Transfer impact assessment under GDPR: steps and cost

What a transfer impact assessment under GDPR requires

A team that has a US or other third-country processor and needs to sign or renew that contract should treat the transfer impact assessment as its own documented analysis, not as something an outside body issues. Under the six steps in the EDPB Recommendations 01/2020 (version 2.0, adopted 18 June 2021), the exporter maps the transfer, verifies the transfer tool, assesses third-country law and practice, decides on supplementary measures, takes any formal procedural steps and schedules re-evaluation. Clause 14 of the 2021 standard contractual clauses adds a warranty that the parties have no reason to believe the destination's laws or practices stop the importer from meeting its obligations. No independent auditor, certification body or supervisory authority signs off that analysis, so the record of reasoning is the evidence that matters.

The outcome depends on three inputs that change from one contract to the next: the destination's law and practice, the categories of personal data moved, and who can read that data in the clear. A provider that stores encrypted data with keys held by the exporter faces a different question from a support engineer who must see plaintext records to troubleshoot a fault. Public authority access powers in the destination country are the central variable, so the assessment should name the specific laws and practices reviewed and the sources used, and it should record the date of that review.

Before signing, the team should confirm three things in writing with the provider: which entities can access data in the clear, which sub-processors sit in the chain, and how the provider handles government disclosure requests under Clause 15. Where the analysis concludes that supplementary measures are needed, the decision and its reasoning belong in the same document. Legal counsel should review the conclusion, and the team should set a date for re-evaluation so the file does not go stale.

How the six EDPB steps work in practice

The six steps turn a transfer into a documented decision: you map where personal data goes, confirm the legal tool, test whether the destination's law undermines that tool, add technical or contractual measures where needed, complete any formal steps, and keep the result current. Each step leaves a file the compliance lead can show a supervisory authority.

Map every transfer and onward transfer
Start by listing each flow where personal data leaves the EEA or where a party outside it can reach data, including remote administration, support access and sub-processors. Record the exporter, importer, destination country, data categories, purpose and the systems involved. Confirm the mapping with engineering and operations, because access from a third country counts even when no copy is moved. The output is a transfer register, reviewed against your records of processing, that shows every third-country flow in scope.
Verify the transfer tool for each flow
For each mapped flow, identify the legal basis for the transfer under Chapter V. This may be an adequacy decision, such as the EU-US Data Privacy Framework where the importer is certified, or the 2021 standard contractual clauses with the correct module and annexes completed. Check that the clauses are signed, that annexes describe the actual processing, and that the importer's DPF status is current if relied on. Article 49 derogations cannot become the routine basis for regular transfers. The output is a signed tool reference per flow, with the module or decision cited.
Assess third-country law and practice
Examine the destination's laws on public authority access to data and how they are applied in practice, for the specific data and importer involved. Consider the surveillance powers, the oversight available, redress routes and the importer's history of government requests, drawing on public sources and the importer's own disclosures. Clause 14 of the 2021 clauses requires the parties to warrant that they have no reason to believe local law prevents compliance, so this assessment is part of the contract, not an optional note. The output is a written assessment per destination and importer, signed off by the accountable owner and dated.
Adopt supplementary measures where the assessment requires them
Supplementary measures are needed only where the assessment shows that third-country law or practice impinges on the effectiveness of the transfer tool. Options include strong encryption before transmission where keys stay with the exporter or a trusted party in the EEA, pseudonymization, and contractual or organizational commitments such as Clause 15 review and challenge duties. Where the importer needs data in the clear and public authority powers go beyond what is necessary and proportionate, the EDPB states that it cannot envision an effective technical measure, so the transfer may need to be avoided. The output is a measures record linking each risk to the control that addresses it, with evidence that the control is operating.
Complete formal procedural steps
Take any formal step the adopted measures require before the transfer proceeds. This can include executing the final contract text, updating processing records and privacy notices, and where the supplementary measures change the conclusion, informing the relevant parties in writing. Confirm with your supervisory authority's guidance or your legal counsel whether any further procedure applies in your Member State. The output is a completed approval record, with the transfer switched on only after sign-off and not before.
Re-evaluate at appropriate intervals
Repeat the assessment when the destination's law changes, when the importer reports a government request, when the data or purpose changes, or when a court decision affects the adequacy basis. The EDPB frames re-evaluation as continuous at appropriate intervals, so set a review cadence in your governance calendar and document the trigger for each review. Ask the importer to notify you of relevant changes and to cooperate with requests for information. The output is a dated review log per transfer, showing what changed, what was decided and who approved it.

