Transfer Impact Assessment (TIA) Template, GDPR Chapter V

EDPB six-step TIA for one Art. 46 transfer: transfer facts, tool, destination law, supplementary measures, procedural steps, re-evaluation, UK and US notes

ISO 및 컴플라이언스표준EDPB Recommendations 01/2020 v2.0; SCCs (EU) 2021/914transfer impact assessment업데이트됨 2026. 10. 29.

에디터에서 열기.md 다운로드

사용법: Use it for each transfer that relies on SCCs, BCRs or another Article 46 tool. Fill Step 1 (including remote access and sub-processors) and the destination law findings with dated sources first. The main pitfall is copying a vendor's generic TIA without checking your own data and access path.

미리보기

Transfer Impact Assessment: [Transfer name]

A transfer impact assessment (TIA) documents whether personal data sent to, or accessed from, a country outside the EEA under an Article 46 GDPR transfer tool keeps a level of protection essentially equivalent to the EU's. It follows the six steps in EDPB Recommendations 01/2020 on supplementary measures (version 2.0, adopted 18 June 2021), the CJEU judgment in Case C-311/18 (Schrems II, 16 July 2020) and Clause 14 of the standard contractual clauses (SCCs) in Commission Implementing Decision (EU) 2021/914 of 4 June 2021, which requires the parties to document such an assessment. It also notes the UK equivalent (the transfer risk assessment, called a "data protection test" in UK law since the Data (Use and Access) Act 2025). Replace every [bracketed] value and every row marked Example. This is a documentation format, not legal advice: check the current official text and ask a qualified professional.

Step 1: know the transfer
Step 2: transfer tool
Step 3: law and practice of the destination
Step 4: supplementary measures
Step 5: procedural steps
Step 6: re-evaluation
Conclusion
Jurisdiction notes
References

The six steps and their outcomes:

Document control

Field	Value
Document ID	[TIA-001]
Transfer reference	[XFR-nnn in the residency assessment or RoPA]
Exporter	[Legal entity, role: controller / processor]
Importer	[Legal entity, role, country]
Transfer tool	[SCCs module 1 / 2 / 3 / 4, BCRs, other]
Version	[1.0]
Status	[Draft / In review / Approved]
Owner	[@name]
Approvers/reviewers	[DPO, legal, security]
Last updated	YYYY-MM-DD
Next review	YYYY-MM-DD
Classification	[Confidential]

Approvals

Role	Name	Decision	Date
Exporter accountable owner	[@name]	[Approved]	YYYY-MM-DD
DPO	[@name]	[Advice given]	YYYY-MM-DD

Revision history

Version	Date	Author	Change summary
0.1	YYYY-MM-DD	[@name]	First draft with importer questionnaire
1.0	YYYY-MM-DD	[@name]	Example: Approved, clear-text support access suspended

1. Step 1: know the transfer

Item	Description
Purpose	[Purpose]
Data subjects and volume	[Categories, approximate numbers]
Personal data and format	[Categories; clear text, pseudonymised, encrypted]
Special category or criminal data	[Yes / No]
Access path	[Storage abroad, remote access, API, file transfer]
Frequency	[Continuous, daily, occasional]
Onward transfers and sub-processors	[List with countries]
Importer sector and type	[For example cloud provider, telecom, software vendor]

Example: Talvik Payroll Services BV processes payroll data for client employers. Its software vendor's support team in Country X connects to Talvik's EU-hosted system to fix defects. Data in scope: employee names, bank account numbers, salary and tax identifiers. Access happens a few times a month, on ticket.

2. Step 2: transfer tool

Question	Answer
Adequacy decision covering destination and importer?	[Yes / No; decision reference]
Tool relied on	[SCCs module, BCRs, code, certification]
Clauses signed and annexes complete?	[Yes / No; reference]
Docking clause or onward transfer terms in place?	[Yes / No]

3. Step 3: law and practice of the destination

3.1 Legal framework

Question	Finding	Source and date
Which laws allow public authority access to data of this type held by this kind of importer?	[Finding]	[Source]
Are the rules clear, precise and accessible?	[Finding]	[Source]
Is access limited to what is necessary and proportionate?	[Finding]	[Source]
Is there independent oversight?	[Finding]	[Source]
Do EU individuals have effective remedies?	[Finding]	[Source]

3.2 Practice and the importer's experience

Question	Finding	Source
Has the importer received access requests for comparable data? How many, in which period?	[Finding]	[Importer statement, transparency report]
Does the importer fall within the scope of the laws in 3.1?	[Finding]	[Legal opinion]
Is the problematic law applied in practice to transfers like this one?	[Finding]	[Source]

3.3 Step 3 conclusion

[No problematic law applies / Problematic law applies or may apply, continue to Step 4].

