Artifact GuideEU

EU GDPR SCC Transfer Impact Assessment

Where Clause 14 applies to an EU GDPR transfer that uses the 2021 SCCs, the assessment tests destination-country laws and practices against the specific transfer and any supplementary safeguards.

Based on official EU sources for Chapter V transfers, adequacy decisions, Commission SCCs, Clause 14 transfer impact assessment, and transfer suspension triggers.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Jul 25, 2026
Questions
3

Structured answer sets in this page tree.

Primary sources
5

Cited legal and guidance references.

Publication metadata
Sorena AI
Published May 9, 2026
Updated Jul 25, 2026
Overview

For a transfer that uses the 2021 EU , first confirm that no covers it and that the chosen SCC module fits the parties. Complete the Clause 14 assessment for the specific transfer, document any , and suspend or end the transfer if appropriate safeguards cannot be ensured. The 2021 transfer SCCs cannot be used where the importer's relevant processing is already directly subject to the GDPR. Clause 14 also has a narrow Module 4 return-transfer exception.

Search this module

Find a question or answer quickly

3 of 3 questions
Question 1

How should teams handle an SCC transfer impact assessment?

Run a transfer-specific Article 46 check. First map the transfer: exporter, importer, roles, destination country, onward transfers, categories and format of personal data, processing purpose, transfer route, storage location, recipient type, economic sector, and processing-chain length.

Then confirm the transfer tool. If a valid European Commission covers the country, territory, sector, or organisation for the transfer, the SCC is not the route for that transfer, although the adequacy decision should still be monitored. The 2021 transfer SCCs also are not designed for an importer whose relevant processing is already directly subject to the GDPR. If the SCCs can be used, select the correct module, complete the annexes, and assess whether destination-country laws and practices could prevent the importer from complying with the clauses.

  • Start with the Article 45 adequacy check before using SCCs as the Article 46 transfer tool.
  • Use the SCC module that matches the parties' roles: controller-to-controller, controller-to-processor, processor-to-processor, or processor-to-controller.
  • Confirm that the importer's processing is not directly subject to the GDPR before using the 2021 transfer SCCs.
  • Complete the SCC annexes so the transfer, data categories, purposes, roles, safeguards, sub-processors, and competent authority are clear.
  • Record the Clause 14 assessment of relevant destination-country laws and practices, public-authority access risks, and any contractual, technical, or organisational safeguards.
  • Suspend the transfer if the exporter concludes appropriate safeguards cannot be ensured, or if the competent supervisory authority instructs suspension.

When is an SCC needed under the EU GDPR?

It is generally needed when a transfer relies on the 2021 SCCs as an Article 46 safeguard rather than a valid Article 45 . Confirm first that the importer and module fall within the SCCs' scope. Section III, including Clause 14, does not apply when an EEA processor uses Module 4 only to return to a non-EEA controller data that the processor originally received from that controller; the exception does not cover personal data originating in Europe.

Citations
Regulation (EU) 2016/679 (GDPR)

GDPR Chapter V sets the sequence for international transfers: Article 45 adequacy decisions, Article 46 appropriate safeguards, and Article 49 derogations.

European Commission SCC Q&A

Commission Q&A explains SCC scope, modules, annex completion, Clause 14 assessments, and the narrow Module 4 return-transfer exception.

Question 2

What should the assessment record?

The record should be specific enough to show why the SCCs work for this transfer. Under Clause 14, the parties take due account of the transfer's circumstances, relevant destination-country laws and practices, and safeguards that supplement the clauses. The importer should provide relevant information and continue cooperating with the exporter.

The evidence file should also preserve the operational result: whether the transfer can proceed, which were adopted, which public-authority request notices or transparency limits apply, and what event will reopen the assessment.

