Conducting Transfer Impact Assessment
Overview
Following the Court of Justice of the European Union's judgment in Schrems II (Case C-311/18, 16 July 2020), organisations relying on Standard Contractual Clauses (SCCs) or other Art. 46 GDPR transfer mechanisms must conduct a Transfer Impact Assessment (TIA) to evaluate whether the legal framework of the destination country provides an essentially equivalent level of protection for personal data. The EDPB adopted Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data (Version 2.0, adopted 18 June 2021), establishing a six-step methodology for this assessment.
EDPB Six-Step Methodology
Step 1: Know Your Transfers
Map all personal data transfers to third countries, identifying:
| Element |
Required Information |
| Transfer identification |
Unique reference for each transfer or set of transfers |
| Data exporter |
Legal entity name, establishment, role (controller/processor) |
| Data importer |
Legal entity name, establishment, role (controller/processor) |
| Transfer mechanism |
SCCs (specifying module), BCRs, Art. 49 derogation |
| Data categories |
Personal data types transferred, including any special categories |
| Data subjects |
Categories of individuals whose data is transferred |
| Purpose |
Specific purpose(s) for which the data is processed after transfer |
| Destination country |
Country where the importer processes the data |
| Onward transfers |
Any further transfers from the importer to other jurisdictions |
| Format and channel |
How data is transmitted (API, SFTP, email, physical media) |
| Storage duration |
How long data is retained in the destination country |
Athena Global Logistics example transfer mapping:
| Transfer Ref |
Exporter |
Importer |
Destination |
Mechanism |
Data Categories |
| TIA-2025-HK-001 |
Athena Global Logistics GmbH |
TransPacific Freight Solutions Ltd |
Hong Kong SAR |
SCCs Module 2 |
Customer names, addresses, customs IDs, consignment data |
| TIA-2025-IN-001 |
Athena Global Logistics GmbH |
Athena Freight Services India Pvt Ltd |
India |
SCCs Module 1 |
Employee names, contact details, performance records |
| TIA-2025-US-001 |
Athena Global Logistics GmbH |
Meridian Cloud Services Inc |
United States |
EU-US DPF + SCCs backup |
Customer data, operational analytics |
Step 2: Identify the Transfer Tool Relied Upon
For each transfer, confirm the Art. 46 transfer mechanism:
- SCCs (Art. 46(2)(c)): Identify the specific module (1-4) and version (2021/914).
- BCRs (Art. 47): Confirm approval status and scope coverage.
- Ad hoc contractual clauses (Art. 46(3)(a)): Confirm SA authorisation.
- Codes of conduct (Art. 46(2)(e)): Confirm approved code and binding commitments.
- Certification mechanisms (Art. 46(2)(f)): Confirm certification status and scope.
Document the specific clauses that may be affected by the destination country legal framework, particularly:
- Clause 14 (SCCs) — local laws and obligations relating to access by public authorities
- Clause 15 (SCCs) — obligations of the data importer in case of government access
Step 3: Assess Whether the Transfer Tool Is Effective in Light of All Circumstances
This is the core of the TIA. Assess the legal framework of the destination country against the four European Essential Guarantees (EDPB Recommendations 02/2020):
Essential Guarantee 1: Processing Should Be Based on Clear, Precise, and Accessible Rules
| Assessment Question |
Analysis |
| Is government access to personal data based on legislation? |
Identify the specific statutes authorising government access (e.g., FISA Section 702, EO 12333 for US; National Security Law for Hong Kong; IT Act Section 69 for India) |
| Are the rules publicly available? |
Assess whether the legislation and its implementing regulations are published and accessible |
| Is the scope of government access clearly defined? |
Assess whether the legislation specifies the categories of data, persons, or situations subject to access |
| Are there exceptions or conditions for access? |
Identify any limitations, thresholds, or prior authorisation requirements |
Essential Guarantee 2: Necessity and Proportionality
| Assessment Question |
Analysis |
| Is government access limited to what is strictly necessary? |
Assess whether the legislation requires a showing of necessity for each access request |
| Is the scope proportionate to the stated objective? |
Evaluate whether bulk/mass surveillance is permitted or whether access must be targeted |
| Are there safeguards against abuse? |
Assess minimisation requirements, purpose limitations, and retention limits for accessed data |
