A transfer impact assessment, or TIA, is the written analysis behind a transfer of personal data out of the EEA under an Article 46 tool of the GDPR, such as standard contractual clauses. It answers one question. Will the safeguards in the contract actually work in the destination country, given its laws and practices?
TIAs tend to come in two unhelpful forms: long legal memos that nobody can maintain, and one-page templates that assert the answer without showing the work. Neither holds up when a customer's privacy team or a supervisory authority asks to see one.
This article explains where the requirement comes from, the method the EDPB recommends, how the Data Privacy Framework changes transfers to the United States, and how to keep a TIA proportionate.
What Schrems II decided
In July 2020, the Court of Justice of the EU gave judgment in Case C-311/18, known as Schrems II. Two holdings matter here.
First, the Court invalidated the EU-US Privacy Shield adequacy decision. It found that US surveillance programs, including those under Section 702 of the Foreign Intelligence Surveillance Act and Executive Order 12333, were not limited in a way essentially equivalent to EU law, and that EU individuals lacked effective redress.
Second, the Court upheld standard contractual clauses, with a condition. SCCs bind the parties, not the government of the destination country. So the exporter, with the importer's help, must verify case by case whether the law of the destination country allows the importer to comply with the clauses. Where it does not, the exporter must adopt supplementary measures or suspend the transfer.
The 2021 standard contractual clauses wrote this into Clause 14. The parties warrant, on the basis of a documented assessment, that they have no reason to believe local laws and practices prevent compliance. That documented assessment is the TIA. The clauses themselves are covered in standard contractual clauses for international transfers.
The EDPB's six steps
The EDPB's Recommendations 01/2020 on supplementary measures, finalized in June 2021, set out six steps:
Know your transfers. Map where personal data goes, including onward transfers. Remote access from outside the EEA, such as a support engineer viewing data, counts as a transfer.
Identify the transfer tool you rely on: adequacy, an Article 46 tool, or an Article 49 derogation.
Assess whether the Article 46 tool is effective in light of all the circumstances of the transfer, including the law and practice of the destination country.
Identify and adopt supplementary measures where the assessment finds the tool alone is not enough.
Take any formal procedural steps the supplementary measures require.
Re-evaluate at appropriate intervals, and whenever something material changes.
Step 3 is the TIA in the narrow sense. Steps 1 and 2 are its inputs, drawn from your record of processing and your vendor list. Step 4 is its output.
What step 3 examines
The assessment concerns the specific transfer, not the country in the abstract. The same destination can produce different answers for different transfers.
The importer and the data. Who the importer is, what data it receives, in what format, and for what purpose. Data that arrives encrypted with keys the importer does not hold is a different case from data processed in clear.
The laws that could apply to this importer. Particularly laws that give public authorities access to data, and whether that access is limited to what is necessary and proportionate, subject to independent oversight, and open to effective redress. The EDPB's recommendations on the European Essential Guarantees describe these standards.
How the law is applied in practice. The final recommendations accept that you can take practice into account, using sources that are relevant, objective, reliable, verifiable, and publicly available or otherwise accessible. They do not accept subjective factors, such as an assumption that authorities are unlikely to be interested in your data, as a substitute.
Supplementary measures
Where the assessment finds a gap, the EDPB groups supplementary measures into three kinds:
Technical measures, such as encryption where the keys stay under the control of the exporter in the EEA or an adequate country, or pseudonymization where the importer cannot reidentify the data.
Contractual measures, such as commitments to challenge requests, transparency about requests received, and notice obligations that go beyond the SCCs.
Organizational measures, such as internal policies for handling government requests, data minimization, and strict access controls.
The EDPB's view is that contractual and organizational measures generally cannot, on their own, close a gap where the destination's law allows access beyond what is necessary and proportionate. In that case, technical measures are what can prevent access.
The recommendations also describe scenarios where the EDPB could not identify effective technical measures. The clearest is a provider that needs the data in clear to deliver its service. That describes a great deal of SaaS, which is why the US position after 2023 matters so much.
The United States after the Data Privacy Framework
In October 2022, the US issued Executive Order 14086. It added necessity and proportionality limits on signals intelligence activities and a new redress mechanism that includes a Data Protection Review Court. In July 2023, the Commission adopted an adequacy decision for the EU-US Data Privacy Framework.
That has two consequences for TIAs:
Transfers to DPF-certified US organizations rely on adequacy under Article 45, so no TIA is needed for them. Verify that the recipient's certification is active and covers the type of data you send.
Transfers to US recipients under SCCs still need a TIA. But the safeguards introduced by Executive Order 14086 apply to data transferred to the US whatever tool is used, and the Commission and the EDPB have both said they can be taken into account when assessing other transfer tools.
The framework has faced legal challenge, and adequacy decisions are subject to periodic review. A US TIA should record the position on the date it was written and be revisited if the framework's status changes.
Keeping a TIA proportionate
A TIA does not need to be a treatise on foreign law. A usable one follows a consistent structure:
The transfer: exporter, importer, data categories, purpose, format, and any onward transfers.
The tool: the SCC module, or another Article 46 mechanism.
The legal assessment: which access laws could apply to this importer and this data, and how they measure against the European Essential Guarantees. Reuse a country assessment across transfers, and record its source and date.
Transfer-specific factors: encryption, key control, data sensitivity, and the importer's policy on government requests.
Supplementary measures adopted, each with a reference to where it is implemented.
Conclusion and review date.
The country-level analysis is the expensive part. You can rely on an analysis prepared by counsel or provided by the importer, then add the transfer-specific facts yourself. Record the source and date, and check that the importer's analysis covers your data and your use of their service.
The UK runs its own version. The ICO calls it a transfer risk assessment and publishes a tool for it. The tests differ, so a UK transfer needs the UK analysis rather than a copy of the EU one.
A TIA is a legal analysis, and its conclusion for a given country can shift with legislation or court decisions. Have counsel review your country assessments, and confirm them again when the law changes.
How TrustLynce helps
TrustLynce's data privacy workflows include a TIA template linked to each transfer and processing activity, with a review date. Third-party risk management flags vendors whose hosting or sub-processor locations change, so the affected assessments come up for review.