transfer-impact-assessment

name	transfer-impact-assessment
title	Conducting Transfer Impact Assessment
description	Guides the post-Schrems II Transfer Impact Assessment process following EDPB Recommendations 01/2020 six-step methodology. Covers destination country surveillance law assessment, European Essential Guarantees evaluation, and supplementary measures determination. Keywords: TIA, transfer impact assessment, Schrems II, EDPB recommendations, supplementary measures.
author	mukul975
author_url	https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/transfer-impact-assessment
license	Apache-2.0
version	0.1.0
execution_mode	open
jurisdiction	general
practice	data-protection
language	en

Conducting Transfer Impact Assessment

Overview

Following the Court of Justice of the European Union's judgment in Schrems II (Case C-311/18, 16 July 2020), organisations relying on Standard Contractual Clauses (SCCs) or other Art. 46 GDPR transfer mechanisms must conduct a Transfer Impact Assessment (TIA) to evaluate whether the legal framework of the destination country provides an essentially equivalent level of protection for personal data. The EDPB adopted Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data (Version 2.0, adopted 18 June 2021), establishing a six-step methodology for this assessment.

EDPB Six-Step Methodology

Step 1: Know Your Transfers

Map all personal data transfers to third countries, identifying:

Element	Required Information
Transfer identification	Unique reference for each transfer or set of transfers
Data exporter	Legal entity name, establishment, role (controller/processor)
Data importer	Legal entity name, establishment, role (controller/processor)
Transfer mechanism	SCCs (specifying module), BCRs, Art. 49 derogation
Data categories	Personal data types transferred, including any special categories
Data subjects	Categories of individuals whose data is transferred
Purpose	Specific purpose(s) for which the data is processed after transfer
Destination country	Country where the importer processes the data
Onward transfers	Any further transfers from the importer to other jurisdictions
Format and channel	How data is transmitted (API, SFTP, email, physical media)
Storage duration	How long data is retained in the destination country

Athena Global Logistics example transfer mapping:

Transfer Ref	Exporter	Importer	Destination	Mechanism	Data Categories
TIA-2025-HK-001	Athena Global Logistics GmbH	TransPacific Freight Solutions Ltd	Hong Kong SAR	SCCs Module 2	Customer names, addresses, customs IDs, consignment data