Zum Hauptinhalt springen

Create a transfer impact assessment – review third-country transfers after Schrems II

A transfer impact assessment (TIA) is required under Art. 44 ff. GDPR and the Schrems II ruling when personal data is transferred to a third country without an adequacy decision. The form follows the EDPB six-step methodology: actors (data exporter, importer, additional recipients), description of the transfer, assessment of the third-country legislation (e.g. FISA 702, CLOUD Act), guarantees (TOMs, standard contractual clauses), risk assessment with risk mapping, measures and report.

Last updated:
Video transcript
A transfer impact assessment is mandatory after the Schrems II ruling for transfers to third countries without an adequacy decision. Via „New“ you create an assessment – blank, from sample documents, or as an uploaded file. The form follows the EDPB six-step methodology – from the actors to the report. Under „General“ you set the name and the status of the assessment. In „Reference to processing activities“ you link the processing in whose context the transfer takes place. In „Actors“ you capture the data exporter – conveniently via „Load from contacts“ or your own organisation. The data importer sits in the third country – here Cascadia Data Inc. in the USA. Additional data recipients such as sub-processors are documented with the description of the data transfer. Document the start date, transmission channels, data categories and storage location – content can be pulled from the processing activity. Assess the third-country law with legislation such as FISA 702 or the CLOUD Act and prior authority requests. Under guarantees you link technical and organisational measures and the legal basis – e.g. standard contractual clauses. In the assessment you capture risks with probability and severity – the risk mapping plots them automatically. Derive measures with an implementation due date and a status. In the report you record the memo and finally set the status – with AI and your team.

A transfer impact assessment (TIA) is required under Art. 44 ff. GDPR and the CJEU's Schrems II ruling when personal data is transferred to a third country or an international organisation without an adequacy decision. preeco | data protection guides you through the six-step methodology required by the EDPB Recommendations 01/2020.

  1. Create: In the left menu under „Risks" click „Transfer impact assessments". Via „New" you create an assessment – blank, from sample documents, or as an uploaded file.
  2. General and reference to processing: Set the name and status (e.g. „Act / review") and, under „Reference to processing activities", link the processing in whose context the transfer takes place.
  3. Actors: Capture the data exporter and the data importer (in the third country) – conveniently via „Load from contacts" or your own organisation. Additional data recipients such as sub-processors are documented with the description of the data transfer.
  4. Description of the transfer: Document the start date, transmission channels, data categories and storage location. Content can be pulled from the linked processing activity.
  5. Third-country legislation: Assess the legal situation with an assessment period, relevant legislation (e.g. FISA 702, CLOUD Act) and prior authority disclosure requests.
  6. Guarantees: Link technical and organisational measures (TOMs) and maintain the legal basis – e.g. standard contractual clauses (SCC 2021/914).
  7. Assessment, measures and report: Capture risks with probability of occurrence and severity – the risk mapping plots them automatically. Derive measures with an implementation due date and a status, record the overall memo in the report, and finally set the status (acceptable, act/review or unacceptable).

Tip: Set a follow-up for the end of the assessment period – that way the third-country evaluation never silently goes stale when the legal situation changes.

Changes and errors may occur. The information in this article has been carefully compiled, but does not claim to be complete or correct.

More guides

Why can users not edit text modules in information obligations? Access conflicts in preeco | datenschutz: causes and solutions Video hosters in the EU with iframe embedding Error when integrating an AI via an API endpoint in the DSMS

Related glossary terms

Standard contractual clauses Transfer impact assessment Adequacy decision Personal Data Schrems II
Back to guides