Assessing third-country law and practice for each transfer

Clause 14 of the 2021 clauses requires the exporter and the importer to warrant that they have no reason to believe the laws and practices of the destination country prevent the importer from meeting its obligations. That warranty only means something if the assessment behind it is written down for each transfer, not assumed from the importer's marketing or from a general view of the country. For every transfer, the review should identify the specific laws that could reach the data, such as surveillance and public authority access powers, and record how the importer has concluded that those laws do not stop it from complying with the clauses. Sources a documented review commonly uses include the relevant statute and case law, the importer's own transparency reporting, published guidance from national or EU bodies, and independent country analyses. Counsel should confirm the current text of each law at the time of the assessment, because a review that cites an outdated statute is weak evidence.

Public authority access powers are only part of the picture. The assessment must also cover actual practice: how often the importer has received government requests for data of this kind, what it disclosed, whether it has ever been ordered to conceal a request, and whether the authorities in practice exercise their powers against this type of data or this type of provider. A law that looks narrow on paper can still produce broad disclosure in practice, and a broad law may rarely be used. Both facts belong in the record. Under Clause 15, the importer agrees to review the legality of any public authority disclosure request and to challenge it where there are reasonable grounds to consider it unlawful, and to disclose the minimum amount permitted. Ask the importer for its written request-handling procedure, its history of challenges, and its commitment to notify you of requests where the law allows. A weak answer here weakens the whole transfer assessment, and it should shape whether supplementary measures are needed.

When supplementary measures are needed

Supplementary measures are not automatic. They become necessary only when the assessment shows that third-country law or practice undermines the Article 46 tool you rely on. The five checks below follow the order in which the assessment usually reaches them, and each one narrows what remains open.

Does third-country law impinge on the tool?

This is the gate. If the assessment of the destination's laws and practices shows no impingement on the effectiveness of your standard contractual clauses, no supplementary measure is required for that transfer, though the assessment must still be documented. If it does show impingement, you move on to the next checks. Record the reasoning, the sources you relied on and the date, because Clause 14 of the 2021 clauses requires the parties to hold this view on each transfer.

Does the importer need data in the clear?

Ask whether the importer, such as a cloud provider or support engineer, must read the personal data to perform the service. If the data is only stored and no one outside the EEA needs plaintext access, strong encryption applied before transmission can be effective, provided the keys are held solely by the exporter or a trusted entity in the EEA or an equivalent jurisdiction. If plaintext access is required, the encryption route largely closes and the remaining checks decide the outcome.

Who holds the encryption keys?

Map every key used to encrypt the data, including key-encryption keys, backups and any keys the provider can generate or recover. Keys held only by the exporter or an EEA trusted entity support the storage use case. Keys that the importer can access, or that the provider can reconstruct on request, mean the encryption does not protect against a foreign authority compelled to obtain them. Confirm key custody in the contract and in the provider's technical documentation.

Do public authority powers exceed necessity?

Where the importer must access data in the clear, the question becomes whether the destination's public authorities can demand access beyond what is necessary and proportionate. The EDPB has said that in this situation it cannot envision an effective technical measure. Under Clause 15, the importer must review the legality of disclosure requests and challenge those it considers unlawful. Document the authority powers, the importer's challenge process and whether that process has been tested in practice.

Is an Article 49 derogation carrying the transfer?

Derogations under Article 49 cannot become the rule in practice and must be limited to specific situations. If your transfers depend on a derogation such as explicit consent or contract necessity for routine, repeated processing, the assessment has failed at the foundation. Move the flow back to an Article 46 tool, such as the SCCs with a completed assessment, or restructure the processing so the derogation no longer carries it. Flag any derogation-based flow as a remediation item.

