# Transfer Impact Assessment: [Transfer name]

> A transfer impact assessment (TIA) documents whether personal data
> sent to, or accessed from, a country outside the EEA under an
> Article 46 GDPR transfer tool keeps a level of protection essentially
> equivalent to the EU's. It follows the six steps in EDPB
> Recommendations 01/2020 on supplementary measures (version 2.0,
> adopted 18 June 2021), the CJEU judgment in Case C-311/18 (Schrems
> II, 16 July 2020) and Clause 14 of the standard contractual clauses
> (SCCs) in Commission Implementing Decision (EU) 2021/914 of 4 June
> 2021, which requires the parties to document such an assessment. It
> also notes the UK equivalent (the transfer risk assessment, called a
> "data protection test" in UK law since the Data (Use and Access) Act
> 2025). Replace every `[bracketed]` value and every row marked
> *Example*. This is a documentation format, not legal advice: check
> the current official text and ask a qualified professional.

<!--
Guidance: How to use this template
- Use one TIA per transfer, or per group of transfers that share the
  same importer, destination, data and access path.
- A TIA is not needed where an adequacy decision covers the transfer
  (Article 45) or where a narrow Article 49 derogation is used. It is
  needed for SCCs, binding corporate rules and other Article 46 tools.
- The estate-level view (inventory, flow map, jurisdiction matrix,
  mechanism per flow) lives in the data residency and sovereignty
  assessment (`compliance/data-residency-sovereignty-assessment`). This
  template is the detailed record for one transfer.
- Destination law in the worked example is shown as "Country X", a
  placeholder. Do not copy conclusions about real countries from
  vendors or other organisations without checking the sources.
- The worked example uses Talvik Payroll Services BV, a fictional
  Dutch payroll provider whose software vendor gives support from
  Country X.
- Related templates: processor agreement (`legal-lite/dpa`), data
  sharing agreement (`compliance/data-sharing-agreement`), records of
  processing (`compliance/gdpr-ropa`), DPIA (`compliance/dpia`),
  supplier security assessment (`compliance/supplier-security-assessment`),
  privacy enhancing technology selection
  (`compliance/pet-selection-assessment`).
-->

## Contents

1. Step 1: know the transfer
2. Step 2: transfer tool
3. Step 3: law and practice of the destination
4. Step 4: supplementary measures
5. Step 5: procedural steps
6. Step 6: re-evaluation
7. Conclusion
8. Jurisdiction notes
9. References

The six steps and their outcomes:

```mermaid
flowchart TD
  S1["Step 1: know the transfer"] --> S2{"Step 2: adequacy decision covers it?"}
  S2 -->|Yes| A["No TIA needed, monitor the decision"]
  S2 -->|No, Article 46 tool| S3{"Step 3: problematic law applied in practice?"}
  S3 -->|No| S6["Step 6: re-evaluate at intervals"]
  S3 -->|Yes or unclear| S4{"Step 4: effective supplementary measures?"}
  S4 -->|Yes| S5["Step 5: procedural steps"]
  S5 --> S6
  S4 -->|No| X["Do not start, or suspend and end the transfer"]
```

## Document control

<!-- Guidance: Clause 14(d) of the SCCs requires the parties to document the assessment and make it available to the competent supervisory authority on request. Keep each version. -->

| Field | Value |
|---|---|
| Document ID | [TIA-001] |
| Transfer reference | [XFR-nnn in the residency assessment or RoPA] |
| Exporter | [Legal entity, role: controller / processor] |
| Importer | [Legal entity, role, country] |
| Transfer tool | [SCCs module 1 / 2 / 3 / 4, BCRs, other] |
| Version | [1.0] |
| Status | [Draft / In review / Approved] |
| Owner | [@name] |
| Approvers/reviewers | [DPO, legal, security] |
| Last updated | YYYY-MM-DD |
| Next review | YYYY-MM-DD |
| Classification | [Confidential] |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| Exporter accountable owner | [@name] | [Approved] | YYYY-MM-DD |
| DPO | [@name] | [Advice given] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change summary |
|---|---|---|---|
| 0.1 | YYYY-MM-DD | [@name] | First draft with importer questionnaire |
| 1.0 | YYYY-MM-DD | [@name] | *Example:* Approved, clear-text support access suspended |

