How should organisations assess cross-border data transfers after Schrems II?

How to frame the transfer assessment after Schrems II

The practical question is not whether a transfer is international, but whether the specific transfer arrangement still delivers the level of protection GDPR expects once the destination law and access conditions are considered. A sound assessment starts with the data flow, the transfer mechanism, and the importer’s legal environment, then asks whether the risk profile can be reduced enough with safeguards.

That is why the assessment has to be written as an accountable decision record, not a box-tick. If the destination regime creates a gap that the chosen tool cannot realistically close, the organisation should not keep the transfer alive on paper alone.

For a structured way to map the relevant jurisdictions, transfer routes and fallback options, use the International Data Transfers Map as a starting point, then test the exact route you rely on rather than assuming country-level rules are uniform.

What a Schrems II transfer assessment must examine

The core assessment should answer four questions: what personal data is leaving, which transfer tool is being used, what laws or practices in the destination may affect access or onward disclosure, and whether supplementary measures can realistically restore protection. That includes government access risk, contractual enforceability, and whether the importer can actually comply with the commitments in practice.

Where a transfer depends on SCCs, the operational detail matters as much as the legal text. The transfer review should test whether the importer’s environment supports the promises made in the clauses, because the legal tool only works if the surrounding controls, such as encryption, key custody and access restrictions, match the risk.

When organisations need a practical structure for that review, the Standard Contractual Clauses (SCCs) Guide is useful because it ties the clauses to the transfer impact assessment and the supplementary measures decision.

If the destination rules create a residual exposure that SCCs alone cannot solve, the organisation should consider alternative transfer routes, including adequacy-based mechanisms where available. A good assessment also distinguishes between the transfer legal basis and the technical pattern of the transfer itself, because a secure route can still be undermined by broad importer access or weak operational discipline.

For organisations comparing transfer tools, the EU-US Data Privacy Framework Guide helps place adequacy-based transfers and fallback planning in context.

When supplementary measures are not enough

Schrems II does not require a transfer to stop every time the destination law is imperfect. It does require the organisation to be honest about whether supplementary measures actually reduce the risk to an acceptable level. Strong encryption, tight key control, minimisation, pseudonymisation and strict access constraints can help, but they are only effective when they match the threat model and the importer’s practical access.

The hardest cases are usually those where the importer must hold data in readable form, or where local law can compel access that the exporter cannot meaningfully resist. In those situations, a formal contract is not a substitute for effective protection, and the assessment should be prepared to suspend or stop the transfer if the risk remains too high.

If you need a practical checklist for deciding whether the transfer can be defended, the Transfer Impact Assessment Template is the most direct way to turn the Schrems II logic into a repeatable review.

The Data Sovereignty and Residency Guide is also helpful when the decision is not only about lawful transfer, but about whether the organisation should redesign the hosting or access model to reduce cross-border exposure altogether.

Practitioner Guidance

What to verify: Confirm that each transfer has a named owner, a current transfer tool, and a documented assessment of the destination’s legal and practical access environment. If any of those three are missing, the transfer should be treated as unreviewed rather than assumed compliant.

Decision rule: If supplementary measures cannot be shown to reduce the risk to an essentially equivalent level in practice, do not keep the transfer alive on contractual wording alone. Escalate to a stop, redesign, or a different transfer basis before treating the matter as closed.

Evidence to retain: Keep the mapping of flows, the legal basis for each transfer, the reasoning behind the supplementary measures chosen, and the review cadence. That record is what demonstrates accountability when the transfer is challenged later.

Practitioner takeaway: The real test after Schrems II is whether the transfer remains defensible under the destination’s actual access conditions, not whether the organisation can cite a clause or policy after the fact.

Related resources from NHI Mgmt Group

• Who is accountable for making cross-border transfers defensible after Schrems II?
• What do organisations get wrong about keeping cross-border transfers lawful after Schrems II?
• Why does unrestricted cross-border access to personal data create compliance risk under Schrems II?
• Why do cross-border data transfers still create GDPR risk even after the EU-U.S. Data Privacy Framework?