Performing Transfer Impact Assessment
Overview
Following the Court of Justice of the European Union (CJEU) judgment in Data Protection Commissioner v Facebook Ireland and Maximillian Schrems (Case C-311/18, 16 July 2020) — commonly known as Schrems II — controllers and processors transferring personal data outside the EEA must assess whether the legal framework of the destination country provides an essentially equivalent level of protection to that guaranteed by the GDPR and the EU Charter of Fundamental Rights. This assessment is known as a Transfer Impact Assessment (TIA). The European Data Protection Board adopted Recommendations 01/2020 on 18 June 2021, establishing a six-step process for conducting TIAs.
Legal Foundation
CJEU C-311/18 Key Holdings
- Privacy Shield invalidated: The EU-US Privacy Shield framework was declared invalid due to US surveillance programmes (Section 702 FISA, EO 12333) enabling mass access to personal data transferred from the EU, with insufficient remedies for EU data subjects.
- Standard Contractual Clauses remain valid in principle: The SCCs decision (2010/87/EU, now replaced by Commission Implementing Decision 2021/914) was upheld but subject to the requirement that data exporters verify the clauses can be complied with in practice in the destination country.
- Case-by-case assessment required: Controllers cannot rely on SCCs mechanically; they must assess the destination country's legal framework and, where necessary, implement supplementary measures to ensure essentially equivalent protection.
- Supervisory authority intervention: Supervisory authorities are required to suspend or prohibit transfers where essentially equivalent protection cannot be ensured.
EDPB Recommendations 01/2020 — Six-Step Process
The EDPB established a structured methodology for evaluating whether transfers can proceed:
Step 1: Know Your Transfers
Map all transfers of personal data to third countries or international organisations:
| Transfer Attribute |
Documentation Required |
| Data exporter |
Legal entity, establishment, contact details |
| Data importer |
Legal entity, country of establishment, sector |
| Personal data categories |
Specific categories transferred (identifiers, financial, health, behavioural) |
| Special categories |
Whether Art. 9 or Art. 10 data is transferred |
| Data subjects |
Categories and approximate number |
| Transfer mechanism |
SCCs, BCRs, Art. 49 derogation, adequacy decision |
| Purpose of transfer |
Specific purposes for which data is transferred |
| Onward transfers |
Whether importer transfers data to further third countries |
| Format |
Whether data is transferred in clear text, pseudonymised, or encrypted |
| Storage vs transit |
Whether data is stored in third country or only transits through it |
Step 2: Identify the Transfer Tool — Chapter V GDPR
| Transfer Mechanism |
GDPR Reference |
Assessment Requirement |
| Adequacy decision |
Art. 45 |
Rely on Commission assessment; monitor for future invalidation |
| Standard Contractual Clauses (new 2021 SCCs) |
Art. 46(2)(c) |
Full TIA required per CJEU C-311/18 |
| Binding Corporate Rules |
Art. 47 |
Full TIA required; BCRs must include supplementary measures |
| Codes of conduct with binding commitments |
Art. 46(2)(e) |
Full TIA required |
| Certification mechanisms |
Art. 46(2)(f) |
Full TIA required |
| Ad hoc contractual clauses |
Art. 46(3)(a) |
Full TIA required plus supervisory authority authorisation |
| Art. 49 derogations |
Art. 49 |
No TIA required but strict conditions apply; derogations must be interpreted restrictively |
Step 3: Assess Third Country Legal Framework
Evaluate whether the destination country's laws and practices provide essentially equivalent protection. Key assessment areas:
3.1 Government Access to Data
| Assessment Factor |
Questions to Address |
| Surveillance legislation |
What laws authorise government access to personal data held by private entities? |
| Scope of access powers |
Is access limited to what is strictly necessary and proportionate, or does it enable bulk/indiscriminate collection? |
| Independent oversight |
Is government access subject to prior authorisation by an independent body (court or independent administrative authority)? |
| Transparency |
Are data subjects notified of government access, either directly or through transparency reporting? |
| Effective remedies |
Do data subjects have access to an independent tribunal or court to challenge government access? |
3.2 Rule of Law and Legal Framework
| Assessment Factor |
Questions to Address |
| Constitutional protections |
Does the country's constitution protect the right to privacy and data protection? |
| Data protection legislation |
Does the country have comprehensive data protection legislation? |
| Independent supervisory authority |
Is there an independent data protection authority with enforcement powers? |
| Judicial independence |
Is the judiciary independent from the executive, with power to review government surveillance? |
3.3 Practical Application
| Assessment Factor |
Sources of Information |
| Government access requests |
Transparency reports from the data importer and major technology companies |
| Enforcement actions |
Published decisions of the destination country's data protection authority |
| Legal reforms |
Pending or recent legislative changes affecting surveillance powers |
| International assessments |
EDPB adequacy referentials, CoE Convention 108+ ratification status |
Step 4: Identify and Adopt Supplementary Measures
Where the assessment in Step 3 reveals that the third country framework does not provide essentially equivalent protection, the exporter must identify supplementary measures that, together with the transfer tool, ensure essentially equivalent protection.