Example: Talvik's external counsel reports that Country X law allows security agencies to compel software vendors to give access to data they can read, with no independent prior approval and no remedy for non-residents. The vendor falls within that scope. Conclusion: continue to Step 4.

4. Step 4: supplementary measures

ID	Type	Measure	Gap it closes	Effective?	Owner
SM-01 (Example)	Technical	Support works on a masked copy: names, bank and tax identifiers replaced with tokens, key held only in the EU	Vendor cannot read identifying data	Yes, for masked data	[@security-lead]
SM-02 (Example)	Technical	Just-in-time access through an EU jump host, session recording, 4-hour expiry	Limits exposure window	Partly	[@it-ops]
SM-03 (Example)	Contractual	Vendor confirms its Clause 15 duties to notify and review requests, adds a 48-hour notice target and publishes a transparency report	Visibility of requests	Partly	[@legal]
SM-04 (Example)	Organisational	Clear-text production access only by EU-based staff	Removes clear-text transfer	Yes	[@support-manager]
[SM-nn]	[Type]	[Measure]	[Gap]	[Yes / Partly / No]	[@owner]

5. Step 5: procedural steps

Step	Done?	Reference
Measures added without contradicting the SCCs	[Yes / No]	[Contract annex]
Authorisation from a supervisory authority needed?	[Yes / No]
Importer obligations under Clause 15 (notification and review of requests) briefed	[Yes / No]

6. Step 6: re-evaluation

Review on [YYYY-MM-DD] and on any of these triggers: change in destination law or practice, an access request received, a new sub-processor or access path, a court judgment or new EDPB or Commission guidance, or a change in the data.

7. Conclusion

Item	Value
Outcome	[Transfer may proceed / Proceed with measures / Do not proceed or suspend]
Conditions	[Measure IDs]
Decided by	[@name], YYYY-MM-DD

Example: Proceed with measures SM-01, SM-02 and SM-04 for masked data. Clear-text remote access from Country X is suspended because no effective measure was found for it.

8. Jurisdiction notes

As of October 2026 (not legal advice; check the current official text):

Jurisdiction	Point	Official source
EU	SCCs (EU) 2021/914 and EDPB Recommendations 01/2020 v2.0. The Commission states it is preparing further SCCs for importers already subject to the GDPR and for EU institutions. The EU-US Data Privacy Framework adequacy decision (2023/1795) was upheld by the General Court on 3 September 2025; an appeal (Case C-703/25 P) was pending	https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en
UK	Restricted transfers use adequacy regulations, the International Data Transfer Agreement or the UK Addendum to the EU SCCs, with a transfer risk assessment, which UK law now calls a "data protection test". The ICO updated its transfer guidance on 15 January 2026	https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/
US	The Department of Justice Data Security Program (28 CFR Part 202, in force 8 April 2025) restricts certain transactions that give countries of concern access to bulk US sensitive personal data. It applies to transfers out of the US, the reverse direction of a GDPR TIA, but multinational groups often need both records	https://www.justice.gov/nsd/data-security

9. References

Reference	Version or date	Use
Regulation (EU) 2016/679 (GDPR), Chapter V	Check the consolidated text	Articles 44 to 49
EDPB Recommendations 01/2020 on measures that supplement transfer tools	Version 2.0, adopted 18 June 2021	Six steps, use cases
EDPB Recommendations 02/2020 on the European Essential Guarantees for surveillance measures	10 November 2020	Step 3 benchmark
Commission Implementing Decision (EU) 2021/914	4 June 2021	Clauses 14, 15, 16
CJEU Case C-311/18, Data Protection Commissioner v Facebook Ireland and Schrems	Judgment of 16 July 2020	Duty to verify protection in practice
ICO, Completing a transfer risk assessment	Updated 15 January 2026	UK practice

Standard and licence note

Based on Regulation (EU) 2016/679 (GDPR) Chapter V, EDPB Recommendations 01/2020 (version 2.0) and 02/2020, Commission Implementing Decision (EU) 2021/914 and the CJEU judgment in Case C-311/18, with UK ICO guidance as a comparison. Article and clause numbers are cited and obligations are summarised in original wording; no legal or guideline text is reproduced. The worked example and "Country X" are fictional. Check the consolidated texts, the Commission's SCC page and current EDPB guidance before use. This is a documentation format, not legal advice. Template licence: MIT.