Point of law

The transfer impact assessment

The regulation does not know the term transfer impact assessment. The duty follows from Art. 46(1) GDPR as interpreted by the Court of Justice and has been written out since 2021 in clause 14 of the standard contractual clauses. Those who do not know this do not carry it out, and those who do often fail to find the transfer.

One line in the record, four countries behind it

The record shows one line with a provider in Ireland. The data centre is in Frankfurt. Support works out of Manila, monitoring runs through a provider in the United States, and payment reconciliation goes to a provider in India. All three appear in the contract, in an annex on page nine.

The duty sits in the contractual clause, not in the regulation

Where the duty comes from although no provision carries that name is the question at which the assessment usually ends before it begins. The regulation does not use the term. The duty arises from three sources working together.

Three sources, one duty

Art. 46(1) GDPR
A transfer is permitted only where appropriate safeguards are in place and enforceable rights and effective remedies are available to data subjects. Whether that is the case, the provision does not say.
Court of Justice, 16 July 2020
The Court based the contractual mechanism on the responsibility of the controller. It falls to the controller to verify, case by case and where appropriate together with the recipient.
Clause 14 of the standard contractual clauses
The 2021 implementing decision turns this into a contractual obligation with six points, from the warranty through the assessment to suspension. Whoever signs the clauses has undertaken to carry out the assessment.

3 von 3

That also settles the sequence. The assessment belongs to the choice of safeguard under Art. 46 GDPR and not to a later review. Where an adequacy decision under Art. 45 GDPR exists, it falls away for as long as that decision stands.

The third-country element rarely sits where the contracting party does

Where the third-country element actually lies is the real difficulty. Art. 44 GDPR covers every transfer, and Art. 28(4) GDPR extends the obligations to every further processor. The seat of the contracting party says nothing about it.

Four places where it is regularly missed

Support and remote maintenance

Access from a third country to fix a fault is a transfer, even where no file is copied. Access to the data suffices, and remote maintenance windows are rarely limited to one data set.

Monitoring and logging

Log data regularly contains identifiers, addresses and timestamps and is therefore personal. A monitoring service in a third country processes it, even where it never sees the business data.

Backups and failover data centres

The backup often sits in a different region from the live system, and recovery follows different rules from normal operation. Both belong in the assessment.

Intra-group passing on by the provider

The provider passes data to its own parent company, for instance for billing or abuse detection. That is onward transfer within the meaning of clause 14(b)(i) and is often not recognisable as such in the list of sub-processors.

The information for this sits in the record of processing activities, where Art. 30(1)(e) GDPR calls for the third country and the safeguard. Where nothing appears there, the transfer is not absent but unnoticed.

What is assessed is this transfer and not the legal system

How far the assessment of foreign law has to reach is overestimated, and that is where it fails a second time. Clause 14(b) ties the assessment to the specific circumstances of the transfer and to the laws relevant in that light.

What is assessed and what is not

Subject of the assessment	Merkmal	Not the subject
This transferChain, actors involved, transmission channels, type of recipient, categories and format of data.	Scope	The legal system at largeA general assessment of the country is neither required nor feasible.
Those that are relevantIn particular public authority access powers, with their limitations and safeguards.	Laws	Every conceivable ruleThe yardstick is the circumstances of this transfer.
Expressly includedClause 14 names laws and practices side by side.	Practices	Not the wording aloneA rule applied differently in practice has to be assessed as applied.
Contractually owedClause 14(c) obliges it to use best efforts.	Input from the recipient	No substitute for the assessmentThe assessment remains the exporter's own.

The assessment is cut to the specific transfer, and that is what makes it feasible. Anyone expecting a country study never starts. Anyone working through the four features reaches a defensible result.

Without sufficient supplementary measures the transfer has to be suspended

What follows where the assessment shows no adequate level of protection was stated plainly by the Court of Justice. Where the controller cannot take sufficient supplementary measures, it is obliged to suspend the transfer. Clause 14(f) repeats this as a contractual duty and gives the exporter a right to terminate.

How we support you with the Transfer Impact Assessment

The starting point is not the assessment but the list. The record of processing activities and the lists of sub-processors show which transfers take place at all. Only then can it be decided which of them need an assessment under clause 14, and transfers under an adequacy decision drop out at that point.

Frequently asked questions

Where is the duty to carry out a transfer impact assessment written down?

Under that name, nowhere. It follows from Art. 46(1) GDPR, which the Court of Justice interpreted on 16 July 2020 as requiring the controller to verify, on a case-by-case basis, whether the law of the destination country ensures adequate protection. Clause 14 of the 2021 standard contractual clauses has since set the assessment out expressly.

Does the duty apply where an adequacy decision exists?

No. Art. 45 GDPR carries the transfer without further assessment for as long as the decision stands. What remains to be checked is whether the recipient and the purpose are covered by it, and a decision can be repealed or declared invalid.

Does the assessment have to be documented?

Yes. Clause 14(d) of the standard contractual clauses obliges the parties to document the assessment and to make it available to the competent supervisory authority on request.

What if the provider gives no information?

Clause 14(c) obliges the data importer to use its best efforts to supply relevant information. Where none is forthcoming, the assessment lacks its basis, and that is itself a result. It leads to the question of supplementary measures and, where none suffice, to suspension.

Get in touch!

Have we sparked your interest? Do you have questions? Would you like a quote without obligation? We look forward to hearing from you!

Alternatively you can request a call back.