| name | transfer-impact-assessment |
| title | Conducting Transfer Impact Assessment |
| description | Guides the post-Schrems II Transfer Impact Assessment process following EDPB Recommendations 01/2020 six-step methodology. Covers destination country surveillance law assessment, European Essential Guarantees evaluation, and supplementary measures determination. Keywords: TIA, transfer impact assessment, Schrems II, EDPB recommendations, supplementary measures. |
| author | mukul975 |
| author_url | https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/transfer-impact-assessment |
| license | Apache-2.0 |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | general |
| practice | data-protection |
| language | en |
Conducting Transfer Impact Assessment
Overview
Following the Court of Justice of the European Union's judgment in Schrems II (Case C-311/18, 16 July 2020), organisations relying on Standard Contractual Clauses (SCCs) or other Art. 46 GDPR transfer mechanisms must conduct a Transfer Impact Assessment (TIA) to evaluate whether the legal framework of the destination country provides an essentially equivalent level of protection for personal data. The EDPB adopted Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data (Version 2.0, adopted 18 June 2021), establishing a six-step methodology for this assessment.
EDPB Six-Step Methodology
Step 1: Know Your Transfers
Map all personal data transfers to third countries, identifying:
| Element | Required Information |
|---|
| Transfer identification | Unique reference for each transfer or set of transfers |
| Data exporter | Legal entity name, establishment, role (controller/processor) |
| Data importer | Legal entity name, establishment, role (controller/processor) |
| Transfer mechanism | SCCs (specifying module), BCRs, Art. 49 derogation |
| Data categories | Personal data types transferred, including any special categories |
| Data subjects | Categories of individuals whose data is transferred |
| Purpose | Specific purpose(s) for which the data is processed after transfer |
| Destination country | Country where the importer processes the data |
| Onward transfers | Any further transfers from the importer to other jurisdictions |
| Format and channel | How data is transmitted (API, SFTP, email, physical media) |
| Storage duration | How long data is retained in the destination country |
Athena Global Logistics example transfer mapping:
| Transfer Ref | Exporter | Importer | Destination | Mechanism | Data Categories |
|---|
| TIA-2025-HK-001 | Athena Global Logistics GmbH | TransPacific Freight Solutions Ltd | Hong Kong SAR | SCCs Module 2 | Customer names, addresses, customs IDs, consignment data |