Encryption use cases: where encryption counts and where it does not

Use Case 1 in the EDPB Recommendations 01/2020 covers data that is sent to a third country only for storage, where the importer never needs to access the data in the clear. The EDPB treats strong encryption applied before transmission as an effective supplementary measure in this situation, provided the encryption is correctly implemented and the keys are reliably managed. The keys must be retained solely by the exporter or by a trusted entity established in the EEA or in a jurisdiction that offers an equivalent level of protection. The measure works because a public authority in the destination country cannot obtain intelligible data without the keys, so the disclosure risk that drives the assessment is neutralized at the technical level.

No clear-text access by the importer: The storage service must hold ciphertext only. Backup jobs, replication and administrative tools must not decrypt on the provider side.
Encryption before transmission: Data should be encrypted on the exporter's systems or in a client-side pipeline before it leaves the EEA, so that the provider never receives a usable copy.
Key custody held by the exporter: Keys stored in a key management service operated by the exporter, or in an HSM the exporter controls, fit the use case. Keys held by the same provider that stores the data do not.
Strong, current algorithms and key lifecycle: Documented key generation, rotation, access logging and destruction procedures are needed to show the encryption is correctly implemented.
Scope limits: The measure covers stored data only. Any support session, troubleshooting or migration that exposes plaintext moves the flow into a different use case.

Confirm with your architects and key custody owners whether every key path, including recovery and disaster recovery keys, stays outside the importer's control before relying on this tab's conclusion.

What a transfer impact assessment costs and who is paid

This table compares each cost component of a transfer impact assessment by who is paid, whether the cost is one-time or recurring, and what pushes it up or down. Read it before requesting quotes so that each proposal can be compared on the same components. No fees or durations are shown because none are supplied as researched facts; ask each provider to price these components separately.

Cost component	Who is paid or who carries it	One-time or recurring	What drives it up or down
Transfer mapping and internal staff time	Your own legal, privacy and business staff, unless an outside party is engaged	One-time, then recurring with each new transfer or vendor	Number of transfers, sub-processors and how current the records of processing are
Third-country law and practice review	External counsel or a specialist provider, for the destination country's public authority powers	One-time per destination, refreshed on re-evaluation	Number of destination countries, how many access powers must be analyzed, and whether the provider already publishes analysis you can reuse
Technical supplementary measures	Implementation partner or your engineering team, for key management, encryption design and architecture changes	One-time build, with ongoing key operations	Whether data must be accessed in the clear by the importer, and whether keys can stay with the exporter or a trusted EEA entity
Contract and transfer tool work	Your legal team or external counsel, for the 2021 clauses, Clause 14 and Clause 15 commitments	One-time per contract, updated when the importer or law changes	Number of contracts, negotiation with the importer, and whether the importer accepts audit and challenge obligations
Tooling and evidence storage	Your organization or a vendor, for logging, key management systems and assessment records	Recurring licences or hosting, plus setup	Existing tooling, self-hosting versus vendor services, and retention requirements
Re-evaluation	Internal staff, with external counsel or a partner if laws or the provider change	Recurring at appropriate intervals and on trigger events	Frequency of legal changes in the destination, volume of transfers, and how well the original assessment was documented
Supervisory authority procedure	Your organization, and external counsel if an authority inquiry or complaint arises	Occasional, only if an inquiry, complaint or investigation occurs	Complexity of the transfer, quality of records, and whether the assessment can be shown promptly

What makes a transfer assessment longer or costlier

A transfer impact assessment grows with the number of flows, the number of parties touching the data, and how much of it must be readable at the destination. The six cards below cover the variables that move effort most, with a control the organization can apply to each.

Number of transfers and processors

Each transfer route, each importer and each onward sub-processor needs its own record and its own assessment of the destination's law. A stack with many SaaS tools and support vendors multiplies this work quickly. Consolidating processors onto fewer contracts, or retiring tools that duplicate functions, cuts the number of assessments you must maintain. Check the transfer map against your processor list before you start, since sub-processors are often missing from it.

