ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
A transfer impact assessment template gives your team a single, repeatable structure for reviewing each transfer of personal data to a country outside the European Economic Area. Without it, assessments vary in depth and quality, key facts are missed and the decision to proceed cannot easily be defended when a regulator, a customer or a data subject asks how it was reached.
This guide sets out what a transfer impact assessment template should contain, section by section, and explains how to fill it in, who should approve it and when it should be reviewed. It is written for privacy and legal teams that handle several transfers and want consistency across them.
In the Schrems II judgment of July 2020, the Court of Justice of the European Union held that a controller relying on standard contractual clauses must verify, case by case, whether the law and practice of the destination country allow the recipient to comply with the clauses. The European Data Protection Board followed with Recommendations 01/2020 on supplementary measures, which set out a six-step roadmap. The Commission’s 2021 standard contractual clauses then wrote the requirement into the contract: under Clause 14 the parties warrant that they have no reason to believe local law prevents compliance and that they have documented their assessment and will make it available to the supervisory authority on request. You can read the recommendations on the EDPB website.
A documented assessment is therefore not optional where the standard clauses or other Article 46 tools are used. A template makes sure that it exists, and that each one covers the same ground. Our comparison of a transfer risk assessment and a TIA explains how the UK and EU terms differ.
Free transfer impact assessment
Can this transfer of personal data go ahead?
Check whether the transfer needs a TIA, map it, assess the laws and practice of the destination, rate the risks from 27 transfer scenarios and choose supplementary measures. Covers the EU SCCs and the UK IDTA and Addendum, free.
| Section | What to record | Common gap |
|---|---|---|
| 1. Transfer description | Exporter, importer, purpose, data categories, data subjects, volume, frequency, onward transfers | Vague descriptions such as customer data |
| 2. Transfer tool | Adequacy decision, standard clauses, binding corporate rules or a derogation | Tool chosen without recording why |
| 3. Destination law and practice | Laws on government access, oversight, redress, and evidence of practice | Copying generic country summaries |
| 4. Importer facts | Sector, type of data, experience of access requests, transparency reports | Assuming rather than asking the importer |
| 5. Supplementary measures | Technical, contractual and organizational measures, and their effect | Listing measures with no link to the risk |
| 6. Conclusion | Transfer may proceed, proceed with measures, or must be suspended | No clear decision or owner |
| 7. Review | Date, triggers, reviewer | One-off record that is never revisited |
Begin with facts, because every later judgment depends on them. Record who sends the data and who receives it, what the receiver does with it and where it is stored and accessed from. List the categories of personal data and the groups of people concerned, and mark special categories or data of children. Note how the data moves, such as through an API, file transfer or remote access, and whether the importer passes it on. Cross-check this against your record of processing. Our guide to international transfers in the RoPA shows how to keep that record aligned.
State which Chapter V mechanism applies. If the country has an adequacy decision, the assessment can be short, though you should still record that decision and check it remains in force. For the EU-US Data Privacy Framework, confirm that the importer is certified for the relevant type of data and check the current legal status of the framework before relying on it. Our guide on the Data Privacy Framework and TIAs explains what you can rely on. Where you use standard contractual clauses or binding corporate rules, record the module and the version, and whether the annexes have been completed.
This is the hardest section, and it should be based on sources, not impressions. Identify the laws that allow public authorities to access data held by the importer, the safeguards that apply, whether there is independent oversight and whether individuals have a route to redress. Then consider practice: whether the importer has received such requests, whether it has published transparency data and whether there is credible evidence of the law being applied in ways that go beyond its text. Record each source and its date so the next reviewer can see what was relied on. Our guide to assessing third-country laws explains how to structure that research.
Where the analysis finds a gap between the local law and the level of protection required, record the measures you will add. They fall into three groups: technical, such as strong encryption with keys held in the EEA, or pseudonymization; contractual, such as commitments to challenge access requests and to notify you; and organizational, such as internal policies and limits on access. Explain why each measure is effective against the specific risk identified. Encryption, for example, offers limited protection if the importer needs the data in clear form to perform the service. See supplementary measures for data transfers for examples of what does and does not work.
Much of the evidence for the assessment must come from the recipient, so send a short questionnaire before you complete the record. Ask whether it has ever received a request from a public authority for the type of data concerned, how it handled the request, whether it would challenge one that seemed unlawful, and whether it publishes figures on such requests. Ask where the data is stored, who can access it, whether support staff outside the EEA can view it and which subprocessors are involved. Ask what encryption is used and who holds the keys. Keep the answers with the file, and if the importer declines to answer, record that fact and consider it when reaching your conclusion.
Where the same importer serves many customers, ask for its standard transparency report and its own transfer assessment, then check that it fits your data. A generic answer is a starting point, not a substitute for judging your own transfer.
The template must end in a decision: proceed, proceed with named measures, or suspend or do not start. Name the person who made it and the person who approved it. Set a review date and define triggers such as a change of law in the destination country, a new government access request, a change of importer or hosting location, a court ruling or the end of an adequacy arrangement. For transfers between companies in the same group, see our guide to the intra-group transfer impact assessment.
Reuse research but not conclusions. The analysis of a country’s law can be shared across all transfers to that country, kept in a single reviewed memo and referenced in each assessment. The rest of the record, including the data, the importer and the measures, must be specific to each transfer. Keep a register of all completed assessments with owner, date and next review, so that you can see which are overdue and can respond quickly to a court decision or a regulator query. Also keep the importer’s answers to your questionnaire, since they are part of the evidence.
If you would rather begin from a completed structure than design your own, the Transfer Impact Assessment Report and Workbook provides a structured report, a scoring method and a working register. You can compare it with a filled-in record in our transfer impact assessment example. Either way, a good transfer impact assessment template is short enough to complete, specific enough to be useful and firm enough to end in a decision.
It should include the transfer description, the transfer tool, the analysis of the destination country’s law and practice, the importer facts, supplementary measures, the conclusion and a review date.
Where you rely on an Article 46 tool such as standard contractual clauses, you must assess whether the destination country’s law allows the safeguards to work, and the 2021 clauses require the assessment to be documented.
Yes, the structure can be shared, but each completed assessment must reflect the specific data, importer and measures. Country-level legal research can be reused across transfers to the same country.
Review it at planned intervals and when triggers occur, such as legal changes, new access requests, changes of importer or the end of an adequacy decision. Many organizations review annually.
A senior person with authority over the transfer, with advice from the data protection officer or privacy lead recorded, should approve it. Suspension decisions should be escalated promptly.
September 30, 2026
