Transfer Impact Assessment Checklist: The Essential 2026 Guide to the Six Steps

A transfer impact assessment checklist is a step-by-step list of checks you complete before sending personal data from the EU or UK to a country that has no adequacy decision, so you can show that the data will stay protected to an essentially equivalent standard. It is how most organizations put the Schrems II ruling into practice.

The Court of Justice decided that case in July 2020 and held that companies relying on standard contractual clauses must verify, case by case, whether the law and practice of the destination country undermine those clauses. The European Data Protection Board then published Recommendations 01/2020, which set out six steps (EDPB Recommendations 01/2020). This checklist follows them.

It is a working tool, not legal advice. Adequacy decisions and regulator positions change, so confirm the current position for each destination before you rely on it.

Why a transfer impact assessment checklist helps

Transfers are easy to overlook. A support tool hosted abroad, an analytics vendor with staff in another region, a cloud backup in a different country: each can be a restricted transfer under GDPR Chapter V. A checklist makes sure each one is found, assessed and recorded.

It also speeds up the work. Once the questions are standardized, a privacy analyst can complete a routine assessment in an afternoon and save the harder cases for legal review. The result is a file that answers a regulator or a customer who asks how you assessed the transfer.

Keep scope clear. The assessment applies where you rely on a transfer tool such as standard contractual clauses or binding corporate rules. If the destination has an adequacy decision, or the recipient is certified under a valid framework, the analysis is lighter, though you should still record why.

Step one and two of the transfer impact assessment checklist: map and choose

Begin by mapping each transfer: the data categories, the data subjects, the exporter, the importer, the countries involved, any onward transfers and the purpose. Include remote access from abroad, because viewing data from another country is a transfer even when the data stays in the EU.

Then record the transfer tool. Options include an adequacy decision, standard contractual clauses, binding corporate rules and, in narrow cases, the derogations in Article 49. For the EU-US route, check whether the recipient is certified under the Data Privacy Framework, which the Commission adopted in July 2023. A challenge to that decision was dismissed by the EU General Court in September 2025, but further appeal is possible, so check its current status.

Document why you chose the tool. A sentence explaining that SCCs were used because the recipient is not certified is enough, and it saves confusion later.

Step	Check	Evidence to keep
1. Know the transfer	What data, who, where, why?	Transfer map
2. Choose the tool	SCCs, BCRs, adequacy or derogation?	Signed clauses, decision reference
3. Assess the law	Does local law undermine the tool?	Written assessment of laws and practice
4. Add measures	Encryption, pseudonymization, contract terms	Technical and contractual measures
5. Procedure	Any approvals or notifications needed?	Records of steps taken
6. Re-evaluate	When will you look again?	Review date and triggers

Assess the destination in your transfer impact assessment checklist

This is the hardest step. Ask whether the laws and practices in the destination country allow public authorities to access the data in ways that go beyond what is necessary and proportionate in a democratic society. Look at surveillance laws, the oversight of authorities, the rights of individuals and the availability of redress.

Use reliable sources: legal analysis, regulator publications and the importer’s own information. The EDPB expects you to assess the actual practice as well as the written law, and to consider whether the importer has ever received a request for the data. The guidance in third-country laws for transfer assessments gives a structure you can follow.

Record the conclusion in plain words: the law poses no issue for this data, poses an issue that can be fixed by measures, or poses an issue that cannot be fixed. Only the last outcome means you must stop or change the transfer.

Supplementary measures checklist

If the assessment finds a gap, consider technical, contractual and organizational measures. Technical measures include strong encryption with keys held in the EU, pseudonymization where the importer cannot re-identify people, and split processing. The options are explained in supplementary measures for data transfers.

Contractual measures include commitments to challenge government requests, to notify you of requests where legally allowed and to publish transparency reports. Organizational measures include internal policies, data minimization and access limits. See TIA government access requests for how to handle requests.

Be honest about effectiveness. Contract terms alone rarely fix a problem caused by local law, so pair them with technical controls. Encryption details are in TIA encryption measures.