Technical Supplementary Measures
| Measure |
EDPB Assessment |
Effective Against |
| End-to-end encryption where exporter holds the key |
Effective — prevents importer and government access to clear text data |
Government access via importer; importer misuse |
| Pseudonymisation where exporter holds the mapping table |
Effective — if additional information needed to re-identify is held solely in EEA |
Government access where re-identification requires mapping table |
| Split processing across jurisdictions |
Effective — if no single jurisdiction has access to complete dataset |
Government access in any single jurisdiction |
| Transport encryption (TLS/IPSEC) for data in transit |
Insufficient alone — protects only against interception during transit, not access at rest |
Transit interception only |
| Encryption at rest where importer holds decryption key |
Insufficient — importer can be compelled to provide decryption key |
Not effective against government compulsion |
Contractual Supplementary Measures
| Measure |
Purpose |
| Obligation to use all available legal remedies to challenge government access requests |
Ensures importer resists unlawful government access |
| Warrant canary or transparency reporting obligations |
Enables exporter to detect government access |
| Obligation to notify exporter of government access requests (where legally permitted) |
Enables exporter to intervene or suspend transfers |
| Obligation to conduct annual assessment of government access laws |
Ensures ongoing monitoring of legal framework changes |
| Contractual right for exporter to audit importer's compliance |
Enables verification of supplementary measure effectiveness |
Organisational Supplementary Measures
| Measure |
Purpose |
| Adoption of internal policies and procedures for handling government access requests |
Ensures structured response to government demands |
| Appointment of a DPO or privacy officer by the importer |
Ensures designated responsibility for compliance |
| Staff training on government access response procedures |
Ensures operational readiness |
| Regular external audits of government access request handling |
Independent verification of compliance |
Step 5: Procedural Steps for Supplementary Measures
- Document the supplementary measures in writing, either within the SCCs or in a separate supplementary agreement annexed to the SCCs.
- Ensure supplementary measures are legally binding on the data importer.
- Verify that supplementary measures are technically implementable given the processing purposes.
- Assess whether supplementary measures conflict with any obligation of the data importer under the destination country's law.
- If supplementary measures conflict with local law obligations of the importer, the transfer cannot proceed.
Step 6: Re-evaluate at Appropriate Intervals
- Monitor developments in the third country legal framework on an ongoing basis.
- Conduct formal TIA re-evaluation at minimum annually or upon a trigger event.
- Trigger events: new surveillance legislation, court decision affecting data access, adequacy decision adopted or withdrawn, law enforcement action affecting the importer.
- Suspend transfers immediately if supplementary measures can no longer ensure essentially equivalent protection.
