Transfer Impact Assessment (TIA)

The Transfer Impact Assessment (TIA) is the post-Schrems II compliance artefact for cross-border transfers of personal data from the EU/EEA under GDPR Article 46 safeguards (typically Standard Contractual Clauses or Binding Corporate Rules). The CJEU's judgment in Case C-311/18 held that controllers and processors cannot rely on a transfer mechanism in isolation — they must also verify that the destination country's law and practice (particularly intelligence surveillance and the availability of redress) do not undermine the safeguard. The EDPB's Recommendations 01/2020 set out the methodology.

A complete TIA records: the nature of the data, the categories of individuals, the recipients and sub-recipients, the mechanism relied on (SCCs module 1/2/3/4, BCRs, etc.), the destination country's privacy law assessment, the destination country's government-access regime, any supplementary measures (encryption with Union-held keys, pseudonymisation, split processing), and the residual risk conclusion. For organisations transferring to the US under the EU-US Data Privacy Framework, a formal TIA may still be prudent in high-risk categories (government interactions, intelligence-adjacent processing), even though the DPF itself replaces the primary adequacy question. Under the UK GDPR, the equivalent artefact is the Transfer Risk Assessment (TRA) under the ICO's guidance.