Assesments

Impact assessment of international data transfers

Managing responsibilities

The Schrems II decision repealed the earlier Privacy Shield arrangement, on the basis of which personal data could be transferred from the EU to the United States. With the decision, the European Commission published new standard clauses (Standard Contractual Clauses, SCC) and companies faced greater pressure to define their relationship with data processors located outside the EU/EEA. All new data processing agreements must contain the new standard clauses from 27.9.2021 and contracts based on old standard clauses must be updated by 27.12.2022.

However, updating the new standard clauses as an annex to the contract is not enough. The law of the destination country of data transfer may affect the applicability of standard clauses, so your organization should assess each data transfer to determine whether the data recipient can actually implement the same level of personal data protection as in the EU. The European Data Protection Board requires an evaluation of the effects of data transfer (Data Transfer Impact Assessments, TIA), which evaluates e.g. sections of the target country’s legislation, on the basis of which the authorities can gain access to personal data. The impact assessment of the transfer of personal data is one of the due diligence measures that organizations must use to ensure the legality of data transfer. With the help of the data transfer impact assessment, your organization can assess the level of risks to personal data after the transfer.