Review this workflow before sending personal data from the EEA to a third country or international organisation without relying only on a contract label.
It keeps adequacy checks, SCC module selection, Clause 14 assessment, importer evidence, supplementary measures, and stop-transfer decisions in one auditable transfer record.
Use this workflow for a GDPR Chapter V transfer impact assessment () where personal data is made available to a separate recipient in a third country or international organisation. It helps the team decide whether an adequacy decision covers the transfer, whether standard contractual clauses (SCCs) are available, and whether supplementary measures can make the selected transfer tool effective after Schrems II.
Open one transfer record for each distinct exporter, importer, destination country, transfer tool, data set, and processing purpose. Do not group unrelated vendors or destinations into one generic because the SCC assessment depends on the transfer's specific circumstances.
Before choosing a transfer tool, confirm that Chapter V applies. EDPB Guidelines 05/2021 use three cumulative criteria: an exporter is subject to the GDPR for the processing; the exporter transmits or otherwise makes the personal data available to a different controller, joint controller, or processor; and that importer is in a third country or is an international organisation. The importer's own GDPR status does not remove Chapter V.
First decide whether the destination is covered by a current adequacy decision for the relevant recipient and sector. If it is, record the adequacy route and keep evidence that the recipient actually falls inside the decision. If it is not, move to the Article 46 transfer-tool review. If there is no separate importer, Chapter V may not apply, but the processing still needs the GDPR security, accountability, and risk controls that fit the overseas access.
Sources (4)
Grounds the adequacy gate: an adequacy decision lets personal data flow to the covered third country without further safeguards, while the listed scope must still be checked.
without any further safeguard being necessary
Grounds the EU-US branch of the workflow for companies participating in the EU-US Data Privacy Framework.
companies in the United States that participate
Grounds the Chapter V transfer categories: adequacy decisions, appropriate safeguards, and derogations.
transfers of personal data to third countries
Provides the three cumulative transfer criteria, the separate-importer distinction, and the rule that Chapter V may apply even when the importer is subject to the GDPR.
three cumulative criteria
Where the transfer uses SCCs, the contract package should identify the right module and complete the appendices before the team signs off the transfer assessment. Empty annexes, generic security descriptions, or missing onward-transfer details make the assessment hard to defend.
The 2021 SCCs use a modular structure for different transfer scenarios. The workflow should therefore tie the selected module to the actual exporter/importer roles, then attach the transfer details, technical and organisational measures, sub-processor information where relevant, and competent supervisory authority details. Also confirm that the clauses are available for the transfer: Decision (EU) 2021/914 states that these SCCs may be used only where the importer's processing is not within the territorial scope of the GDPR.
Sources (3)
Grounds the SCC package requirements, modular approach, annexes, transfer details, specific measures, and the rule that the importer's processing must fall outside the GDPR's territorial scope.
a modular approach to cater for various transfer scenarios
Provides the Commission SCC resource page used to locate SCC materials for international data transfers.
Standard Contractual Clauses
Commission guidance used for practical SCC completion, transfer impact assessment timing, and suspension where safeguards cannot be ensured.
prior to concluding the SCCs
Where Clause 14 applies, the must determine whether local laws and practices could prevent the importer from complying with the SCCs for this transfer. Record the basis for any Module 4 return-transfer exception before proceeding without that assessment.
Schrems II and the SCCs require a case-by-case assessment. The record should cover the transfer facts, the destination-country laws and practices relevant to the importer and data, the importer evidence, and any safeguards already in place.
Sources (3)
Grounds the exporter workflow for assessing third-country laws and practices and documenting supplementary-measure decisions.
conduct this assessment with due diligence and document it thoroughly
Grounds Clause 14 factors for assessing local laws and practices and the importer cooperation obligation.
the specific circumstances of the transfer
Grounds the case-by-case obligation to consider both SCC commitments and the destination country's legal system.
standard data protection clauses
Record an explicit transfer decision and the evidence behind it. A transfer can proceed under SCCs only when the team can explain why the SCCs, together with any supplementary measures, ensure the required level of protection for that transfer.
If destination laws or practices prevent the importer from complying and effective supplementary measures cannot close the gap, the record should say that the transfer must not start or must be suspended or ended. Article 49 derogations are exceptions for specific situations, not a routine replacement for adequacy or Article 46 safeguards; document the exact condition and any additional requirements before relying on one.
No. Select the correct module, complete the applicable annexes, and document the Clause 14 assessment where it applies; check the narrow Module 4 return-transfer exception described above. Operate all applicable clauses after signature, including importer notices, public-authority request handling, review of changed laws or practices, and suspension or termination when compliance can no longer be ensured.
