Transfer Impact Assessment (TIA)

What is a transfer impact assessment (TIA)?

A transfer impact assessment (TIA) is a written check you make before sending personal data out of the EU under a transfer tool such as standard contractual clauses (SCCs) or binding corporate rules (BCRs). It checks whether the laws and practices of the destination country let the recipient keep the promises in that tool, above all where public authorities can demand access to the data.

The GDPR does not use the name. The duty comes from the 2020 Schrems II ruling, which said companies relying on SCCs must check the destination case by case. The European Data Protection Board (EDPB) set out how in its Recommendations 01/2020, final since June 18, 2021. They describe six steps:

1. Know your transfers, including onward transfers to subprocessors and remote access from abroad, such as support staff.
2. Identify the transfer tool each transfer relies on.
3. Assess whether that tool works in practice, given the destination's laws and practices.
4. Adopt supplementary measures if it does not.
5. Take any procedural steps those measures require.
6. Re-evaluate at appropriate intervals.

You must document the assessment and make it available to the data protection authority on request. A transfer covered by an adequacy decision needs no TIA. That includes transfers to US companies certified under the EU-US Data Privacy Framework.

The UK version

In the UK it is called a transfer risk assessment (TRA), and the Data (Use and Access) Act 2025, in force for transfers since February 5, 2026, now calls it the "data protection test." The ICO says you must complete one before relying on a safeguard such as the UK Addendum. The test is whether protection after the transfer is "not materially lower" than in the UK.

What it looks like in a vendor's terms

The 2021 SCCs build the assessment into Clause 14, and a DPA may repeat its warranty in its own words. A typical clause reads like this:

As of the Effective Date, Provider has no reason to believe that the laws and practices of any country where it processes Customer Personal Data prevent it from meeting its obligations under this DPA. Provider will promptly notify Customer if it becomes subject to such laws, including through a request for disclosure from a public authority.

• "No reason to believe": the vendor's warranty, which mirrors Clause 14(a). It is a statement, not the assessment itself.
• "Promptly notify": your cue to act. Under Clause 14(f), the exporter must suspend the transfer if it cannot ensure appropriate safeguards.

The Salesforce Data Processing Addendum has an "Impact of Local Laws" section in this form. If Salesforce cannot offer a workable change, you may terminate the affected services and get a refund of prepaid fees for the period after termination.

Why it matters to you

When you send personal data to a vendor outside the EU, you are usually the data exporter, so the TIA is your document. The EDPB says a regulator may ask for it and hold you accountable for any decision you base on it.

If a cloud provider needs your data in the clear to do its job, and the destination's laws let authorities go beyond what is necessary and proportionate, the EDPB says it cannot envision an effective technical measure. Transport and storage encryption do not count as a supplementary measure if the vendor holds the keys.

A TIA also goes stale. A new subprocessor in another country, a new data center or a new law can change the answer, which is why step 6 exists.

What to check

• The vendor's input: ask for its TIA material or a summary of the laws it is subject to. Under Clause 14(c), the importer warrants it has made its best efforts to give you relevant information.
• Where data goes: the countries on the subprocessor list, plus any support access from abroad.
• The tool per recipient: SCCs, BCRs or the Data Privacy Framework. A certified US recipient needs no TIA; a US recipient on SCCs does.
• Government requests: the vendor's transparency report. The EDPB says a lack of past requests is never decisive on its own.
• Supplementary measures: who holds the encryption keys, and whether data can be pseudonymized before it leaves.
• Review date: when you will look again, and what triggers an earlier review.

How Venpo helps

Step 6 asks you to watch for changes, and some of them show up in a vendor's own documents: a new subprocessor in another country, a changed transfer clause in the DPA. Venpo watches your vendors' DPAs, subprocessor lists and other public legal pages and emails you a plain-English alert when they change. The Fine Print Scan also answers, per vendor, whether your data goes to China or other restricted countries.