transfer-impact-assessment
Use this for each transfer, or each group of transfers to the same importer under the same mechanism, before data flows and whenever the importer, the data or the destination law changes. You get two kinds of file in a new folder, ./transfer-impact-assessment/: a spreadsheet you can open in Excel listing every transfer, with the receiving company, country, data, purpose and how the data is reached (transfer-inventory.csv), and one written assessment per receiving company that counsel can check line by line (<importer>-tia.md). This skill drafts for a human to review and sign; this skill never marks a control effective. The destination law conclusion and the decision to transfer belong to the exporter's privacy lead and counsel.
Inputs to gather
Read the record of processing activities, the vendor and sub-processor lists, the data processing agreements and their transfer clauses, the importer's published sub-processor list, security documentation and transparency report if one exists. Ask the reader, in one message: what data goes to the importer and why, whether the company is controller or processor for it, where the importer and its support staff access the data from, and whether counsel or the importer has supplied any assessment of the destination country's law.
Step 1: confirm there is a transfer
Under the EDPB's guidance, a transfer exists when an exporter subject to the GDPR for the processing discloses or makes personal data available to a separate importer located in a third country. Remote access counts: a support engineer viewing EU-hosted data from outside the EEA is a transfer, even if the servers sit in the EU. Map the full chain in the transfer spreadsheet (transfer-inventory.csv): importer, country, data categories, data subjects, purpose, access type (storage, remote access, onward transfer), sub-processors and their countries. Onward transfers by the importer are part of the assessment. Cross-check the spreadsheet against the record of processing and the sub-processor list, and list any transfer missing from either: an assessment of an unrecorded transfer protects nothing.
Step 2: identify the mechanism
Chapter V of the GDPR offers three routes, in this order of preference:
- Adequacy decision (Article 45): the destination, or the importer's certification under a framework recognised by one, is covered. No transfer impact assessment is needed for that route; record the decision relied on and check that the importer's certification is active and covers the data type concerned.
- Appropriate safeguards (Article 46): standard contractual clauses, binding corporate rules or another listed tool. This is where the assessment is needed. The standard contractual clauses themselves ask the parties to document it and make it available to the supervisory authority on request.
- Derogations (Article 49): narrow and for occasional transfers. Do not rely on them for a recurring vendor relationship.