Transfer impact assessment (TIA)

When personal data leaves the European Economic Area under standard contractual clauses or another contractual tool, you must check that the law of the destination does not undermine the protection those clauses promise. A transfer impact assessment (TIA) records that check, following the six steps of the European Data Protection Board's Recommendations 01/2020.

#Which transfers need one

The Transfers outside the EEA list on the Assessments page shows every vendor whose region is outside the EEA, read from your vendor list:

• Adequacy decision: the country is recognized by the European Commission (for example the United Kingdom, Switzerland, Japan or Canada). No TIA is needed.
• Data Privacy Framework: when your transfer safeguard is the Data Privacy Framework, US providers certified under it need no TIA. Check the provider is on the official list.
• TIA needed: other transfers, usually under standard contractual clauses.

#Run the assessment

Choose Start TIA. It opens with what your records and our vendor catalog say, marked Suggested until you change it: where the vendor says the data is (quoted from its own document, with the link and the date we read it), the data and people, the transfer tool named in its data processing agreement, the link to its subprocessor list, and the measures your company profile already shows, such as encryption. The country analysis you wrote in one TIA is reused for the next vendor in the same country, so you write the US part once.

It walks through:

1. The transfer: countries where data is stored or accessed, the data, the purpose, the people, whether it is encrypted and who holds the keys, and onward transfers.
2. Transfer tool: adequacy, Data Privacy Framework, standard contractual clauses, binding corporate rules or an Article 49 derogation, and where it is set out.
3. Laws of the destination: whether the provider can be required to give authorities access, what it says about government requests, and the safeguards and redress available. For US cloud providers this is usually likely, and the answer notes the safeguards of Executive Order 14086.
4. Supplementary measures: technical, contractual and organisational measures, such as encryption with keys you hold or a commitment to challenge disproportionate requests.
5. Conclusion: the transfer can go ahead, can go ahead with the measures listed, or must be suspended.

Completed assessments are dated with a review date one year later. Review them sooner when the provider, the data or the law of the destination changes.

#FAQ

#Do I need a TIA for a US provider?

Not when it is certified under the Data Privacy Framework and you rely on it. Under standard contractual clauses, yes.

#Why does a TIA reuse my answers for another vendor?

The safeguards and redress in a country are the same whatever the provider, so the analysis you wrote for one US vendor fills the next one. What depends on the vendor, such as its transfer tool and what it says about government requests, is filled for that vendor only.

#Is a TIA a legal opinion on the destination country?

No. It records your own assessment, with the facts you checked and the measures you chose.