  • Exporter, importer, controller/processor role, SCC module, signatories, governing choices, and competent supervisory authority.
  • Categories of data subjects, personal data categories, sensitive-data indicators, transfer purpose, retention, storage location, transmission channel, and onward-transfer chain.
  • Destination-country laws and practices relevant to the importer and transfer, including public-authority disclosure or direct-access risks.
  • Objective support used in the assessment, such as case law, independent oversight reports, sector request history, or documented practical experience where lawfully shareable and corroborated.
  • Supplementary contractual, technical, and organisational safeguards, plus why they are effective for the destination country, importer, data format, and processing context.
  • Decision outcome, approver, importer notice duties, suspension or termination criteria, reassessment trigger, and the date of the next review.
Citations
European Commission SCC Q&A

Commission Q&A lists the transfer details to clarify in SCC annexes and explains the Clause 14 transfer impact assessment.

Question 3

When do supplementary measures or suspension become necessary?

Supplementary measures are needed when the Clause 14 assessment is negative or shows that the SCCs alone may not ensure the required protection. The measures can be contractual, technical, or organisational, but they must actually address the identified gap for the specific transfer.

If the exporter receives an importer notice, learns that the importer can no longer comply, or concludes that no appropriate safeguards can be ensured, the transfer should be suspended. The SCCs also provide termination and return-or-delete mechanics when compliance is not restored.

  • Use only after identifying the specific law, practice, access risk, data format, or importer constraint they address.
  • Do not treat policy promises alone as sufficient where the risk requires a technical or organisational control.
  • Require importer notice if laws, practices, or disclosure requests mean it is or has become unable to comply with Clause 14.
  • Suspend the transfer when appropriate safeguards cannot be ensured, and document whether termination, return, or deletion is required under the SCCs.
  • Reopen the assessment after new onward transfers, destination-country legal changes, importer control changes, public-authority access events, data-category changes, or security-control changes.
Citations
Recommended next step

This FAQ is a cited SCC transfer review checklist

Sorena can turn the SCC transfer impact assessment points on this page into cited transfer maps, Clause 14 evidence requests, supplementary-safeguard reviews, and reassessment triggers.

Research workflow
Open Research Copilot for EU GDPR

Ask questions tied to cited sources about SCC transfers, adequacy checks, Clause 14 assessments, supplementary safeguards, and suspension triggers using the cited sources on this page.

Explore next step
Talk to Sorena
Talk through implementation

Review your SCC transfer assessment workflow, evidence gaps, importer inputs, and supplementary-safeguard decisions with Sorena.

Explore next step
Primary sources

References and citations

Commission Implementing Decision (EU) 2021/914
eur-lex.europa.eu
Referenced sections
  • Binding SCC decision for importer notice, public-authority access obligations, supplementary safeguards, suspension, termination, and return-or-delete outcomes.
"the data exporter shall suspend the data transfer"
European Commission - Adequacy decisions
commission.europa.eu
Referenced sections
  • Commission source for checking whether an adequacy decision covers the destination before SCCs are used.
"Adequacy decisions"
European Commission - Standard Contractual Clauses
commission.europa.eu
Referenced sections
  • Commission SCC overview confirming SCCs as pre-approved clauses for EU-to-third-country GDPR transfers and linking to the modernised SCC materials.
"Standard Contractual Clauses"
European Commission SCC Q&A
commission.europa.eu
Referenced sections
  • Commission Q&A lists the transfer details to clarify in SCC annexes and explains the Clause 14 transfer impact assessment.
"Standard Contractual Clauses"
Regulation (EU) 2016/679 (GDPR)
eur-lex.europa.eu
Referenced sections
  • GDPR Chapter V sets the sequence for international transfers: Article 45 adequacy decisions, Article 46 appropriate safeguards, and Article 49 derogations.
"Transfers of personal data to third countries or international organisations"
Related guides

