Transfer Impact Assessment (TIA) Template, GDPR Chapter V

Transfer Impact Assessment: [Transfer name]

A transfer impact assessment (TIA) documents whether personal data sent to, or accessed from, a country outside the EEA under an Article 46 GDPR transfer tool keeps a level of protection essentially equivalent to the EU's. It follows the six steps in EDPB Recommendations 01/2020 on supplementary measures (version 2.0, adopted 18 June 2021), the CJEU judgment in Case C-311/18 (Schrems II, 16 July 2020) and Clause 14 of the standard contractual clauses (SCCs) in Commission Implementing Decision (EU) 2021/914 of 4 June 2021, which requires the parties to document such an assessment. It also notes the UK equivalent (the transfer risk assessment, called a "data protection test" in UK law since the Data (Use and Access) Act 2025). Replace every [bracketed] value and every row marked Example. This is a documentation format, not legal advice: check the current official text and ask a qualified professional.

Contents

1. Step 1: know the transfer
2. Step 2: transfer tool
3. Step 3: law and practice of the destination
4. Step 4: supplementary measures
5. Step 5: procedural steps
6. Step 6: re-evaluation
7. Conclusion
8. Jurisdiction notes
9. References

The six steps and their outcomes:

Document control

Approvals

Revision history

1. Step 1: know the transfer

Example: Talvik Payroll Services BV processes payroll data for client employers. Its software vendor's support team in Country X connects to Talvik's EU-hosted system to fix defects. Data in scope: employee names, bank account numbers, salary and tax identifiers. Access happens a few times a month, on ticket.

2. Step 2: transfer tool

3. Step 3: law and practice of the destination

3.1 Legal framework

3.2 Practice and the importer's experience

3.3 Step 3 conclusion

[No problematic law applies / Problematic law applies or may apply, continue to Step 4].

Example: Talvik's external counsel reports that Country X law allows security agencies to compel software vendors to give access to data they can read, with no independent prior approval and no remedy for non-residents. The vendor falls within that scope. Conclusion: continue to Step 4.

4. Step 4: supplementary measures

5. Step 5: procedural steps

6. Step 6: re-evaluation

Review on [YYYY-MM-DD] and on any of these triggers: change in destination law or practice, an access request received, a new sub-processor or access path, a court judgment or new EDPB or Commission guidance, or a change in the data.

7. Conclusion

Example: Proceed with measures SM-01, SM-02 and SM-04 for masked data. Clear-text remote access from Country X is suspended because no effective measure was found for it.

8. Jurisdiction notes

As of October 2026 (not legal advice; check the current official text):

9. References

Standard and licence note

Based on Regulation (EU) 2016/679 (GDPR) Chapter V, EDPB Recommendations 01/2020 (version 2.0) and 02/2020, Commission Implementing Decision (EU) 2021/914 and the CJEU judgment in Case C-311/18, with UK ICO guidance as a comparison. Article and clause numbers are cited and obligations are summarised in original wording; no legal or guideline text is reproduced. The worked example and "Country X" are fictional. Check the consolidated texts, the Commission's SCC page and current EDPB guidance before use. This is a documentation format, not legal advice. Template licence: MIT.