TIA Scoring Rubric
Government Access Risk Score
| Factor |
Weight |
Score 1 (Low Risk) |
Score 3 (Medium Risk) |
Score 5 (High Risk) |
| Surveillance legislation scope |
25% |
Targeted access only, strictly necessary and proportionate |
Mix of targeted and bulk powers, some proportionality limitations |
Bulk/indiscriminate access powers without proportionality requirements |
| Independent prior authorisation |
20% |
Judicial authorisation required for all access |
Judicial authorisation for some; administrative for others |
No independent authorisation required; self-authorisation |
| Effective remedies |
20% |
Independent court with full review powers, accessible to foreign nationals |
Administrative review body with limited powers |
No effective remedy available to foreign nationals |
| Transparency and notification |
15% |
Mandatory notification and public transparency reporting |
Partial transparency; notification in some cases |
No notification obligation; limited or no transparency |
| Rule of law and judicial independence |
20% |
Strong constitutional protections; independent judiciary; ratified CoE 108+ |
Some constitutional protections; judiciary generally independent |
Weak or absent constitutional protections; executive influence over judiciary |
Overall TIA Risk Level
| Total Weighted Score |
Risk Level |
Recommendation |
| 1.0 — 2.0 |
Low |
Transfer may proceed with standard transfer tool |
| 2.1 — 3.0 |
Medium |
Transfer may proceed with appropriate supplementary measures |
| 3.1 — 4.0 |
High |
Transfer may proceed only with robust technical supplementary measures (encryption with exporter-held key, pseudonymisation) |
| 4.1 — 5.0 |
Very High |
Transfer should not proceed unless data is encrypted with exporter-held key and importer has no access to clear text data |
Country-Specific Assessment Notes
United States
- Post-Schrems II status: EU-US Data Privacy Framework adopted 10 July 2023 (Commission Implementing Decision C(2023) 4745). US companies self-certified under the DPF benefit from an adequacy decision. Non-certified companies require SCCs with TIA.
- Key legislation: FISA Section 702 (amended by FISA Section 702 reauthorisation in April 2024), EO 14086 (7 October 2022) establishing proportionality requirements and Data Protection Review Court.
- Assessment: For DPF-certified companies, adequacy finding applies. For non-certified companies, TIA must assess whether EO 14086 safeguards are sufficient given the specific data and importer.
United Kingdom
- Post-Brexit status: Adequacy decision adopted 28 June 2021 (Commission Implementing Decision C(2021) 4800), valid until 27 June 2025, extended by new adequacy assessment.
- Key legislation: Investigatory Powers Act 2016, Data Protection Act 2018, UK GDPR.
- Assessment: Adequacy decision currently in force. Monitor for changes to IPA bulk powers and UK divergence from GDPR standards.
India
- Status: No adequacy decision. Digital Personal Data Protection Act 2023 enacted but implementation through rules pending.
- Key legislation: Information Technology Act 2000, DPDP Act 2023, Indian Telegraph Act 1885.
- Assessment: Government access powers under IT Act Section 69 and Telegraph Act are broad. TIA should assess proportionality and remedy availability. Supplementary measures recommended.
Common TIA Deficiencies
- Generic country assessments: Using a template country assessment without considering the specific data, importer, and processing context.
- Reliance on contractual measures alone: Contractual obligations cannot override a government compulsion order; technical measures must supplement contractual ones.
- Failure to assess onward transfers: The importer may transfer data to further third countries with different legal frameworks.
- No ongoing monitoring: TIA conducted once and never updated despite legal framework changes.
- Conflating adequacy with absence of risk: Even countries with adequacy decisions may present risks for specific data types or sectors.
Enforcement Precedents
- CJEU C-311/18 Schrems II (2020): Invalidated Privacy Shield; required case-by-case assessment for SCCs.
- Austrian DPA (DSB) — Decision D155.027 of 22 December 2021: Google Analytics transfers to US found unlawful; TIA inadequate because Google's SCCs and supplementary measures did not prevent US government access under FISA 702.
- CNIL (France) — Decision of 10 February 2022: Google Analytics transfers to US found unlawful; echoed Austrian DPA reasoning regarding FISA 702 access.
- DPC Ireland — Meta Platforms Decision (May 2023): EUR 1.2 billion fine for continued transfers to US without valid transfer mechanism following Schrems II.
- EDPS — Decision on European Parliament COVID testing (January 2022): Found that transfers to US by Ecolog (processor) lacked adequate supplementary measures.