Data categories and volume

Special category data, financial records and large volumes of identifiers raise the stakes of a foreign public authority request and make the impact of any disclosure harder to bound. The assessment must reflect what is actually transferred, not what the contract says is in scope. Limiting fields at export, pseudonymising identifiers before transfer, and dropping unneeded historical extracts reduce both the data at risk and the analysis required.

Whether data must be readable in the clear

The EDPB's Use Case 1 treats strong encryption before transmission as effective only when the importer does not need the data in the clear. Where a cloud provider or support engineer must process readable personal data in a third country, the analysis becomes much harder and the EDPB's Use Case 6 describes the situation in which no effective technical measure may be available. Ask early whether any processing at the destination requires plaintext, and design the architecture around that answer.

Number of destination countries

Each destination country has its own public authority powers, its own practice and its own history of requests, so the assessment of third-country law must be run separately for each. Routing traffic, backups and support access through several jurisdictions creates several analyses, even when the contract is with one vendor. Restricting processing to a single destination, or to the EEA and adequate countries, removes whole branches of the work.

Current transfer documentation

A transfer assessment built on an existing record of processing, current transfer tools and the vendor's written answers on government access is far shorter than one built from scratch. Gaps in the record, outdated standard contractual clauses and vendor answers that are years old all add research time. Before starting, confirm which clauses are signed, which module applies, whether the importer is certified under the EU-US Data Privacy Framework, and what the vendor has disclosed about public authority requests.

Vendor cooperation and contract terms

The assessment depends on facts only the importer can supply, such as its legal exposure, its policy on challenging requests, its transparency reports and its technical controls. A vendor that answers detailed questions in writing shortens the work, while one that refuses to share information forces you to rely on less reliable public sources or to choose another provider. Ask for these answers as a condition of the contract, and record who in the vendor is accountable for them.

Who owns each part of the assessment

As the controller or exporter, your organization owns the transfer impact assessment, the transfer tool you rely on, and the final decision to transfer, continue or suspend a flow. The EDPB Recommendations 01/2020 place the six steps with the exporter, and Clause 14 of the 2021 clauses makes the parties warrant that they have no reason to believe the destination's laws prevent the importer from complying. That warranty is given by your organization, so it cannot be delegated away.

Transfer inventory: You map every flow to a third country, including remote access by vendor staff, and record the data categories, purposes and recipients.
Transfer tool selection: You confirm whether an adequacy decision, the 2021 clauses or another Article 46 tool covers each flow, and check any DPF certification of the importer.
Assessment record: You document the reasoning for each destination, the sources you relied on and the date of the assessment.
Decision and sign-off: A named person accepts the residual risk, approves supplementary measures and schedules re-evaluation.
Regulator contact: Your DPO or privacy lead handles any supervisory authority questions about the assessment.

Before signing off, confirm that every flow in the inventory has an owner who can explain the decision to a supervisory authority.

Transfer impact assessment questions buyers ask

Is a standard template enough for a transfer impact assessment?

A template helps you structure the work, but it cannot replace an assessment of each transfer. The 2021 clauses require the parties to warrant that they have no reason to believe the destination's laws and practices prevent the importer from complying, and that warranty can only be given after you have looked at those laws for the specific transfer. The EDPB Recommendations 01/2020 (version 2.0, adopted 18 June 2021) describe the steps you must work through, including knowing your transfers, verifying the transfer tool and assessing third-country law and practice. Expect the depth of the work to vary with the data, the importer, the destination and the access risk. Ask any template provider which steps it covers and where your own facts must be entered.

Does the EU-US Data Privacy Framework remove the need for an assessment?

It removes the need for a full transfer assessment only for transfers to organizations that are certified under the framework, because an adequacy decision covers them. Commission Implementing Decision (EU) 2023/1795 adopted the framework, and you should confirm the importer's current certification status yourself before relying on it. Transfers to a US importer that is not certified, or onward transfers outside the framework, still need an Article 46 tool such as the standard contractual clauses plus a transfer assessment. Check that the scope of the certification matches the data and the services you buy.

How long should re-evaluation of a transfer assessment run?