Essential Guarantee 3: Independent Oversight Mechanism
| Assessment Question |
Analysis |
| Is there prior judicial or independent authorisation? |
Determine whether a court or independent body must approve access requests before execution |
| Is there ongoing oversight? |
Assess whether an independent body monitors government access activities |
| Are oversight bodies genuinely independent? |
Evaluate the appointment, tenure, and dismissal conditions of oversight body members |
Essential Guarantee 4: Effective Remedies Available to the Individual
| Assessment Question |
Analysis |
| Can individuals challenge government access in court? |
Assess whether there is a right to judicial review of surveillance measures |
| Is there an effective notification mechanism? |
Determine whether individuals are notified of surveillance (even if delayed) |
| Can individuals obtain a remedy? |
Assess available remedies (compensation, data deletion, injunctive relief) |
Step 4: Adopt Supplementary Measures
If Step 3 reveals that the transfer tool is not effective on its own, identify and implement supplementary measures to bridge the protection gap:
Technical Measures
| Measure |
Effectiveness |
Applicable Scenarios |
| End-to-end encryption (data in transit and at rest) with EU-held keys |
High — prevents importer and government access to plaintext |
Data storage or transit where importer does not need to process plaintext |
| Pseudonymisation with EU-held mapping table |
High — transferred data cannot be attributed to identified individuals |
Analytics, research, or aggregation where identification is not needed at the importer |
| Split processing |
High — no single entity in the third country holds the complete dataset |
Multi-party computation or processing split between jurisdictions |
| Transport-layer encryption (TLS 1.3) |
Medium — protects data in transit but not against compelled disclosure at rest |
All transfers as a baseline measure; insufficient alone for high-risk jurisdictions |
Contractual Measures
| Measure |
Effectiveness |
Applicable Scenarios |
| Obligation to challenge disproportionate government access requests |
Medium — depends on legal standing and judicial independence in destination country |
All SCC-based transfers (already required under Clause 15) |
| Transparency obligation for government access requests received |
Medium — provides visibility but does not prevent access |
All transfers |
| Audit rights exercisable by the exporter or independent auditor |
Medium — verifies compliance but is retrospective |
All transfers |
| Warrant canary (commitment to publish regular transparency reports) |
Low-Medium — provides indirect signal but does not prevent access |
US transfers where gag orders may apply |
Organisational Measures
| Measure |
Effectiveness |
Applicable Scenarios |
| Strict internal access policies limiting who can access transferred data |
Medium — reduces the surface of potential government access |
All transfers |
| Regular transparency reports on government access requests |
Medium — provides accountability |
All transfers |
| Data protection impact assessment for government access scenarios |
Medium — proactive risk identification |
High-risk jurisdiction transfers |
| Adoption of ISO 27001/27701 certification by the importer |
Medium — independent verification of security and privacy controls |
All transfers |
Step 5: Procedural Steps If Supplementary Measures Are Adopted
- Document the supplementary measures in the SCC Annex or in a separate addendum.
- Implement the technical measures before commencing or continuing the transfer.
- Execute contractual amendments reflecting the supplementary measures.
- Verify the importer has the technical capability and legal ability to implement the measures.
- Notify the competent SA if required (for ad hoc contractual clauses under Art. 46(3)(a)).
Step 6: Re-Evaluate at Appropriate Intervals
- Schedule periodic TIA reviews: at minimum annually, or upon any of the following triggers:
- New legislation enacted in the destination country affecting government access
- Court rulings in the destination country affecting privacy protections
- Changes to the EC adequacy decision landscape
- EDPB or national SA guidance updates
- Material change in the nature, volume, or sensitivity of transferred data
- Government access request received by the importer
- Document each re-evaluation with the date, trigger, findings, and any changes to supplementary measures.
- If re-evaluation concludes that effective protection cannot be ensured, suspend the transfer and notify the competent SA.
