Transfer Impact Assessment (TIA) Template: Document SCC Transfers the EDPB Way

Standard contractual clauses only protect personal data sent outside the EEA if the law and practice in the destination country let the importer actually honour them, and the exporter has to prove it assessed that. After the Court of Justice's Schrems II judgment (Case C-311/18, July 2020), the 2021 EU standard contractual clauses (Commission Implementing Decision (EU) 2021/914) made this explicit: under Clause 14 the parties warrant they have no reason to believe local laws prevent compliance, must take specified factors into account, and must document the assessment and make it available to the supervisory authority on request. That documented assessment is what practitioners call a transfer impact assessment (TIA). This template follows the six-step roadmap in EDPB Recommendations 01/2020 (version 2.0, adopted 18 June 2021) and is meant to be completed per transfer or per group of similar transfers by privacy, security and procurement teams together. Status checked 27 October 2026; laws and guidance change, so confirm the current position before relying on it. For the clauses themselves, see the Standard Contractual Clauses (SCCs) Guide.

How to use this template

• One TIA per transfer scenario: complete a TIA for each importer and destination, or for a documented group of transfers with the same data, purpose, importer type and destination.
• Replace placeholders: text in [square brackets] is for you to complete, for example [Organisation], [Importer], [Destination country].
• Keep the evidence: every finding in sections 4 and 5 should cite a source (importer questionnaire, legal opinion, published report) and its date.
• Security owns section 6: supplementary technical measures, such as encryption and key custody, must be described precisely enough that a reviewer can tell whether the importer could access data in clear text.
• Review on change: the TIA is a living record. Section 9 sets the triggers.
• Not legal advice: this template structures the work; the conclusion should be reviewed by your data protection officer or legal counsel.

1. Assessment details

2. Know your transfer (EDPB step 1)

Describe the transfer in the terms Clause 14(b)(i) requires: the specific circumstances, including the length of the processing chain, the number of actors, the transmission channels, onward transfers, the categories of data, the purpose, the sector and where data is stored.

• 2.1 Purpose: [why the data is transferred, for example hosting, support, analytics]
• 2.2 Data subjects and data categories: [customers, employees; identifiers, contact data, financial data]. Flag special category or criminal offence data: [yes/no, which]
• 2.3 Volume and frequency: [one-off, continuous, records per month]
• 2.4 Form of transfer: [data stored in destination / remote access from destination for support / transit only]. The EDPB treats remote access from a third country as a transfer.
• 2.5 Format in the destination: [clear text / pseudonymised / encrypted with keys held by whom]
• 2.6 Processing chain: [sub-processors and onward transfers, each with country]
• 2.7 Data minimisation check: [confirm only necessary data is transferred, and whether the purpose could be met with less]

3. Transfer tool (EDPB step 2)

• 3.1 Adequacy: is the destination, or the importer, covered by an adequacy decision? [yes/no, decision reference]. If an adequacy decision covers the transfer, a TIA under Clause 14 is not required for that transfer; record the basis. For the United States, the EU-US Data Privacy Framework adequacy decision of 10 July 2023 applies only to importers certified under the framework: [certified yes/no, certification checked on date].
• 3.2 Article 46 GDPR tool used: [SCCs under Decision 2021/914, module; BCRs; other]
• 3.3 Derogation: if relying on an Article 49 derogation instead, state which and why it applies to an occasional transfer: [n/a or details]
• 3.4 SCC version check: confirm the contract uses the 2021 clauses. The 2001 and 2010 decisions were repealed with effect from 27 September 2021, and contracts on the old clauses were treated as providing safeguards only until 27 December 2022: [confirmed]

4. Destination laws and practices (EDPB step 3)

Assess whether the laws and practices of the destination, in particular those requiring disclosure to public authorities or authorising access, could stop the importer honouring the SCCs. The EDPB asks for information that is relevant, objective, reliable, verifiable and publicly available or otherwise accessible, such as case law, oversight body reports and the importer's own information.

4.8 Conclusion of step 3: [No problematic legislation applies to this transfer / Problematic legislation may apply: proceed to section 6]. Note that the EDPB says the absence of past requests is never decisive on its own.

5. Importer commitments and information

Clause 14(c) requires the importer to make best efforts to provide relevant information for the assessment. Record what was provided.