## 1. Step 1: know the transfer

<!-- Guidance: Describe the circumstances Clause 14(b) asks you to consider: length of the processing chain, number of actors, transmission channels, onward transfers, type of recipient, purpose, categories and format of data, sector and storage location. Remote access from abroad counts as a transfer. Pitfall: forgetting support access and sub-processors. -->

| Item | Description |
|---|---|
| Purpose | [Purpose] |
| Data subjects and volume | [Categories, approximate numbers] |
| Personal data and format | [Categories; clear text, pseudonymised, encrypted] |
| Special category or criminal data | [Yes / No] |
| Access path | [Storage abroad, remote access, API, file transfer] |
| Frequency | [Continuous, daily, occasional] |
| Onward transfers and sub-processors | [List with countries] |
| Importer sector and type | [For example cloud provider, telecom, software vendor] |

*Example:* Talvik Payroll Services BV processes payroll data for client
employers. Its software vendor's support team in Country X connects to
Talvik's EU-hosted system to fix defects. Data in scope: employee
names, bank account numbers, salary and tax identifiers. Access happens
a few times a month, on ticket.

## 2. Step 2: transfer tool

<!-- Guidance: Name the Chapter V tool. If an adequacy decision covers the destination and importer, stop here and record it. For the 2021 SCCs, record the module and that the clauses are not modified. -->

| Question | Answer |
|---|---|
| Adequacy decision covering destination and importer? | [Yes / No; decision reference] |
| Tool relied on | [SCCs module, BCRs, code, certification] |
| Clauses signed and annexes complete? | [Yes / No; reference] |
| Docking clause or onward transfer terms in place? | [Yes / No] |

## 3. Step 3: law and practice of the destination

<!-- Guidance: Assess whether laws or practices in the destination, especially those that let public authorities access data for national security or law enforcement, could stop the importer meeting its commitments for this transfer. The EDPB's European Essential Guarantees (Recommendations 02/2020) are the benchmark: clear, precise and accessible rules; necessity and proportionality; independent oversight; effective remedies. Use relevant, objective, reliable, verifiable and publicly available sources, and record them. -->

### 3.1 Legal framework

| Question | Finding | Source and date |
|---|---|---|
| Which laws allow public authority access to data of this type held by this kind of importer? | [Finding] | [Source] |
| Are the rules clear, precise and accessible? | [Finding] | [Source] |
| Is access limited to what is necessary and proportionate? | [Finding] | [Source] |
| Is there independent oversight? | [Finding] | [Source] |
| Do EU individuals have effective remedies? | [Finding] | [Source] |

### 3.2 Practice and the importer's experience

| Question | Finding | Source |
|---|---|---|
| Has the importer received access requests for comparable data? How many, in which period? | [Finding] | [Importer statement, transparency report] |
| Does the importer fall within the scope of the laws in 3.1? | [Finding] | [Legal opinion] |
| Is the problematic law applied in practice to transfers like this one? | [Finding] | [Source] |

### 3.3 Step 3 conclusion

[No problematic law applies / Problematic law applies or may apply,
continue to Step 4].

*Example:* Talvik's external counsel reports that Country X law allows
security agencies to compel software vendors to give access to data
they can read, with no independent prior approval and no remedy for
non-residents. The vendor falls within that scope. Conclusion: continue
to Step 4.

## 4. Step 4: supplementary measures

<!-- Guidance: Choose measures that close the gap found in Step 3. Contractual and organisational measures alone usually cannot stop access by public authorities; technical measures carry most of the weight. The EDPB recommendations describe use cases: encrypted storage where the key stays in the EEA, pseudonymised data, split processing, and two scenarios where no effective measure was found (cloud processing needing clear text, and remote access to clear text for business purposes) when problematic law is applied in practice. -->

| ID | Type | Measure | Gap it closes | Effective? | Owner |
|---|---|---|---|---|---|
| SM-01 *(Example)* | Technical | Support works on a masked copy: names, bank and tax identifiers replaced with tokens, key held only in the EU | Vendor cannot read identifying data | Yes, for masked data | [@security-lead] |
| SM-02 *(Example)* | Technical | Just-in-time access through an EU jump host, session recording, 4-hour expiry | Limits exposure window | Partly | [@it-ops] |
| SM-03 *(Example)* | Contractual | Vendor confirms its Clause 15 duties to notify and review requests, adds a 48-hour notice target and publishes a transparency report | Visibility of requests | Partly | [@legal] |
| SM-04 *(Example)* | Organisational | Clear-text production access only by EU-based staff | Removes clear-text transfer | Yes | [@support-manager] |
| [SM-nn] | [Type] | [Measure] | [Gap] | [Yes / Partly / No] | [@owner] |