Country-Specific Assessment Summaries
United States
| Factor |
Assessment |
| Key surveillance laws |
FISA Section 702, EO 12333, CLOUD Act, National Security Letters (18 USC 2709) |
| Necessity/proportionality |
EO 14086 (October 2022) introduced necessity and proportionality requirements; applies to all signals intelligence activities |
| Independent oversight |
FISC (prior authorisation for Section 702); PCLOB (oversight); DPRC (redress for EU data subjects) |
| Remedies |
DPRC mechanism established under EO 14086; binding determinations |
| Overall assessment |
If importer is DPF-certified: adequacy decision applies. If not DPF-certified: SCCs with supplementary measures (encryption, contractual transparency) |
People's Republic of China
| Factor |
Assessment |
| Key surveillance laws |
Cybersecurity Law (Art. 28, 37), National Intelligence Law (Art. 7, 14), Data Security Law (Art. 35-36), PIPL (Art. 38-43) |
| Necessity/proportionality |
National Intelligence Law Art. 7 imposes broad cooperation obligations; no explicit proportionality requirement |
| Independent oversight |
No independent judicial oversight of intelligence access; procuratorate oversight is not independent from the state |
| Remedies |
Limited judicial remedies for foreign data subjects against state surveillance |
| Overall assessment |
High risk; supplementary measures must include strong encryption with EU-held keys; consider data minimisation and pseudonymisation before transfer; for some data categories, transfer may not be possible with effective protection |
India
| Factor |
Assessment |
| Key surveillance laws |
IT Act 2000 Section 69 (interception), Telegraph Act 1885 Section 5, DPDP Act 2023 Section 36 (government exemptions) |
| Necessity/proportionality |
Section 69 requires ministerial authorisation but proportionality review is limited; mass surveillance capability through CMS (Central Monitoring System) |
| Independent oversight |
No prior judicial authorisation for interception; review committee is executive-appointed |
| Remedies |
Limited remedies under IT Act; High Court writ jurisdiction available but practical access is constrained |
| Overall assessment |
Medium-High risk; supplementary measures should include encryption, contractual transparency, and audit rights; TIA should assess specific risk based on data category and importer profile |
Hong Kong SAR
| Factor |
Assessment |
| Key surveillance laws |
Interception of Communications and Surveillance Ordinance (Cap. 589), National Security Law (2020), Safeguarding National Security Ordinance (2024) |
| Necessity/proportionality |
Cap. 589 requires judicial authorisation for interception; however, NSL provides broad powers with limited proportionality review |
| Independent oversight |
Commissioner on Interception of Communications and Surveillance provides oversight under Cap. 589; NSL cases subject to designated judges |
| Remedies |
Judicial review available under Cap. 589; limited practical remedies under NSL |
| Overall assessment |
Medium risk (elevated since NSL enactment); supplementary measures should include encryption and contractual obligations; assess sensitivity of data and likelihood of government interest |
TIA Documentation Requirements
Each TIA must be documented and include:
- Transfer identification (Step 1 mapping data)
- Transfer mechanism details (Step 2 analysis)
- Destination country legal assessment with specific legislation citations (Step 3)
- European Essential Guarantees analysis for each identified law (Step 3)
- Supplementary measures identified and rationale (Step 4)
- Implementation status of supplementary measures (Step 5)
- Re-evaluation schedule and triggers (Step 6)
- Overall conclusion: transfer may proceed / transfer may proceed with supplementary measures / transfer must be suspended
- Sign-off by the DPO or Head of Data Protection
- Version history tracking all updates and re-evaluations
1---2name: transfer-impact-assessment3description: Guides the post-Schrems II Transfer Impact Assessment process following EDPB Recommendations 01/2020 six-step methodology. Covers destination country surveillance law assessment, European Essential Guarantees evaluation, and supplementary measures determination. Keywords: TIA, transfer impact assessment, Schrems II, EDPB recommendations, supplementary measures.4license: Apache-2.05---67# Conducting Transfer Impact Assessment89## Overview1011Following the Court of Justice of the European Union's judgment in Schrems II (Case C-311/18, 16 July 2020), organisations relying on Standard Contractual Clauses (SCCs) or other Art. 46 GDPR transfer mechanisms