No. Importer experience can be relevant only when it is lawfully shareable and assessed with objective, reliable, relevant, verifiable, and accessible information. An absence of prior requests is not decisive by itself, and the file should explain the period covered, the importer's legal limits on disclosure, and the public or otherwise accessible information used to corroborate the conclusion.
Do not start, or suspend or end, the transfer when the selected tool cannot provide effective protection and no supplementary measure closes the identified gap. The same escalation applies when the importer later reports that it cannot comply with the SCCs or when a legal, factual, or control change invalidates the approved assessment.
Sources (3)
Grounds the supplementary-measure decision and the obligation to avoid, suspend, or terminate transfers where no effective measure is available.
must avoid, suspend or terminate the transfer
Grounds SCC consequences when the importer cannot comply, including suspension, termination, return, or deletion.
unable to comply with these Clauses
Grounds the requirement that SCC transfers be suspended or prohibited if the required EU level of protection cannot be ensured.
suspended or prohibited
Worked patterns help reviewers test the logic, but they do not replace the facts of the actual transfer. Use the same sequence in every case: identify the exporter and separate importer, map the data and onward recipients, check adequacy, select the available Article 46 tool, assess laws and practices, test supplementary measures, and record the operating decision.
A vendor's security certification, data-processing agreement, or statement that it has never received a government request may support part of the evidence file. None of those items establishes the Chapter V route or resolves Clause 14 by itself.
Sources (3)
Supports the separate-importer test, including the employee-within-the-same-controller example, and confirms that the importer's own GDPR status does not remove Chapter V.
another controller, joint controller or processor
Provides the transfer-mapping sequence and use cases for encryption, remote access, importer access to plaintext, and supplementary measures.
know your transfers
Supports the four modules, onward-transfer controls, sub-processing duties, inability-to-comply notices, and suspension, termination, return, or deletion steps.
unable to comply with these Clauses
A useful transfer record lets privacy, legal, vendor-management, and security teams reconstruct the decision without searching email threads. Keep the evidence close to the vendor or system record so it is updated when the service, country, subprocessors, or data categories change.
Reopen the workflow when the transfer facts change, the importer reports an inability to comply, there is a new or changed public-authority access risk, supplementary measures stop working, SCC annexes change, or adequacy coverage changes.
Sources (3)
Grounds the evidence expectation that assessments and supplementary measures be documented and made available to authorities on request.
make such documentation available
Grounds evidence fields for SCC annexes, importer documentation, public-authority request records, and specific security measures.
document any request for disclosure
Grounds the adequacy evidence check and review trigger because adequacy decisions can be maintained, amended, or withdrawn.
maintain, amend or withdraw
Sorena can help convert SCC packages, importer evidence, TIA conclusions, and supplementary-measure controls into reusable transfer records for GDPR work.
Ask questions tied to cited sources about adequacy, SCCs, TIA evidence, and supplementary measures using the cited sources on this page.
Review your transfer route, SCC annexes, importer evidence, and supplementary-measure gaps with Sorena.
"the specific circumstances of the transfer"
"a modular approach to cater for various transfer scenarios"
"unable to comply with these Clauses"
"document any request for disclosure"
"conduct this assessment with due diligence"
"conduct this assessment with due diligence and document it thoroughly"
"must avoid, suspend or terminate the transfer"
"know your transfers"
"make such documentation available"
"suspended or prohibited"
"standard data protection clauses"
"three cumulative criteria"
"another controller, joint controller or processor"
"without any further safeguard being necessary"
"maintain, amend or withdraw"
"companies in the United States that participate"
"transfers of personal data to third countries"
"prior to concluding the SCCs"
"Standard Contractual Clauses"
A concrete GDPR scope test for personal data, controller and processor roles, EU establishment, EU targeting or monitoring, special-category and child data, transfers, vendors, and evidence.
This GDPR Article 30 RoPA intake workflow helps capture controller and processor fields, owners, transfers, retention, security measures, and evidence before a processing activity goes live.
GDPR guide to profiling and Article 22 decisions: scope, transparency, lawful basis, DPIA triggers, safeguards, human intervention, challenge rights, and evidence.
EU GDPR breach notification workflow covering awareness, 72-hour supervisory authority notices, processor escalation, high-risk data-subject communication, delay reasons, and evidence logs.
A concrete EU GDPR breach notification workflow for detecting and triaging incidents, starting the awareness clock, assessing risk, notifying authorities or data subjects, and keeping Article 33 records.
This GDPR checklist helps review scope, lawful basis, notices, DSAR handling, DPIAs, RoPA, processor contracts, SCC transfers, breach notification, retention, security, and evidence.
GDPR guide to children's consent and special-category data: Article 8 national age variation, Article 9 conditions, transparency, DPIA triggers, safeguards, and evidence.
