Who is responsible for deciding whether supplementary measures are needed for cross border transfers?

Why Shared Transfer Decisions Matter Under EU Law

The question is not only who signs the transfer paperwork, but who is actually accountable for deciding whether the transfer remains protected in practice. Under EU transfer rules, that matters because the assessment must look at the destination country’s legal and technical environment, not just the contract language. If either party treats the decision as a formality, supplementary measures can be missed and the transfer may lose its lawful basis.

That shared responsibility also affects governance: the exporter typically has visibility into the data, purpose, and originating obligations, while the importer understands the receiving environment and operational constraints. Neither side can make a credible decision alone if it lacks those inputs. In practice, many teams discover this only after a transfer assessment has stalled or a regulator has already questioned the assumption that the contract itself was enough.

How the Decision Process Works in Practice

The decision starts with a transfer risk assessment that tests whether the law and practice in the destination country undermine the level of protection required by EU law. The exporter cannot outsource that judgment completely, because it remains responsible for choosing whether to transfer at all. The importer cannot sit back either, because it is often the party best placed to describe local access paths, disclosure obligations, and the practical limits of any technical safeguards.

Good practice is to treat the decision as a joint evidence exercise. The parties should review the data category, the transfer mechanism, government access risks, the feasibility of encryption or pseudonymisation, and whether organisational measures can meaningfully reduce exposure. Where the assessment shows residual concern, supplementary measures may need to be technical, contractual, or operational, but they must be effective against the actual legal and operational risk, not just documented as present.

• The exporter should define the data sensitivity, transfer purpose, and minimum acceptable protection outcome.
• The importer should provide facts about local law, access requests, hosting conditions, and control constraints.
• Both parties should agree whether the transfer can proceed only with added encryption, key separation, or tighter access control.

That process works only when the assessment is specific to the transfer and revisited when the legal or technical environment changes.

Common Edge Cases in Transfer Accountability

Shared responsibility often creates delay, but it is usually better than a rushed approval that no one can defend later.

A frequent edge case is the use of a processor or subprocessor chain, where the importer may rely on downstream parties the exporter never interacts with directly. Another is where the importer is operationally capable of receiving the data but cannot evidence the local safeguards needed to offset government access or disclosure risk. Guidance across the field is consistent on the need for a documented assessment, but there is still room for organisational judgment on which supplementary measures are practical for a given transfer.

Another common mistake is assuming that standard contractual clauses alone solve the problem. They are important, but they do not remove the need to test whether the receiving environment can undermine them. The sharper the sensitivity of the data, the more important it becomes to distinguish between paper compliance and controls that actually reduce exposure. For that reason, teams should expect some transfers to be approved only with added restrictions, while others may need to be paused entirely if no effective safeguard can be justified.

Practitioner Guidance

What to verify: Check that both parties can explain the transfer decision in factual terms, including what is being transferred, where it lands, and what supplementary measures were considered. If either side cannot show how the destination environment was assessed, the decision is not ready for reliance.

What practitioners underestimate: The hardest part is often not selecting a safeguard, but proving that the safeguard still works against the specific legal and operational exposure in the receiving country. Teams often overestimate the value of generic contract language and underestimate the importance of evidence about access, disclosure, and technical resilience.

Practitioner takeaway: Treat the transfer decision as a joint accountability exercise with evidence behind it, not as a one-time legal approval; if the receiving environment cannot be assessed or the safeguard cannot be shown to reduce real exposure, the transfer should not proceed on assumptions alone.

Related resources from NHI Mgmt Group

• How should organisations avoid hidden cross-border data transfers in ZTNA?
• Why do cross-border data transfers create such a hard compliance problem?
• Why do cross-border data transfers create governance risk when organisations store government or regulated data in cloud services?
• How do compliance teams evaluate whether a cross-border signing process is actually operating within regulatory boundaries?