1---2name: performing-transfer-impact-assessment3description: Guides the post-Schrems II Transfer Impact Assessment process following EDPB Recommendations 01/2020 six-step methodology. Covers assessment of third country legal frameworks, supplementary measures evaluation, and TIA scoring. Activate for international data transfers, SCCs, third-country adequacy, or Chapter V compliance. Keywords: TIA, Schrems II, transfer assessment, EDPB, supplementary measures, SCCs, international transfer.4license: Apache-2.05---67# Performing Transfer Impact Assessment89## Overview1011Following the Court of Justice of the European Union (CJEU) judgment in Data Protection Commissioner v Facebook Ireland and Maximillian Schrems (Case C-311/18, 16 July 2020) — commonly known as Schrems II — controllers and processors transferring personal data outside the EEA must assess whether the legal framework of the destination country provides an essentially equivalent level of protection to that guaranteed by the GDPR and the EU Charter of Fundamental Rights. This assessment is known as a Transfer Impact Assessment (TIA). The European Data Protection Board adopted Recommendations 01/2020 on 18 June 2021, establishing a six-step process for conducting TIAs.1213## Legal Foundation1415### CJEU C-311/18 Key Holdings16171. **Privacy Shield invalidated**: The EU-US Privacy Shield framework was declared invalid due to US surveillance programmes (Section 702 FISA, EO 12333) enabling mass access to personal data transferred from the EU, with insufficient remedies for EU data subjects.182. **Standard Contractual Clauses remain valid in principle**: The SCCs decision (2010/87/EU, now replaced by Commission Implementing Decision 2021/914) was upheld but subject to the requirement that data exporters verify the clauses can be complied with in practice in the destination country.193. **Case-by-case assessment required**: Controllers cannot rely on SCCs mechanically; they must assess the destination country's legal framework and, where necessary, implement supplementary measures to ensure essentially equivalent protection.204. **Supervisory authority intervention**: Supervisory authorities are required to suspend or prohibit transfers where essentially equivalent protection cannot be ensured.2122### EDPB Recommendations 01/2020 — Six-Step Process2324The EDPB established a structured methodology for evaluating whether transfers can proceed:2526## Step 1: Know Your Transfers2728Map all transfers of personal data to third countries or international organisations:2930| Transfer Attribute | Documentation Required |31|-------------------|----------------------|32| Data exporter | Legal entity, establishment, contact details |33| Data importer | Legal entity, country of establishment, sector |34| Personal data categories | Specific categories transferred (identifiers, financial, health, behavioural) |35| Special categories | Whether Art. 9 or Art. 10 data is transferred |36| Data subjects | Categories and approximate number |37| Transfer mechanism | SCCs, BCRs, Art. 49 derogation, adequacy decision |38| Purpose of transfer | Specific purposes for which data is transferred |39| Onward transfers | Whether importer transfers data to further third countries |40| Format | Whether data is transferred in clear text, pseudonymised, or encrypted |41| Storage vs transit | Whether data is stored in third country or only transits through it |4243## Step 2: Identify the Transfer Tool — Chapter V GDPR4445| Transfer Mechanism | GDPR Reference | Assessment Requirement |46|-------------------|----------------|----------------------|47| Adequacy decision | Art. 45 | Rely on Commission assessment; monitor for future invalidation |48| Standard Contractual Clauses (new 2021 SCCs) | Art. 46(2)(c) | Full TIA required per CJEU C-311/18 |49| Binding Corporate Rules | Art. 47 | Full TIA required; BCRs must include supplementary measures |50| Codes of conduct with binding commitments | Art. 46(2)(e) | Full TIA required |51| Certification mechanisms | Art. 46(2)(f) | Full TIA required |52| Ad hoc contractual clauses | Art. 46(3)(a) | Full TIA required plus supervisory authority authorisation |53| Art. 49 derogations | Art. 49 | No TIA required but strict conditions apply; derogations must be interpreted restrictively |5455## Step 3: Assess Third Country Legal Framework5657Evaluate whether the destination country's laws and practices provide essentially equivalent protection. Key assessment areas:5859### 3.1 Government Access to Data6061| Assessment Factor | Questions to Address |62|-------------------|---------------------|63| Surveillance legislation | What laws authorise government access to personal data held by private entities? |64| Scope of access powers | Is access limited to what is strictly necessary and proportionate, or does it enable bulk/indiscriminate collection? |65| Independent oversight | Is government access subject to prior authorisation by an independent body (court or independent administrative authority)? |66| Transparency | Are data subjects notified of government access, either directly or through transparency