must conduct a Transfer Impact Assessment (TIA) to evaluate whether the legal framework of the destination country provides an essentially equivalent level of protection for personal data. The EDPB adopted Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data (Version 2.0, adopted 18 June 2021), establishing a six-step methodology for this assessment.1213## EDPB Six-Step Methodology1415### Step 1: Know Your Transfers1617Map all personal data transfers to third countries, identifying:1819| Element | Required Information |20|---------|---------------------|21| Transfer identification | Unique reference for each transfer or set of transfers |22| Data exporter | Legal entity name, establishment, role (controller/processor) |23| Data importer | Legal entity name, establishment, role (controller/processor) |24| Transfer mechanism | SCCs (specifying module), BCRs, Art. 49 derogation |25| Data categories | Personal data types transferred, including any special categories |26| Data subjects | Categories of individuals whose data is transferred |27| Purpose | Specific purpose(s) for which the data is processed after transfer |28| Destination country | Country where the importer processes the data |29| Onward transfers | Any further transfers from the importer to other jurisdictions |30| Format and channel | How data is transmitted (API, SFTP, email, physical media) |31| Storage duration | How long data is retained in the destination country |3233**Athena Global Logistics example transfer mapping**:3435| Transfer Ref | Exporter | Importer | Destination | Mechanism | Data Categories |36|-------------|----------|----------|------------|-----------|----------------|37| TIA-2025-HK-001 | Athena Global Logistics GmbH | TransPacific Freight Solutions Ltd | Hong Kong SAR | SCCs Module 2 | Customer names, addresses, customs IDs, consignment data |38| TIA-2025-IN-001 | Athena Global Logistics GmbH | Athena Freight Services India Pvt Ltd | India | SCCs Module 1 | Employee names, contact details, performance records |39| TIA-2025-US-001 | Athena Global Logistics GmbH | Meridian Cloud Services Inc | United States | EU-US DPF + SCCs backup | Customer data, operational analytics |4041### Step 2: Identify the Transfer Tool Relied Upon4243For each transfer, confirm the Art. 46 transfer mechanism:44451. **SCCs (Art. 46(2)(c))**: Identify the specific module (1-4) and version (2021/914).462. **BCRs (Art. 47)**: Confirm approval status and scope coverage.473. **Ad hoc contractual clauses (Art. 46(3)(a))**: Confirm SA authorisation.484. **Codes of conduct (Art. 46(2)(e))**: Confirm approved code and binding commitments.495. **Certification mechanisms (Art. 46(2)(f))**: Confirm certification status and scope.5051Document the specific clauses that may be affected by the destination country legal framework, particularly:52- Clause 14 (SCCs) — local laws and obligations relating to access by public authorities53- Clause 15 (SCCs) — obligations of the data importer in case of government access5455### Step 3: Assess Whether the Transfer Tool Is Effective in Light of All Circumstances5657This is the core of the TIA. Assess the legal framework of the destination country against the four European Essential Guarantees (EDPB Recommendations 02/2020):5859#### Essential Guarantee 1: Processing Should Be Based on Clear, Precise, and Accessible Rules6061| Assessment Question | Analysis |62|-------------------|----------|63| Is government access to personal data based on legislation? | Identify the specific statutes authorising government access (e.g., FISA Section 702, EO 12333 for US; National Security Law for Hong Kong; IT Act Section 69 for India) |64| Are the rules publicly available? | Assess whether the legislation and its implementing regulations are published and accessible |65| Is the scope of government access clearly defined? | Assess whether the legislation specifies the categories of data, persons, or situations subject to access |66| Are there exceptions or conditions for access? | Identify any limitations, thresholds, or prior authorisation requirements |6768#### Essential Guarantee 2: Necessity and Proportionality6970| Assessment Question | Analysis |71|-------------------|----------|72| Is government access limited to what is strictly necessary? | Assess whether the legislation requires a showing of necessity for each access request |73| Is the scope proportionate to the stated objective? | Evaluate whether bulk/mass surveillance is permitted or whether access must be targeted |74| Are there safeguards against abuse? | Assess minimisation requirements, purpose limitations, and retention