The recommendations ask you to re-evaluate at appropriate intervals and to monitor developments in the destination's law and practice. No fixed period is set in the supplied sources, so agree the interval with your data protection officer or legal team and write it into your records. Re-evaluate sooner when the importer changes, when a sub-processor moves, when a public authority request is reported, or when a court or supervisory authority changes the position on the destination's laws. Ask your provider how it notifies you of such changes and what it commits to in the contract.

Does self-hosting in the EEA remove transfer work?

It can, but only if the data and every person or system with access to it stay inside the EEA or an equivalent jurisdiction. Self-hosting on infrastructure you control means no third-country party has access, so the transfer analysis may fall away. Remote administration from outside the EEA, vendor support sessions, backups replicated abroad or telemetry sent to a foreign provider can each create a transfer. Map every access path before you conclude that no transfer exists, and confirm the position with your advisers for your own setup.

What must the internal team provide for the assessment?

The team must provide a clear picture of the transfers. In practice that means a list of importers and sub-processors, the categories of data and data subjects, the purposes, the locations where data is stored or viewed, the transfer tool relied on, and who can access the data in the clear. The team also needs the contract terms, including the clauses on public authority requests, and any information the importer has supplied about government access requests. Assign an owner for each item and set a deadline. Gaps in this inventory usually take longer to close than the legal analysis itself.

Can an outside firm sign off on the transfer assessment?

An outside firm can prepare the assessment, but the controller or processor remains responsible for it and for the decision to transfer. Under the GDPR, no audit, attestation or certificate is required, and a certification under Article 42 does not reduce the controller's or processor's responsibility. DeployOpen prepares systems, controls and evidence for compliance assessments, but it does not issue reports, attestations or certifications. The decision and its sign-off should sit with your legal and data protection functions, with advice from qualified counsel where needed.

What happens if the assessment finds gaps?

If the assessment shows that third-country law or practice affects the effectiveness of the transfer tool, you must consider supplementary measures. The EDPB Recommendations say supplementary measures are needed only in that case, and for some scenarios, such as a cloud provider that needs data in the clear where public authority powers go beyond what is necessary and proportionate, the EDPB states it cannot envision an effective technical measure. In that situation you may need to change the importer, the architecture or the data flow, or stop the transfer. Article 49 derogations cannot become the rule in practice, so do not rely on them as a routine fallback. Record the decision and the reasoning either way.

How DeployOpen prepares the systems and evidence for a transfer assessment

DeployOpen works on the technical side of a transfer impact assessment: the systems, access paths, encryption and key handling that the assessment depends on. The organization keeps ownership of the assessment, its conclusions and any decision to transfer, while DeployOpen prepares the environment and the evidence that supports those conclusions.

How we scope

Written scope lists every transfer identified in the data flow inventory, including remote administration and vendor support access.
Scope records which systems hold personal data in the clear and which hold only encrypted data.
Scope names the transfer tools relied on and the third countries whose law the assessment must cover.
Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts.

How we build

Deployments in your own cloud accounts, data centers or air-gapped networks, so access paths are documented and controlled.
Encryption before transmission and key custody designed so that keys stay with the exporter or a trusted EEA entity.
Access control and logging configured so that every administrative path from outside the EEA is recorded and reviewable.
Security testing of the deployed platform to confirm that the technical measures behave as the documentation states.

How we hand over

Written documentation of the data flows, access paths, encryption design, key management and administrative roles.
Evidence packs mapping each technical measure to the assessment question it answers, ready for your counsel and auditor.
Re-evaluation schedule and trigger list, such as changes in destination law, new sub-processors or new support locations.
Handover session so your team can run the controls and update the assessment when the environment changes.

How we support

Ongoing support, upgrades and continuous testing are available as retainers for environments that change over time.
Retainer work can refresh configuration evidence and retest access paths when the transfer assessment is re-evaluated.
Questions about the legal conclusions of the assessment remain with your legal and privacy team and any independent advisers you engage.
DeployOpen does not issue audit reports, attestations or certifications. Independent auditors and certification bodies perform those roles.

Transfer impact assessment under GDPR