## 5. Step 5: procedural steps

<!-- Guidance: Record formal steps the measures require. Adding measures that contradict the SCCs or change them needs supervisory authority authorisation; additional clauses that do not contradict them do not. -->

| Step | Done? | Reference |
|---|---|---|
| Measures added without contradicting the SCCs | [Yes / No] | [Contract annex] |
| Authorisation from a supervisory authority needed? | [Yes / No] | |
| Importer obligations under Clause 15 (notification and review of requests) briefed | [Yes / No] | |

## 6. Step 6: re-evaluation

<!-- Guidance: Set a date and the events that reopen the TIA. Clause 14(e) requires the importer to tell the exporter if it believes it can no longer comply; Clause 16 sets suspension and termination. -->

Review on [YYYY-MM-DD] and on any of these triggers: change in
destination law or practice, an access request received, a new
sub-processor or access path, a court judgment or new EDPB or
Commission guidance, or a change in the data.

## 7. Conclusion

<!-- Guidance: The conclusion must be one of three outcomes. Record dissent, for example from the DPO. -->

| Item | Value |
|---|---|
| Outcome | [Transfer may proceed / Proceed with measures / Do not proceed or suspend] |
| Conditions | [Measure IDs] |
| Decided by | [@name], YYYY-MM-DD |

*Example:* Proceed with measures SM-01, SM-02 and SM-04 for masked
data. Clear-text remote access from Country X is suspended because no
effective measure was found for it.

## 8. Jurisdiction notes

<!-- Guidance: Dated examples only. Check the current official text in each jurisdiction. -->

As of October 2026 (not legal advice; check the current official text):

| Jurisdiction | Point | Official source |
|---|---|---|
| EU | SCCs (EU) 2021/914 and EDPB Recommendations 01/2020 v2.0. The Commission states it is preparing further SCCs for importers already subject to the GDPR and for EU institutions. The EU-US Data Privacy Framework adequacy decision (2023/1795) was upheld by the General Court on 3 September 2025; an appeal (Case C-703/25 P) was pending | https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en |
| UK | Restricted transfers use adequacy regulations, the International Data Transfer Agreement or the UK Addendum to the EU SCCs, with a transfer risk assessment, which UK law now calls a "data protection test". The ICO updated its transfer guidance on 15 January 2026 | https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/ |
| US | The Department of Justice Data Security Program (28 CFR Part 202, in force 8 April 2025) restricts certain transactions that give countries of concern access to bulk US sensitive personal data. It applies to transfers out of the US, the reverse direction of a GDPR TIA, but multinational groups often need both records | https://www.justice.gov/nsd/data-security |

## 9. References

| Reference | Version or date | Use |
|---|---|---|
| Regulation (EU) 2016/679 (GDPR), Chapter V | Check the consolidated text | Articles 44 to 49 |
| EDPB Recommendations 01/2020 on measures that supplement transfer tools | Version 2.0, adopted 18 June 2021 | Six steps, use cases |
| EDPB Recommendations 02/2020 on the European Essential Guarantees for surveillance measures | 10 November 2020 | Step 3 benchmark |
| Commission Implementing Decision (EU) 2021/914 | 4 June 2021 | Clauses 14, 15, 16 |
| CJEU Case C-311/18, Data Protection Commissioner v Facebook Ireland and Schrems | Judgment of 16 July 2020 | Duty to verify protection in practice |
| ICO, Completing a transfer risk assessment | Updated 15 January 2026 | UK practice |

## Standard and licence note

Based on Regulation (EU) 2016/679 (GDPR) Chapter V, EDPB
Recommendations 01/2020 (version 2.0) and 02/2020, Commission
Implementing Decision (EU) 2021/914 and the CJEU judgment in Case
C-311/18, with UK ICO guidance as a comparison. Article and clause
numbers are cited and obligations are summarised in original wording;
no legal or guideline text is reproduced. The worked example and
"Country X" are fictional. Check the consolidated texts, the
Commission's SCC page and current EDPB guidance before use. This is a
documentation format, not legal advice. Template licence: MIT.