limits for accessed data |7576#### Essential Guarantee 3: Independent Oversight Mechanism7778| Assessment Question | Analysis |79|-------------------|----------|80| Is there prior judicial or independent authorisation? | Determine whether a court or independent body must approve access requests before execution |81| Is there ongoing oversight? | Assess whether an independent body monitors government access activities |82| Are oversight bodies genuinely independent? | Evaluate the appointment, tenure, and dismissal conditions of oversight body members |8384#### Essential Guarantee 4: Effective Remedies Available to the Individual8586| Assessment Question | Analysis |87|-------------------|----------|88| Can individuals challenge government access in court? | Assess whether there is a right to judicial review of surveillance measures |89| Is there an effective notification mechanism? | Determine whether individuals are notified of surveillance (even if delayed) |90| Can individuals obtain a remedy? | Assess available remedies (compensation, data deletion, injunctive relief) |9192### Step 4: Adopt Supplementary Measures9394If Step 3 reveals that the transfer tool is not effective on its own, identify and implement supplementary measures to bridge the protection gap:9596#### Technical Measures9798| Measure | Effectiveness | Applicable Scenarios |99|---------|--------------|---------------------|100| End-to-end encryption (data in transit and at rest) with EU-held keys | High — prevents importer and government access to plaintext | Data storage or transit where importer does not need to process plaintext |101| Pseudonymisation with EU-held mapping table | High — transferred data cannot be attributed to identified individuals | Analytics, research, or aggregation where identification is not needed at the importer |102| Split processing | High — no single entity in the third country holds the complete dataset | Multi-party computation or processing split between jurisdictions |103| Transport-layer encryption (TLS 1.3) | Medium — protects data in transit but not against compelled disclosure at rest | All transfers as a baseline measure; insufficient alone for high-risk jurisdictions |104105#### Contractual Measures106107| Measure | Effectiveness | Applicable Scenarios |108|---------|--------------|---------------------|109| Obligation to challenge disproportionate government access requests | Medium — depends on legal standing and judicial independence in destination country | All SCC-based transfers (already required under Clause 15) |110| Transparency obligation for government access requests received | Medium — provides visibility but does not prevent access | All transfers |111| Audit rights exercisable by the exporter or independent auditor | Medium — verifies compliance but is retrospective | All transfers |112| Warrant canary (commitment to publish regular transparency reports) | Low-Medium — provides indirect signal but does not prevent access | US transfers where gag orders may apply |113114#### Organisational Measures115116| Measure | Effectiveness | Applicable Scenarios |117|---------|--------------|---------------------|118| Strict internal access policies limiting who can access transferred data | Medium — reduces the surface of potential government access | All transfers |119| Regular transparency reports on government access requests | Medium — provides accountability | All transfers |120| Data protection impact assessment for government access scenarios | Medium — proactive risk identification | High-risk jurisdiction transfers |121| Adoption of ISO 27001/27701 certification by the importer | Medium — independent verification of security and privacy controls | All transfers |122123### Step 5: Procedural Steps If Supplementary Measures Are Adopted1241251. Document the supplementary measures in the SCC Annex or in a separate addendum.1262. Implement the technical measures before commencing or continuing the transfer.1273. Execute contractual amendments reflecting the supplementary measures.1284. Verify the importer has the technical capability and legal ability to implement the measures.1295. Notify the competent SA if required (for ad hoc contractual clauses under Art. 46(3)(a)).130131### Step 6: Re-Evaluate at Appropriate Intervals1321331. Schedule periodic TIA reviews: at minimum annually, or upon any of the following triggers:134 - New legislation enacted in the destination country affecting government access135 - Court rulings in the destination country affecting privacy protections136 - Changes to the EC adequacy decision landscape137 - EDPB or