Explore more topics

Does the EU GDPR apply outside the EU under Article 3?
A GDPR Article 3 territorial-scope FAQ covering EU establishment, non-EU targeting, monitoring in the EU, public-international-law cases, and Article 27 representatives.
EU GDPR Applicability Test for Products, Vendors, and Data Flows
A concrete GDPR scope test for personal data, controller and processor roles, EU establishment, EU targeting or monitoring, special-category and child data, transfers, vendors, and evidence.
EU GDPR Article 30 RoPA Intake Workflow
This GDPR Article 30 RoPA intake workflow helps capture controller and processor fields, owners, transfers, retention, security measures, and evidence before a processing activity goes live.
EU GDPR Article 6 Legal Bases FAQ
FAQ on the six Article 6 GDPR lawful bases, consent caveats, legitimate interests, public-task and legal-obligation limits, and Article 9 special-category data.
EU GDPR Automated Decision-Making and Profiling: Article 22 Scope, Safeguards, and Evidence
GDPR guide to profiling and Article 22 decisions: scope, transparency, lawful basis, DPIA triggers, safeguards, human intervention, challenge rights, and evidence.
EU GDPR Breach Notification 72 Hours: Article 33 and 34 workflow
Official source EU GDPR breach notification workflow covering awareness, 72-hour supervisory authority notices, processor escalation, high-risk data-subject communication, delay reasons, and evidence logs.
EU GDPR Breach Notification Workflow: 72-hour clock, risk assessment, and records
A concrete EU GDPR breach notification workflow for detecting and triaging incidents, starting the awareness clock, assessing risk, notifying authorities or data subjects, and keeping Article 33 records.
EU GDPR Checklist: scope, lawful basis, DSARs, DPIA, RoPA, transfers
This GDPR checklist helps review scope, lawful basis, notices, DSAR handling, DPIAs, RoPA, processor contracts, SCC transfers, breach notification, retention, security, and evidence.
EU GDPR Children and Special-Category Data Guide
GDPR guide to children's consent and special-category data: Article 8 national age variation, Article 9 conditions, transparency, DPIA triggers, safeguards, and evidence.
EU GDPR Compliance Checklist: scope, rights, DPIA, RoPA, transfers
Practical EU GDPR compliance guide for mapping scope, lawful basis, notices, data-subject rights, DPIAs, RoPA, processor terms, breaches, transfers, retention, security, and penalties.
EU GDPR Controller, Processor, and Joint Controller Roles
Classify GDPR controllers, processors, and joint controllers from actual decision-making, then document Article 26 allocation, Article 28 terms, instructions, and vendor evidence.
EU GDPR Data Subject Rights and DSAR Workflow
GDPR rights-request workflow for intake, identity checks, request scope, the one-month response clock, extensions, refusals, processor coordination, and evidence.
EU GDPR deadlines and compliance calendar
EU GDPR calendar for calculating rights-request deadlines, breach notification, DPIA and prior-consultation gates, transfer reviews, and retention checks.
EU GDPR DPIA and Prior Consultation Workflow
Screen high-risk processing, run a GDPR Article 35 DPIA, record mitigation, and identify when Article 36 prior consultation is required.
EU GDPR DPIA and risk management under Articles 35 and 36
EU GDPR DPIA guide covering Article 35 triggers and contents, CNIL and DPC PIA methods, residual risk, mitigation records, and prior consultation limits.
EU GDPR DSAR Exceptions: refusal, extensions, identity checks
FAQ on when EU GDPR controllers may extend, charge for, narrow, redact, or refuse a data subject access request under Articles 12 and 15.
EU GDPR DSAR Workflow: Intake, Clock, Rights, and Evidence
Run a GDPR DSAR workflow for intake, identity checks, rights scoping, one-month response timing, extensions, refusals, processor handoffs, and evidence records.
EU GDPR FAQ: scope, lawful basis, rights, DPIA, breaches, transfers
Direct EU GDPR FAQ answers on scope, controller and processor roles, lawful basis, data subject rights, DPIAs, breach notification, international transfers, and Article 83 fine tiers.
EU GDPR International Transfers and SCCs: Chapter V evidence guide
GDPR Chapter V guide to adequacy decisions, SCCs, transfer assessments, supplementary measures, Article 49 derogations, and EU-US DPF checks.
EU GDPR Lawful Basis and Consent Guide
