are needed, though you must monitor whether the decision still stands |
| Standard contractual clauses (Article 46(2)(c)) | Yes, Clause 14 |
| Binding corporate rules or other Article 46 tools | Yes, under the EDPB's recommendations |
| Derogations in Article 49, such as explicit consent for an occasional transfer | No TIA, but the derogations are narrow and interpreted strictly |
Remote access counts: the EDPB treats remote access from a third country to data stored in the EEA as a transfer. A support team in India or a US engineer with production access triggers the same analysis as hosting data abroad.
The EDPB's six steps
The EDPB's Recommendations 01/2020 on supplementary measures (version 2.0, adopted 18 June 2021) set the method:
| Step | What you do |
|---|---|
| 1. Know your transfers | Map every transfer, including onward transfers by your processors and remote access. Your records of processing are the starting point |
| 2. Identify the transfer tool | Adequacy, an Article 46 tool, or an Article 49 derogation. If adequacy applies, stop here |
| 3. Assess the law and practice | Check whether anything in the destination country's law or practice may impinge on the effectiveness of the tool for this specific transfer |
| 4. Adopt supplementary measures | If the tool is not effective on its own, add technical, contractual or organisational measures that close the gap; if none do, do not transfer |
| 5. Procedural steps | Take any formal steps the measures require, for example where they change the clauses |
| 6. Re-evaluate | Monitor developments and re-assess at appropriate intervals |
What to assess in step 3
Clause 14(b) lists the elements to take into account:
- The specific circumstances of the transfer: the length of the processing chain, the number of actors and transmission channels, onward transfers, the type of recipient, the purpose, the categories and format of the data, the economic sector and where the data is stored.
- The laws and practices of the destination country relevant to those circumstances, including any requirements to disclose data to public authorities or measures authorising their access, and the limitations and safeguards that apply.
- Any safeguards added to supplement the clauses, including measures during transmission and processing in the destination country.
Footnote 12 of the clauses and the EDPB allow you to consider the importer's documented practical experience with prior requests from public authorities, or their absence, over a representative period. It is one element, not a conclusion on its own: it must be supported by other objective information, such as case law and reports by independent oversight bodies, and the EDPB stresses that the absence of past requests can never be decisive by itself.
Supplementary measures that work, and those that do not
| Situation (EDPB use case) | Can supplementary measures help? |
|---|---|
| Storage or backup abroad where the provider never needs the data in the clear: strong, state-of-the-art encryption, with keys kept under your control in the EEA or an adequate country (use case 1) | Yes |
| Pseudonymised data where the additional information to re-identify stays with the exporter (use case 2) | Yes, if re-identification by the importer or authorities is not possible |
| Cloud or other processing that requires the provider to access the data in the clear (use case 6) | Given the current state of the art, the EDPB could not envisage an effective technical measure where the destination country allows disproportionate access |
| Remote access to data in the clear for shared business purposes (use case 7) | Same conclusion as use case 6 |
Contractual measures, such as commitments to challenge disproportionate requests, transparency reporting and notification of requests, and organisational measures, such as access policies and data minimisation, support the assessment but cannot by themselves stop access that the destination country's law allows.
US transfers since the Data Privacy Framework
For US organisations on the Data Privacy Framework List, the adequacy decision (Implementing Decision (EU) 2023/1795) applies and no TIA is needed. For US importers that are not certified, you still use standard contractual clauses and a TIA. The EDPB's information note of July 2023 points out that the safeguards the US introduced for national security access, including the redress mechanism, apply to all data transferred to the US, whatever the transfer tool, so exporters should take into account the Commission's assessment in the adequacy decision when assessing their clauses. That makes a US TIA considerably easier than before 2023.
The framework is under challenge at the Court of Justice; see our EU-US Data Privacy Framework guide for the current status. If it falls, the TIA for US transfers would need to be revisited.
A TIA template in practice
- Transfer description: exporter, importer, role of each, data categories, data subjects, purpose, frequency, format, storage location, onward transfers.
- Transfer tool: which module of the clauses, signed when.
- Destination law and practice: the relevant laws on government access, their safeguards and redress, with sources and dates, and whether the importer or the data fall within their scope.
- Importer's experience: documented requests received or not, and what the importer can lawfully disclose.
- Supplementary measures: what you apply and why it addresses the risk identified.
- Conclusion: proceed, proceed with measures, or suspend.
- Review: owner and date, and the triggers for an earlier review, such as a change in law or a new onward transfer.
Keep the TIA with the signed clauses and your records of processing, and check that your privacy notice describes the transfer and how to obtain a copy of the safeguards.
A TIA template ready to fill. The Privacy Impact Assessment Bundle includes a transfer impact assessment template, a DPIA template, a DPIA screening checklist and register, a data protection by design checklist and a DPO consultation record.
Sources
- Court of Justice, Data Protection Commissioner v Facebook Ireland and Schrems (Schrems II), C-311/18, 16 July 2020, EUR-Lex
- Commission Implementing Decision (EU) 2021/914 on standard contractual clauses for transfers to third countries, Clause 14 and footnote 12, EUR-Lex
- EDPB Recommendations 01/2020 on measures that supplement transfer tools, version 2.0 (18 June 2021)
- EDPB Information note on data transfers under the GDPR to the United States after the adoption of the adequacy decision (July 2023)
- Regulation (EU) 2016/679 (GDPR), Articles 44 to 49, EUR-Lex
Related tools
Further reading: EU-US Data Privacy Framework · Data Processing Agreement Checklist
ClevSec
Compliance & security tools for modern businesses
We build practical tools and templates that help startups and SMBs stay compliant with NIS2, GDPR, and DORA. Explore our free tools →
This article is for informational purposes only and does not constitute legal advice. Last updated: October 2026.