national SA guidance updates138 - Material change in the nature, volume, or sensitivity of transferred data139 - Government access request received by the importer1402. Document each re-evaluation with the date, trigger, findings, and any changes to supplementary measures.1413. If re-evaluation concludes that effective protection cannot be ensured, suspend the transfer and notify the competent SA.142143## Country-Specific Assessment Summaries144145### United States146147| Factor | Assessment |148|--------|-----------|149| Key surveillance laws | FISA Section 702, EO 12333, CLOUD Act, National Security Letters (18 USC 2709) |150| Necessity/proportionality | EO 14086 (October 2022) introduced necessity and proportionality requirements; applies to all signals intelligence activities |151| Independent oversight | FISC (prior authorisation for Section 702); PCLOB (oversight); DPRC (redress for EU data subjects) |152| Remedies | DPRC mechanism established under EO 14086; binding determinations |153| Overall assessment | If importer is DPF-certified: adequacy decision applies. If not DPF-certified: SCCs with supplementary measures (encryption, contractual transparency) |154155### People's Republic of China156157| Factor | Assessment |158|--------|-----------|159| Key surveillance laws | Cybersecurity Law (Art. 28, 37), National Intelligence Law (Art. 7, 14), Data Security Law (Art. 35-36), PIPL (Art. 38-43) |160| Necessity/proportionality | National Intelligence Law Art. 7 imposes broad cooperation obligations; no explicit proportionality requirement |161| Independent oversight | No independent judicial oversight of intelligence access; procuratorate oversight is not independent from the state |162| Remedies | Limited judicial remedies for foreign data subjects against state surveillance |163| Overall assessment | High risk; supplementary measures must include strong encryption with EU-held keys; consider data minimisation and pseudonymisation before transfer; for some data categories, transfer may not be possible with effective protection |164165### India166167| Factor | Assessment |168|--------|-----------|169| Key surveillance laws | IT Act 2000 Section 69 (interception), Telegraph Act 1885 Section 5, DPDP Act 2023 Section 36 (government exemptions) |170| Necessity/proportionality | Section 69 requires ministerial authorisation but proportionality review is limited; mass surveillance capability through CMS (Central Monitoring System) |171| Independent oversight | No prior judicial authorisation for interception; review committee is executive-appointed |172| Remedies | Limited remedies under IT Act; High Court writ jurisdiction available but practical access is constrained |173| Overall assessment | Medium-High risk; supplementary measures should include encryption, contractual transparency, and audit rights; TIA should assess specific risk based on data category and importer profile |174175### Hong Kong SAR176177| Factor | Assessment |178|--------|-----------|179| Key surveillance laws | Interception of Communications and Surveillance Ordinance (Cap. 589), National Security Law (2020), Safeguarding National Security Ordinance (2024) |180| Necessity/proportionality | Cap. 589 requires judicial authorisation for interception; however, NSL provides broad powers with limited proportionality review |181| Independent oversight | Commissioner on Interception of Communications and Surveillance provides oversight under Cap. 589; NSL cases subject to designated judges |182| Remedies | Judicial review available under Cap. 589; limited practical remedies under NSL |183| Overall assessment | Medium risk (elevated since NSL enactment); supplementary measures should include encryption and contractual obligations; assess sensitivity of data and likelihood of government interest |184185## TIA Documentation Requirements186187Each TIA must be documented and include:1881891. **Transfer identification** (Step 1 mapping data)1902. **Transfer mechanism details** (Step 2 analysis)1913. **Destination country legal assessment** with specific legislation citations (Step 3)1924. **European Essential Guarantees analysis** for each identified law (Step 3)1935. **Supplementary measures identified and rationale** (Step 4)1946. **Implementation status of supplementary measures** (Step 5)1957. **Re-evaluation schedule and triggers** (Step 6)1968. **Overall conclusion**: transfer may proceed / transfer may proceed with supplementary measures / transfer must be suspended1979. **Sign-off** by the DPO or Head of Data Protection19810. **Version history** tracking all updates and re-evaluations
ThomasMoreAI