WorkflowEU GDPR

GDPR transfer TIA and SCC workflow

Use this workflow before sending personal data from the EEA to a third country or international organisation without relying only on a contract label.

It keeps adequacy checks, SCC module selection, Clause 14 assessment, importer evidence, supplementary measures, and stop-transfer decisions in one auditable transfer record.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

May 9, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated May 9, 2026

Overview

This workflow is for GDPR Chapter V transfer reviews where personal data leaves the EEA and the team needs to decide whether an adequacy decision is enough, whether standard contractual clauses are needed, and whether the transfer also needs supplementary measures after Schrems II.

Section 1

Start with the transfer route

Open one transfer record for each distinct exporter, importer, destination country, transfer tool, data set, and processing purpose. Do not group unrelated vendors or destinations into one generic TIA because the SCC assessment depends on the transfer's specific circumstances.

First decide whether the destination is covered by a current adequacy decision for the relevant recipient and sector. If it is, record the adequacy route and keep evidence that the recipient actually falls inside the decision. If it is not, move to the Article 46 transfer-tool review.

Record the exporter, importer, onward recipients, destination country, storage location, transmission channel, and whether the recipient is a controller, processor, or sub-processor.
Identify the personal data categories, data-subject groups, special-category or criminal-offence data, transfer frequency, retention period, and business purpose.
Check whether an adequacy decision applies to the destination and recipient type; for the United States, record whether the organisation participates in the EU-US Data Privacy Framework if that is the claimed route.
If adequacy does not cover the transfer, identify the Article 46 tool, usually the 2021 SCCs, and preserve the reason Article 49 derogations were not used as the operating basis.

Sources for this answer

European Commission - Adequacy decisions

Grounds the adequacy gate: an adequacy decision lets personal data flow to the covered third country without further safeguards, while the listed scope must still be checked.

European Commission - EU-US data transfers

Grounds the EU-US branch of the workflow for companies participating in the EU-US Data Privacy Framework.

Regulation (EU) 2016/679 (GDPR)

Grounds the Chapter V transfer categories: adequacy decisions, appropriate safeguards, and derogations.

Section 2

Build the SCC package before the TIA conclusion

Where the transfer uses SCCs, the contract package should identify the right module and complete the appendices before the team signs off the transfer assessment. Empty annexes, generic security descriptions, or missing onward-transfer details make the assessment hard to defend.

The 2021 SCCs use a modular structure for different transfer scenarios. The workflow should therefore tie the selected module to the actual exporter/importer roles, then attach the transfer details, technical and organisational measures, sub-processor information where relevant, and competent supervisory authority details.

Select the SCC module that matches the transfer: controller-to-controller, controller-to-processor, processor-to-processor, or processor-to-controller.
Complete Annex I with parties, transfer description, categories of personal data, data subjects, purposes, retention, recipients, and competent supervisory authority.
Complete Annex II with specific technical and organisational measures for this transfer, not a generic security-policy reference.
Complete Annex III where sub-processors are part of the chosen module and authorisation model.
Record who can approve SCC signature, who can update annexes, and who receives importer notices about inability to comply or public-authority access requests.

Sources for this answer

Commission Implementing Decision (EU) 2021/914 - Standard Contractual Clauses

Grounds the SCC package requirements, including the modular approach, annexes, transfer details, and specific technical and organisational measures.

European Commission - Standard Contractual Clauses

Provides the Commission SCC resource page used to locate SCC materials for international data transfers.

Section 3

Run the transfer impact assessment

The TIA should answer one narrow question: in the circumstances of this transfer, can the chosen Article 46 tool work effectively in the destination country, or do local laws and practices undermine the protection promised by the SCCs?

Schrems II and the SCCs require a case-by-case assessment. The record should cover the transfer facts, the destination-country laws and practices relevant to the importer and data, the importer evidence, and any safeguards already in place.

Use the EDPB sequence: know the transfers, verify the transfer tool, assess destination laws and practices, identify supplementary measures if needed, take required procedural steps, and re-evaluate at appropriate intervals.
For Clause 14, record the transfer circumstances, processing-chain length, transmission channels, recipient type, purpose, data categories and format, sector, storage location, relevant destination-country laws and practices, and existing safeguards.
Ask the importer for objective, reliable, relevant, verifiable, and lawfully shareable information about public-authority access risks, prior requests where usable, challenge procedures, transparency limits, and technical controls.
Do not treat absence of past access requests as decisive by itself; corroborate it with public or otherwise accessible information where the assessment relies on importer experience.
Have legal or privacy leadership approve the assessment report, including the sources checked, people involved, dates of checks, conclusion, and residual risk.