Procedure, documentation and sign-off

Step five covers the procedural side. Depending on the tool, you may need to notify or obtain authorization from a supervisory authority, for example for ad hoc contractual clauses. For standard clauses, no authorization is usually required, but you should keep the signed copy and the completed annexes.

Write the assessment up and get it approved. The record should include the transfer map, the tool, the legal analysis, the measures, the conclusion, the author, the approver and the date. TIA template provides a format you can follow.

Keep it findable. When a regulator or a customer asks, you should be able to produce the file within a day.

Review and monitoring

Step six is easy to skip. Set a review interval and triggers. Triggers include a change in the destination country law, a court ruling, a new adequacy or invalidation decision, a change of importer or sub-processor, a new data category and a government access request. The process in TIA review and monitoring shows how to keep the assessments current.

For cloud and sub-processor chains, review the list of sub-processors when the provider notifies a change. TIA sub-processors and TIA cloud services cover these common cases.

A yearly check is a sensible minimum for ongoing transfers to high-interest countries, with event-based reviews in between.

UK and intra-group transfers

The UK has its own regime. Under the UK GDPR, transfers can rely on the International Data Transfer Agreement or the UK Addendum to the EU clauses, and the ICO publishes its own transfer risk assessment approach. If you transfer from both the EU and the UK, align the two assessments but record them separately. UK transfer risk assessment explains the differences.

Transfers within a corporate group follow the same logic, even though the parties are related. A parent company in a third country receiving employee or customer data needs the same analysis, as intra-group transfer impact assessment describes.

Where the same importer receives data from many group companies, one shared assessment can serve them all if the facts are the same.

A short transfer impact assessment checklist example

A European retailer uses a US-based email provider. Step one: customer names and email addresses, transferred for newsletter delivery, with US staff able to view data for support. Step two: the provider is not certified, so the parties sign standard contractual clauses. Step three: the retailer reviews US surveillance law, the provider’s statement on past government requests and its transparency report.

Step four: data is encrypted in transit and at rest, the provider commits to challenge overbroad requests, and access by staff is limited to support cases. Step five: signed clauses are filed. Step six: review in twelve months or on a change in law. The transfer impact assessment checklist records each answer, the approver and the date. The details are illustrative, so your analysis should rest on your own facts.

Mistakes to avoid with a transfer impact assessment checklist

The most common mistake is relying on a signed contract alone. The clauses are a starting point, and the assessment of the destination is what shows they can work in practice. A second mistake is using the same generic conclusion for every country. A third is leaving the importer out of the process: you need accurate facts about how it handles access requests.

Another error is forgetting remote access and sub-processors, which are frequent blind spots. Finally, avoid storing the assessment in a mailbox. Keep one controlled record per transfer, so anyone can find it, read it and see when it was last reviewed. A transfer impact assessment checklist only helps if it is used every time.

Using a ready-made transfer impact assessment checklist

You can turn the checklist above into your own form, but defining the screening rules, the legal analysis sections and the sign-off steps takes effort. A finished structure helps you start faster.

The Transfer Impact Assessment Report includes screening, destination laws, transfer risks, supplementary measures, sign-off and a live workbook, so you enter the facts and produce a complete record. Try it on one real transfer first to check that it fits your process.

Whichever format you use, involve legal counsel in any assessment that concludes a measure is required, and record that review.

Transfer impact assessment checklist FAQ

What is a transfer impact assessment?

It is a documented analysis of whether the law and practice of a destination country allow data to be protected to an essentially equivalent standard when you rely on a transfer tool such as standard contractual clauses.

Do I need one for every transfer?

You need one for each restricted transfer that relies on a tool like SCCs or BCRs. Transfers covered by a valid adequacy decision generally do not need the full analysis.

Who writes the assessment?

The exporter is responsible, usually with help from the importer and legal counsel. The importer must supply accurate information about its laws and practice.

How often should I review it?

At least yearly for ongoing transfers, and whenever the law, the importer or the data changes.

Does the UK require the same thing?

The UK expects a transfer risk assessment for restricted transfers that rely on appropriate safeguards, and the ICO provides its own tool and guidance.