Review this workflow before sending personal data from the EEA to a third country or international organisation without relying only on a contract label.
It keeps adequacy checks, SCC module selection, Clause 14 assessment, importer evidence, supplementary measures, and stop-transfer decisions in one auditable transfer record.
Structured answer sets in this page tree.
Cited legal and guidance references.
Use this workflow for a GDPR Chapter V transfer impact assessment () where personal data is made available to a separate recipient in a third country or international organisation. It helps the team decide whether an adequacy decision covers the transfer, whether standard contractual clauses (SCCs) are available, and whether supplementary measures can make the selected transfer tool effective after Schrems II.
Open one transfer record for each distinct exporter, importer, destination country, transfer tool, data set, and processing purpose. Do not group unrelated vendors or destinations into one generic because the SCC assessment depends on the transfer's specific circumstances.
Before choosing a transfer tool, confirm that Chapter V applies. EDPB Guidelines 05/2021 use three cumulative criteria: an exporter is subject to the GDPR for the processing; the exporter transmits or otherwise makes the personal data available to a different controller, joint controller, or processor; and that importer is in a third country or is an international organisation. The importer's own GDPR status does not remove Chapter V.
First decide whether the destination is covered by a current adequacy decision for the relevant recipient and sector. If it is, record the adequacy route and keep evidence that the recipient actually falls inside the decision. If it is not, move to the Article 46 transfer-tool review. If there is no separate importer, Chapter V may not apply, but the processing still needs the GDPR security, accountability, and risk controls that fit the overseas access.
Where the transfer uses SCCs, the contract package should identify the right module and complete the appendices before the team signs off the transfer assessment. Empty annexes, generic security descriptions, or missing onward-transfer details make the assessment hard to defend.
The 2021 SCCs use a modular structure for different transfer scenarios. The workflow should therefore tie the selected module to the actual exporter/importer roles, then attach the transfer details, technical and organisational measures, sub-processor information where relevant, and competent supervisory authority details. Also confirm that the clauses are available for the transfer: Decision (EU) 2021/914 states that these SCCs may be used only where the importer's processing is not within the territorial scope of the GDPR.
The must determine whether the chosen Article 46 tool can work effectively for this transfer in the destination country or whether local laws and practices undermine the protection promised by the SCCs.
Schrems II and the SCCs require a case-by-case assessment. The record should cover the transfer facts, the destination-country laws and practices relevant to the importer and data, the importer evidence, and any safeguards already in place.
Record an explicit transfer decision and the evidence behind it. A transfer can proceed under SCCs only when the team can explain why the SCCs, together with any supplementary measures, ensure the required level of protection for that transfer.
If destination laws or practices prevent the importer from complying and effective supplementary measures cannot close the gap, the record should say that the transfer must not start or must be suspended or ended. Article 49 derogations are exceptions for specific situations, not a routine replacement for adequacy or Article 46 safeguards; document the exact condition and any additional requirements before relying on one.
No. The parties must select the correct module, complete the applicable annexes, and document the Clause 14 assessment before concluding the SCCs. They must also operate the clauses after signature, including importer notices, public-authority request handling, review of changed laws or practices, and suspension or termination when compliance can no longer be ensured.
No. Importer experience can be relevant only when it is lawfully shareable and assessed with objective, reliable, relevant, verifiable, and accessible information. An absence of prior requests is not decisive by itself, and the file should explain the period covered, the importer's legal limits on disclosure, and the public or otherwise accessible information used to corroborate the conclusion.
Do not start, or suspend or end, the transfer when the selected tool cannot provide effective protection and no supplementary measure closes the identified gap. The same escalation applies when the importer later reports that it cannot comply with the SCCs or when a legal, factual, or control change invalidates the approved assessment.
Worked patterns help reviewers test the logic, but they do not replace the facts of the actual transfer. Use the same sequence in every case: identify the exporter and separate importer, map the data and onward recipients, check adequacy, select the available Article 46 tool, assess laws and practices, test supplementary measures, and record the operating decision.
A vendor's security certification, data-processing agreement, or statement that it has never received a government request may support part of the evidence file. None of those items establishes the Chapter V route or resolves Clause 14 by itself.
A useful transfer record lets privacy, legal, vendor-management, and security teams reconstruct the decision without searching email threads. Keep the evidence close to the vendor or system record so it is updated when the service, country, subprocessors, or data categories change.
Reopen the workflow when the transfer facts change, the importer reports an inability to comply, there is a new or changed public-authority access risk, supplementary measures stop working, SCC annexes change, or adequacy coverage changes.
Sorena AI assembled this workflow from the GDPR, Commission Implementing Decision (EU) 2021/914, the Commission adequacy and SCC materials, EDPB Guidelines 05/2021, EDPB Recommendations 01/2020, and the Schrems II judgment. The transfer test, module fields, assessment factors, evidence list, and stop-transfer outcomes were mapped to those sources.
AI assisted with source comparison, drafting, and organisation. No named human privacy or legal reviewer is claimed. Before approving a transfer, confirm the current adequacy scope, the parties' actual roles, the importer's territorial-scope position, the destination laws and practices, the completed SCC text and annexes, and any national rules or professional advice required for the case.
Source review current as of 25 July 2026. This revision added a featured definition, inline explanations of the other transfer terms, the Chapter V transfer test, worked transfer patterns, direct answers for common approval questions, and an explicit review-method qualification. The page date reflects those substantive changes.
Sorena can help convert SCC packages, importer evidence, TIA conclusions, and supplementary-measure controls into reusable transfer records for GDPR work.
Ask questions tied to cited sources about adequacy, SCCs, TIA evidence, and supplementary measures using the cited sources on this page.
Review your transfer route, SCC annexes, importer evidence, and supplementary-measure gaps with Sorena.
"suspended or prohibited"
"the specific circumstances of the transfer"
"another controller, joint controller or processor"
"conduct this assessment with due diligence"
"maintain, amend or withdraw"
"companies in the United States that participate"
"prior to concluding the SCCs"
"Standard Contractual Clauses"
"the conditions laid down in this Chapter"