Sources for this answer

EDPB Recommendations 01/2020 on supplementary measures

Grounds the exporter workflow for assessing third-country laws and practices and documenting supplementary-measure decisions.

Commission Implementing Decision (EU) 2021/914 - Standard Contractual Clauses

Grounds Clause 14 factors for assessing local laws and practices and the importer cooperation obligation.

CJEU Schrems II judgment, Case C-311/18

Grounds the case-by-case obligation to consider both SCC commitments and the destination country's legal system.

Section 4

Decide, supplement, suspend, or stop

The workflow should end in an explicit transfer decision, not a vague risk note. A transfer can proceed under SCCs only when the team can explain why the SCCs, together with any supplementary measures, ensure the required level of protection for that transfer.

If destination laws or practices prevent the importer from complying and effective supplementary measures cannot close the gap, the record should say that the transfer must not start or must be suspended or ended.

Proceed under adequacy only when the adequacy decision covers the destination, recipient, sector, and transfer facts recorded for the workflow.
Proceed under SCCs without extra measures only when the TIA documents why the destination laws and practices do not undermine the SCCs for this transfer.
Proceed under SCCs with supplementary measures only when the measures are specific, effective for the identified risk, and do not contradict the SCCs.
Use technical, contractual, and organisational measures as needed, but record why each measure works for the actual data, importer, destination law, and processing purpose.
Suspend, end, or do not start the transfer when no effective supplementary measure can ensure the required level of protection, or when the importer can no longer comply with the SCCs.

Sources for this answer

EDPB Recommendations 01/2020 on supplementary measures

Grounds the supplementary-measure decision and the obligation to avoid, suspend, or terminate transfers where no effective measure is available.

Commission Implementing Decision (EU) 2021/914 - Standard Contractual Clauses

Grounds SCC consequences when the importer cannot comply, including suspension, termination, return, or deletion.

CJEU Schrems II judgment, Case C-311/18

Grounds the requirement that SCC transfers be suspended or prohibited if the required EU level of protection cannot be ensured.

Section 5

Evidence to keep with each transfer record

A useful transfer record lets privacy, legal, vendor-management, and security teams reconstruct the decision without searching email threads. Keep the evidence close to the vendor or system record so it is updated when the service, country, subprocessors, or data categories change.

Reopen the workflow when the transfer facts change, the importer reports an inability to comply, there is a new or changed public-authority access risk, supplementary measures stop working, SCC annexes change, or adequacy coverage changes.

Transfer map: exporter, importer, onward recipients, countries, systems, purposes, data categories, data-subject categories, frequency, retention, and storage locations.
Adequacy evidence: decision relied on, scope match, recipient participation evidence where relevant, and date the scope was checked.
SCC evidence: signed module, completed Annex I, Annex II, Annex III where relevant, competent supervisory authority entry, and owner for annex updates.
TIA evidence: laws and practices assessed, importer materials, public or accessible corroborating sources, practical-experience analysis if used, approver, dates, conclusion, and next review trigger.
Supplementary-measure evidence: measure owner, implementation proof, control test, importer commitment, residual risk, and stop-transfer condition.
Operational evidence: process for public-authority request notices, challenge steps, inability-to-comply notices, suspension decisions, termination, return, and deletion.

Sources for this answer

EDPB Recommendations 01/2020 on supplementary measures

Grounds the evidence expectation that assessments and supplementary measures be documented and made available to authorities on request.

Commission Implementing Decision (EU) 2021/914 - Standard Contractual Clauses

Grounds evidence fields for SCC annexes, importer documentation, public-authority request records, and specific security measures.

European Commission - Adequacy decisions

Grounds the adequacy evidence check and review trigger because adequacy decisions can be maintained, amended, or withdrawn.

Recommended next step

Use this workflow to structure GDPR transfer records

Sorena can help convert SCC packages, importer evidence, TIA conclusions, and supplementary-measure controls into reusable transfer records for GDPR work.

Research workflow

Open Research Copilot for EU GDPR

Ask source-linked questions about adequacy, SCCs, TIA evidence, and supplementary measures using the cited sources on this page.

Explore next step

Talk to Sorena

Talk through GDPR transfer implementation

Review your transfer route, SCC annexes, importer evidence, and supplementary-measure gaps with Sorena.

Explore next step

Primary sources