• 5.1 Questionnaire returned: [date, version, signed by]
• 5.2 Government access policy: [importer's documented process to review requests for legality, challenge where there are reasonable grounds, and disclose the minimum permissible, as Clause 15.2 requires]
• 5.3 Notification commitment: [importer will notify the exporter promptly of legally binding requests or direct access, under Clause 15.1, and of law changes under Clause 14(e)]
• 5.4 Transparency reporting: [link and date of the importer's most recent report]
• 5.5 Sub-processor flow-down: [confirmation that the same obligations apply to sub-processors]

6. Supplementary measures (EDPB step 4)

If section 4 found problematic legislation, identify measures that prevent or render ineffective access contrary to EU standards. The EDPB states that contractual and organisational measures alone generally cannot overcome access by public authorities; in some cases only properly implemented technical measures can.

6.1 Key custody statement: [where keys are generated, stored and used; who can access them; whether the importer's service needs clear text to perform the service]. If the service requires the importer to process data in clear text in the destination, encryption at rest with exporter-held keys will not address access during processing; record this explicitly. Key ownership models are covered in the BYOK, HYOK and External Key Management Guide.

6.2 Residual risk: [describe what risk remains after measures]

7. Procedural steps (EDPB step 5)

• 7.1 Contract changes: [any additional clauses added to the SCCs; confirm they do not contradict the SCCs]
• 7.2 Supervisory authority: [whether consultation or authorisation is needed for the chosen tool]
• 7.3 Approval: [approver name, role, date]

8. Conclusion and decision

8.1 Rationale: [two to five sentences explaining the decision, citing sections 4 and 6]

8.2 Availability: this TIA is documented under Clause 14(d) and will be made available to the competent supervisory authority on request.

9. Monitoring and re-evaluation (EDPB step 6)

• 9.1 Review interval: [at least annually, and on any trigger below]
• 9.2 Triggers: change in destination law or a relevant court judgment; change to an adequacy decision; importer notification under Clause 14(e) or 15.1; new sub-processor or onward transfer; change in data categories or purpose; a security incident at the importer.
• 9.3 Owner: [name, role]
• 9.4 Suspension procedure: [who decides, how data flows are stopped technically, how data already transferred is returned or deleted]

Implementation guidance

Running a TIA programme

1. Inventory transfers: start from the record of processing and vendor register; include remote support access, sub-processors and cloud regions, not only primary storage locations.
2. Group and prioritise: group transfers by importer, destination and data type. Assess special category data, large volumes and destinations with broad access laws first.
3. Standardise the importer questionnaire: ask for the information sections 4 and 5 need, including request statistics and the government access policy.
4. Reuse destination analysis: a legal analysis of one country's laws can support many TIAs; keep it as a dated, versioned annex and update it centrally.
5. Bring security in early: section 6 decisions, such as exporter-held keys or pseudonymisation, are architecture choices that are cheaper at procurement than after go-live.
6. Link to contracts: no new transfer should go live without an approved TIA reference in the contract record.

Where identity and security fit

Many transfers are not file exports but access: a support engineer abroad signs in to an EEA system, or an importer's automation account calls an API. The EDPB treats remote access from a third country as a transfer, so identity controls become transfer controls: restrict which identities in which locations can reach personal data, log every access, and make sure service accounts and API keys used by the importer are inventoried, scoped and rotated. See the API Key Management Guide and the Third-Party Risk Management Guide.

UK transfers

For UK GDPR transfers the ICO publishes its own transfer risk assessment guidance and TRA tool. The ICO page, updated on 15 January 2026, says a transfer risk assessment is now referred to in UK legislation as a "data protection test", following the Data (Use and Access) Act. Use the ICO guidance for UK transfers rather than assuming the EDPB approach applies unchanged.

Common mistakes

• Copying the vendor's TIA: an importer's generic assessment does not describe your data, purpose and measures.
• Relying on "no requests so far": the EDPB says the absence of past requests is never decisive on its own.
• Encryption with importer-held keys: recorded as a supplementary measure when the importer can decrypt on demand.
• Forgetting sub-processors and support access: the processing chain is part of Clause 14(b)(i).
• Never reviewing: laws, adequacy decisions and importers change; a TIA from 2021 is unlikely to reflect today's position.

Sources

• EUR-Lex: Commission Implementing Decision (EU) 2021/914 on standard contractual clauses
• EDPB: Recommendations 01/2020 on measures that supplement transfer tools (version 2.0)
• European Commission: EU-US data transfers
• ICO: Transfer risk assessments

This template is provided for guidance and must be adapted to your organisation. This guide summarises the EU SCC Clause 14 assessment and EDPB Recommendations 01/2020 and is not legal advice. Related NHI Mgmt Group resources: Standard Contractual Clauses (SCCs) Guide · International Data Transfers Map · Third-Party Risk Management Guide