Conducting Transfer Impact Assessment

Conducting Transfer Impact Assessment

Overview

Following the Court of Justice of the European Union's judgment in Schrems II (Case C-311/18, 16 July 2020), organisations relying on Standard Contractual Clauses (SCCs) or other Art. 46 GDPR transfer mechanisms must conduct a Transfer Impact Assessment (TIA) to evaluate whether the legal framework of the destination country provides an essentially equivalent level of protection for personal data. The EDPB adopted Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data (Version 2.0, adopted 18 June 2021), establishing a six-step methodology for this assessment.

EDPB Six-Step Methodology

Step 1: Know Your Transfers

Map all personal data transfers to third countries, identifying:

Athena Global Logistics example transfer mapping:

Step 2: Identify the Transfer Tool Relied Upon

For each transfer, confirm the Art. 46 transfer mechanism:

1. SCCs (Art. 46(2)(c)): Identify the specific module (1-4) and version (2021/914).
2. BCRs (Art. 47): Confirm approval status and scope coverage.
3. Ad hoc contractual clauses (Art. 46(3)(a)): Confirm SA authorisation.
4. Codes of conduct (Art. 46(2)(e)): Confirm approved code and binding commitments.
5. Certification mechanisms (Art. 46(2)(f)): Confirm certification status and scope.

Document the specific clauses that may be affected by the destination country legal framework, particularly:

• Clause 14 (SCCs) — local laws and obligations relating to access by public authorities
• Clause 15 (SCCs) — obligations of the data importer in case of government access

Step 3: Assess Whether the Transfer Tool Is Effective in Light of All Circumstances

This is the core of the TIA. Assess the legal framework of the destination country against the four European Essential Guarantees (EDPB Recommendations 02/2020):

Essential Guarantee 1: Processing Should Be Based on Clear, Precise, and Accessible Rules

Essential Guarantee 2: Necessity and Proportionality

Essential Guarantee 3: Independent Oversight Mechanism

Essential Guarantee 4: Effective Remedies Available to the Individual

Step 4: Adopt Supplementary Measures

If Step 3 reveals that the transfer tool is not effective on its own, identify and implement supplementary measures to bridge the protection gap:

Technical Measures

Contractual Measures

Organisational Measures

Step 5: Procedural Steps If Supplementary Measures Are Adopted

1. Document the supplementary measures in the SCC Annex or in a separate addendum.
2. Implement the technical measures before commencing or continuing the transfer.
3. Execute contractual amendments reflecting the supplementary measures.
4. Verify the importer has the technical capability and legal ability to implement the measures.
5. Notify the competent SA if required (for ad hoc contractual clauses under Art. 46(3)(a)).

Step 6: Re-Evaluate at Appropriate Intervals

1. Schedule periodic TIA reviews: at minimum annually, or upon any of the following triggers:
   • New legislation enacted in the destination country affecting government access
   • Court rulings in the destination country affecting privacy protections
   • Changes to the EC adequacy decision landscape
   • EDPB or national SA guidance updates
   • Material change in the nature, volume, or sensitivity of transferred data
   • Government access request received by the importer
2. Document each re-evaluation with the date, trigger, findings, and any changes to supplementary measures.
3. If re-evaluation concludes that effective protection cannot be ensured, suspend the transfer and notify the competent SA.

Country-Specific Assessment Summaries

United States

People's Republic of China

India

Hong Kong SAR

TIA Documentation Requirements

Each TIA must be documented and include:

1. Transfer identification (Step 1 mapping data)
2. Transfer mechanism details (Step 2 analysis)
3. Destination country legal assessment with specific legislation citations (Step 3)
4. European Essential Guarantees analysis for each identified law (Step 3)
5. Supplementary measures identified and rationale (Step 4)
6. Implementation status of supplementary measures (Step 5)
7. Re-evaluation schedule and triggers (Step 6)
8. Overall conclusion: transfer may proceed / transfer may proceed with supplementary measures / transfer must be suspended
9. Sign-off by the DPO or Head of Data Protection
10. Version history tracking all updates and re-evaluations