Transfer Impact Assessments Under GDPR: SCCs, Schrems II and Supplementary Measures

Personal data transfer outside of the European Economic Area under the GDPR is not a mechanical contract process that is completed only by signing a Standard Contractual Clauses (SCC) document. In particular, after Schrems II, the data exporter and data importer must evaluate the laws and practices of the third country where the transfer will take place in the specific of the actual data flow.

In practice, this assessment is generally called Transfer Impact Assessment (TIA) or Data Transfer Impact Assessment.

What is TIA?

A TIA documents whether the chosen mechanism for an international personal data transfer can provide adequate protection in actual conditions and identifies supplementary measures where needed.

GDPR does not prescribe a separate standard form called “TIA”. However, the European Commission’s current SCCs include Clause 14, which requires the parties to assess the third country’s relevant laws and practices.

Why is Schrems II important?

The Court of Justice of the European Union’s Schrems II judgment, C-311/18, established that data exporters cannot rely solely on the transfer instrument’s wording; they must also consider the protection actually available in the third country.

What Does SCC Clause 14 Require?

Under the SCC Clause 14 of Commission Implementation Decision 2021/914, the parties shall assess that there are no laws or practices that prevent the third country's data importer from complying with SCC obligations.

The assessment may consider:

The concrete conditions of transfer,
length of the processing chain,
data categories,
the nature of the recipient,
the purpose of processing,
storage location,
third country law and practices,
Additional technical, contractual and organizational measures

These factors should be considered in context.

Step 1: Map the Data Flow

The first question is not "Which country do we send data to?"

First, establish:

which personal data is transferred,
from which system,
to which recipient,
for what purpose,
through which subprocessors.

These details must be known.

Step 2: Identify the Transfer Mechanism

Under GDPR Chapter V, a transfer may rely on:

an adequacy decision,
an appropriate safeguards mechanism,
SCC,
binding corporate rules,

or another legal mechanism applicable to the specific circumstances.

Step 3: Assess Third Country Law

If SCC is used, it should be examined whether laws and practices in the country where the data importer is located prevent compliance with contractual provisions.

Public authorities’ powers to access personal data and the safeguards available against those powers are particularly important.

Step 4: Examine the Concrete Conditions of Transfer

The risk profile of every data transfer to the same country is not the same.

For example:

encrypted customer backup,
employee data in plaintext,
customer support tickets,
prompt data sent to an AI API

may require different technical and operational assessments.

Step 5: Additional Measures

EDPB Recommendations 01/2020 is an important reference to the evaluation of complementary measures when necessary.

Technical Measures

Strong encryption,
Separate control of keys,
pseudonymisation,
data minimization.

Contractual Measures

notification of public authority requests,
transparency obligations,
subprocessor oversight.

Organizational Measures

access procedures,
incident response,
audit,
personnel authorization.

Does Encryption Solve Every Problem?

No. Encryption’s effectiveness depends on who holds the key and whether data must be decrypted during processing.

If a cloud provider must process data in plaintext, disk encryption alone may not reduce the risk sufficiently.

AI and SaaS Transfers

When using AI APIs, CRM, analytics or other SaaS platforms, also check:

Countries where data is processed,
the subprocessor list,
data retention,
use of data for model training,
access permissions.

These checks are also necessary.

A TIA Is Not a One-Off Document

Evaluation should be reconsidered when the transfer structure or third country conditions change.

For example, reassessment may be needed following:

addition of a new subprocessor,
change of data category,
a switch to a new country,
Significant change in legal regime

These changes may trigger reassessment.

TIA Checklist

Has the data flow been mapped?
Is the transfer mechanism clear?
Is the SCC module correctly selected?
Has the Clause 14 assessment been carried out?
Have third-country law and practice been studied?
Is the subprocessor chain known?
Has the need for additional measures been assessed?
Has it been confirmed that technical measures are really effective?
Has the assessment been recorded in writing?
Is a periodic re-evaluation planned?

The B10 Approach

B10 Digital Agency assesses the legal mechanism together with the actual technical data flow in international transfers. A technical inventory shows which data SaaS, cloud, API and AI systems send to which countries.

Official reference framework

This guide was updated with reference to GDPR Chapter V, SCC Clause 14 in Commission Implementing Decision (EU) 2021/914 and the final version of EDPB Recommendations 01/2020.

Conclusion

The purpose of TIA is not to put a form in the file, but to show if the transfer mechanism used provides adequate protection in the actual data stream. SCC, country analysis, and technical measures should be addressed within the same assessment.

This content is for general information only.