reporting? |67| Effective remedies | Do data subjects have access to an independent tribunal or court to challenge government access? |6869### 3.2 Rule of Law and Legal Framework7071| Assessment Factor | Questions to Address |72|-------------------|---------------------|73| Constitutional protections | Does the country's constitution protect the right to privacy and data protection? |74| Data protection legislation | Does the country have comprehensive data protection legislation? |75| Independent supervisory authority | Is there an independent data protection authority with enforcement powers? |76| Judicial independence | Is the judiciary independent from the executive, with power to review government surveillance? |7778### 3.3 Practical Application7980| Assessment Factor | Sources of Information |81|-------------------|----------------------|82| Government access requests | Transparency reports from the data importer and major technology companies |83| Enforcement actions | Published decisions of the destination country's data protection authority |84| Legal reforms | Pending or recent legislative changes affecting surveillance powers |85| International assessments | EDPB adequacy referentials, CoE Convention 108+ ratification status |8687## Step 4: Identify and Adopt Supplementary Measures8889Where the assessment in Step 3 reveals that the third country framework does not provide essentially equivalent protection, the exporter must identify supplementary measures that, together with the transfer tool, ensure essentially equivalent protection.9091### Technical Supplementary Measures9293| Measure | EDPB Assessment | Effective Against |94|---------|-----------------|-------------------|95| End-to-end encryption where exporter holds the key | Effective — prevents importer and government access to clear text data | Government access via importer; importer misuse |96| Pseudonymisation where exporter holds the mapping table | Effective — if additional information needed to re-identify is held solely in EEA | Government access where re-identification requires mapping table |97| Split processing across jurisdictions | Effective — if no single jurisdiction has access to complete dataset | Government access in any single jurisdiction |98| Transport encryption (TLS/IPSEC) for data in transit | Insufficient alone — protects only against interception during transit, not access at rest | Transit interception only |99| Encryption at rest where importer holds decryption key | Insufficient — importer can be compelled to provide decryption key | Not effective against government compulsion |100101### Contractual Supplementary Measures102103| Measure | Purpose |104|---------|---------|105| Obligation to use all available legal remedies to challenge government access requests | Ensures importer resists unlawful government access |106| Warrant canary or transparency reporting obligations | Enables exporter to detect government access |107| Obligation to notify exporter of government access requests (where legally permitted) | Enables exporter to intervene or suspend transfers |108| Obligation to conduct annual assessment of government access laws | Ensures ongoing monitoring of legal framework changes |109| Contractual right for exporter to audit importer's compliance | Enables verification of supplementary measure effectiveness |110111### Organisational Supplementary Measures112113| Measure | Purpose |114|---------|---------|115| Adoption of internal policies and procedures for handling government access requests | Ensures structured response to government demands |116| Appointment of a DPO or privacy officer by the importer | Ensures designated responsibility for compliance |117| Staff training on government access response procedures | Ensures operational readiness |118| Regular external audits of government access request handling | Independent verification of compliance |119120## Step 5: Procedural Steps for Supplementary Measures1211221. Document the supplementary measures in writing, either within the SCCs or in a separate supplementary agreement annexed to the SCCs.1232. Ensure supplementary measures are legally binding on the data importer.1243. Verify that supplementary measures are technically implementable given the processing purposes.1254. Assess whether supplementary measures conflict with any obligation of the data importer under the destination country's law.1265. If supplementary measures conflict with local law obligations of the importer, the transfer cannot proceed.127128## Step 6: Re-evaluate at Appropriate Intervals1291301. Monitor developments in the third country legal framework on an ongoing basis.1312. Conduct formal TIA re-evaluation at minimum annually or upon a trigger event.1323. Trigger events: new surveillance legislation, court decision affecting data access, adequacy decision adopted or withdrawn, law enforcement action affecting the importer.1334. Suspend transfers immediately if supplementary measures can no longer ensure essentially equivalent protection.134135## TIA Scoring Rubric136137### Government Access Risk Score138139| Factor | Weight | Score 1 (Low Risk) | Score 3 (Medium Risk) | Score 5 (High Risk) |140|--------|--------|--------------------|-----------------------|---------------------|141| Surveillance legislation scope | 25% | Targeted access only, strictly necessary and proportionate | Mix of targeted and bulk powers, some proportionality limitations | Bulk/indiscriminate access powers without proportionality requirements |142| Independent prior authorisation | 20% | Judicial authorisation required for all access | Judicial authorisation for some; administrative for others | No independent authorisation required; self-authorisation |143| Effective remedies | 20% | Independent court with full review powers, accessible to foreign nationals | Administrative review body with limited powers | No effective remedy available to foreign nationals |144| Transparency and notification | 15% | Mandatory notification and public transparency reporting | Partial transparency; notification in some cases | No notification obligation; limited or no transparency |145| Rule of law and judicial independence | 20% | Strong constitutional protections; independent judiciary; ratified CoE 108+ | Some constitutional protections; judiciary generally independent | Weak or absent constitutional protections; executive influence over judiciary |146147### Overall TIA Risk Level148149| Total Weighted Score | Risk Level | Recommendation |150|---------------------|-----------|----------------|151| 1.0 — 2.0 | Low | Transfer may proceed with standard transfer tool |152| 2.1 — 3.0 | Medium | Transfer may proceed with appropriate supplementary measures |153| 3.1 — 4.0 | High | Transfer may proceed only with robust technical supplementary measures (encryption with exporter-held key, pseudonymisation) |154| 4.1 — 5.0 | Very High | Transfer should not proceed unless data is encrypted with exporter-held key and importer has no access to clear text data |155156## Country-Specific Assessment Notes157158### United States159160- **Post-Schrems II status**: EU-US Data Privacy Framework adopted 10 July 2023 (Commission Implementing Decision C(2023) 4745). US companies self-certified under the DPF benefit from an adequacy decision. Non-certified companies require SCCs with TIA.161- **Key legislation**: FISA Section 702 (amended by FISA Section 702 reauthorisation in April 2024), EO 14086 (7 October 2022) establishing proportionality requirements and Data Protection Review Court.162- **Assessment**: For DPF-certified companies, adequacy finding applies. For non-certified companies, TIA must assess whether EO 14086 safeguards are sufficient given the specific data and importer.163164### United Kingdom165166- **Post-Brexit status**: Adequacy decision adopted 28 June 2021 (Commission Implementing Decision C(2021) 4800), valid until 27 June 2025, extended by new adequacy assessment.167- **Key legislation**: Investigatory Powers Act 2016, Data Protection Act 2018, UK GDPR.168- **Assessment**: Adequacy decision currently in force. Monitor for changes to IPA bulk powers and UK divergence from GDPR standards.169170### India171172- **Status**: No adequacy decision. Digital Personal Data Protection Act 2023 enacted but implementation through rules pending.173- **Key legislation**: Information Technology Act 2000, DPDP Act 2023, Indian Telegraph Act 1885.174- **Assessment**: Government access powers under IT Act Section 69 and Telegraph Act are broad. TIA should assess proportionality and remedy availability. Supplementary measures recommended.175176## Common TIA Deficiencies1771781. **Generic country assessments**: Using a template country assessment without considering the specific data, importer, and processing context.1792. **Reliance on contractual measures alone**: Contractual obligations cannot override a government compulsion order; technical measures must supplement contractual ones.1803. **Failure to assess onward transfers**: The importer may transfer data to further third countries with different legal frameworks.1814. **No ongoing monitoring**: TIA conducted once and never updated despite legal framework changes.1825. **Conflating adequacy with absence of risk**: Even countries with adequacy decisions may present risks for specific data types or sectors.183184## Enforcement Precedents185186- **CJEU C-311/18 Schrems II (2020)**: Invalidated Privacy Shield; required case-by-case assessment for SCCs.187- **Austrian DPA (DSB) — Decision D155.027 of 22 December 2021**: Google Analytics transfers to US found unlawful; TIA inadequate because Google's SCCs and supplementary measures did not prevent US government access under FISA 702.188- **CNIL (France) — Decision of 10 February 2022**: Google Analytics transfers to US found unlawful; echoed Austrian DPA reasoning regarding FISA 702 access.189- **DPC Ireland — Meta Platforms Decision (May 2023)**: EUR 1.2 billion fine for continued transfers to US without valid transfer mechanism following Schrems II.190- **EDPS — Decision on European Parliament COVID testing (January 2022)**: Found that transfers to US by Ecolog (processor) lacked adequate supplementary measures.
mukul975