Practical EU GDPR compliance guide for mapping scope, lawful basis, notices, data-subject rights, DPIAs, RoPA, processor terms, breaches, transfers, retention, security, and penalties.
Classify GDPR controllers, processors, and joint controllers from actual decision-making, then document Article 26 allocation, Article 28 terms, instructions, and vendor evidence.
GDPR rights-request workflow for intake, identity checks, request scope, the one-month response clock, extensions, refusals, processor coordination, and evidence.
EU GDPR calendar for calculating rights-request deadlines, breach notification, DPIA and prior-consultation gates, transfer reviews, and retention checks.
Screen high-risk processing, run a GDPR Article 35 DPIA, record mitigation, and identify when Article 36 prior consultation is required.
EU GDPR DPIA guide covering Article 35 triggers and contents, CNIL and DPC PIA methods, residual risk, mitigation records, and prior consultation limits.
Run a GDPR DSAR workflow for intake, identity checks, rights scoping, one-month response timing, extensions, refusals, processor handoffs, and evidence records.
Direct EU GDPR FAQ answers on scope, controller and processor roles, lawful basis, data subject rights, DPIAs, breach notification, international transfers, and Article 83 fine tiers.
GDPR Chapter V guide to adequacy decisions, SCCs, transfer assessments, supplementary measures, Article 49 derogations, and EU-US DPF checks.
Focused GDPR guide to Article 6 lawful bases, consent conditions, legitimate interests, special category data, withdrawal, and evidence records.
Assess GDPR legitimate interests with a purpose, necessity, balancing, Article 21 objection, and evidence-record workflow based on Article 6(1)(f).
How GDPR main establishment, cross-border processing, Article 56 lead authority competence, and Article 60 cooperation fit together.
This EU GDPR legitimate interests assessment template helps document Article 6(1)(f) purpose, necessity, balancing, safeguards, objection rights, and evidence.
EU GDPR penalties guide covering Article 83 fine ceilings, the EDPB calculation method, CJEU conditions, Article 58 powers, and evidence.
EU GDPR Article 28 guide for processor contracts, sub-processor controls, controller-processor role boundaries, vendor evidence, and SCC transfer clauses where applicable.
Build a GDPR Article 30 record of processing activities with separate controller and processor fields for purposes, data categories, recipients, transfers, erasure time limits, and security measures.
Overview of core EU GDPR requirements covering scope, principles, lawful basis, notices, data-subject rights, processors, RoPA, security, breaches, DPIAs, and international transfers.
Build an EU GDPR retention and erasure schedule with purpose-based periods, expiry actions, Article 17 decisions, recipient notices, and deletion evidence.
GDPR privacy-notice guide for Articles 12, 13, and 14: direct collection, other data sources, purposes, lawful bases, recipients, transfers, retention, rights, and timing.
Compare EU GDPR and Brazil LGPD scope, actors, legal bases, rights timing, security incidents, international transfers, evidence, regulators, and penalties.
Compare EU GDPR and California CCPA scope, roles, consumer rights, response times, sale and sharing opt-outs, risk assessments, contracts, transfers, and enforcement.
Compare the EU GDPR and ePrivacy Directive for personal data processing, consent and lawful basis, cookies and terminal access, electronic communications, and parallel compliance.
Compare the EU GDPR and amended UK GDPR across scope, rights, automated decisions, accountability, breaches, regulators, and international transfers.
Map the GDPR work that remains necessary when an AI system processes personal data, including lawful basis, notices, DPIAs, Article 22, rights, security, records, and transfers.
Compare GDPR privacy duties with EU Data Act rights and duties for connected-product data, third-party access, data holders, users, contracts, cloud switching, and enforcement.
A GDPR Article 3 territorial-scope FAQ covering EU establishment, non-EU targeting, monitoring in the EU, public-international-law cases, and Article 27 representatives.
FAQ on the six Article 6 GDPR lawful bases, consent caveats, legitimate interests, public-task and legal-obligation limits, and Article 9 special-category data.
FAQ on when EU GDPR controllers may extend, charge for, narrow, redact, or refuse a data subject access request under Articles 12 and 15.
FAQ on when SCC transfer impact assessments are needed, what Clause 14 records, and when supplementary safeguards or transfer suspension are required.
Decide whether a party is a GDPR controller, processor, or joint controller using purpose-and-means tests, Article 28 terms, Article 26 arrangements, and Article 30 records.
Answer the EU GDPR DPIA threshold question with Article 35 triggers, high-risk criteria, supervisory-authority list checks, and DPIA content requirements.
GDPR breach-awareness FAQ covering the Article 33 clock, processor escalation, delayed or phased notifications, risk assessment, and records to keep.