Focused GDPR guide to Article 6 lawful bases, consent conditions, legitimate interests, special category data, withdrawal, and evidence records.
EU GDPR Lawful Basis and LIA Workflow for Article 6(1)(f)
Assess GDPR legitimate interests with a purpose, necessity, balancing, Article 21 objection, and evidence-record workflow based on Article 6(1)(f).
EU GDPR Lead Supervisory Authority and One-Stop-Shop
How GDPR main establishment, cross-border processing, Article 56 lead authority competence, and Article 60 cooperation fit together.
EU GDPR LIA Template for Article 6(1)(f)
This EU GDPR legitimate interests assessment template helps document Article 6(1)(f) purpose, necessity, balancing, safeguards, objection rights, and evidence.
EU GDPR penalties and fines: Article 83 tiers and evidence
EU GDPR penalties guide covering Article 83 fine ceilings, the EDPB calculation method, CJEU conditions, Article 58 powers, and evidence.
EU GDPR Processor Contracts and Vendor Management | Article 28 Evidence Guide
EU GDPR Article 28 guide for processor contracts, sub-processor controls, controller-processor role boundaries, vendor evidence, and SCC transfer clauses where applicable.
EU GDPR Record of Processing Activities Template: Article 30 RoPA Fields
Build a GDPR Article 30 record of processing activities with separate controller and processor fields for purposes, data categories, recipients, transfers, erasure time limits, and security measures.
EU GDPR Requirements: scope, rights, security, DPIA, RoPA, and transfers
Overview of core EU GDPR requirements covering scope, principles, lawful basis, notices, data-subject rights, processors, RoPA, security, breaches, DPIAs, and international transfers.
EU GDPR Retention and Erasure Schedule
Build an EU GDPR retention and erasure schedule with purpose-based periods, expiry actions, Article 17 decisions, recipient notices, and deletion evidence.
EU GDPR Transfer TIA and SCC Workflow
A GDPR workflow for checking adequacy, selecting SCC modules, documenting transfer impact assessments, and recording supplementary measures for third-country transfers.
EU GDPR Transparency Notices: Articles 12, 13 and 14
GDPR privacy-notice guide for Articles 12, 13, and 14: direct collection, other data sources, purposes, lawful bases, recipients, transfers, retention, rights, and timing.
EU GDPR vs Brazil LGPD: scope, legal bases, rights, incidents, and transfers
Compare EU GDPR and Brazil LGPD scope, actors, legal bases, rights timing, security incidents, international transfers, evidence, regulators, and penalties.
EU GDPR vs California CCPA: scope, rights, opt-outs, and evidence
Compare EU GDPR and California CCPA scope, roles, consumer rights, response times, sale and sharing opt-outs, risk assessments, contracts, transfers, and enforcement.
EU GDPR vs ePrivacy Directive: personal data, cookies, consent, and communications
Compare the EU GDPR and ePrivacy Directive for personal data processing, consent and lawful basis, cookies and terminal access, electronic communications, and parallel compliance.
EU GDPR vs UK GDPR: Scope, Rights, Transfers, and Evidence
Compare the EU GDPR and amended UK GDPR across scope, rights, automated decisions, accountability, breaches, regulators, and international transfers.
GDPR processor vs controller: role boundaries and evidence
Decide whether a party is a GDPR controller, processor, or joint controller using purpose-and-means tests, Article 28 terms, Article 26 arrangements, and Article 30 records.
GDPR vs EU AI Act: privacy controls for AI systems
Map the GDPR work that remains necessary when an AI system processes personal data, including lawful basis, notices, DPIAs, Article 22, rights, security, records, and transfers.
GDPR vs EU Data Act: personal data, connected products, and access rights
Compare GDPR privacy duties with EU Data Act rights and duties for connected-product data, third-party access, data holders, users, contracts, cloud switching, and enforcement.
When does the EU GDPR require a DPIA?
Answer the EU GDPR DPIA threshold question with Article 35 triggers, high-risk criteria, supervisory-authority list checks, and DPIA content requirements.
When does the GDPR 72-hour breach notification clock start?
GDPR breach-awareness FAQ covering the Article 33 clock, processor escalation, delayed or phased notifications, risk assessment, and records to keep.