TIA (Transfer Impact Assessment)
EDPB Recommendations 01/2020 — third country risk assessment
TL;DR
A Transfer Impact Assessment is the structured evaluation of whether personal data is effectively protected in the recipient country — required since CJEU C-311/18 (Schrems II) and set out in more detail in EDPB Recommendations 01/2020.
What is a TIA (Transfer Impact Assessment)?
Minimum TIA steps:
- Description of the transfer
- Identification of the transfer tool (SCC, BCR)
- Assessment of its effectiveness in the third country
- Identification of supplementary measures
- Procedural steps
- Re-evaluation
Practical example
For Microsoft 365 with US sub-processors: the TIA documents the FISA 702 risk, encryption in transit and at rest, the Customer Lockbox function and the EU Data Boundary.
Frequently asked questions
Mandatory for every provider?
For a third country, yes. For DPF-certified US providers, recommended.
Who carries out the TIA?
The controller (you). The recipient must cooperate (Art. 28 and the data processing agreement).
How often should it be renewed?
On material changes and at least annually.
See also
Practitioner note: This article is practice-oriented compliance documentation, not legal advice. We are compliance specialists, not a law firm. For legally binding advice, consult a qualified lawyer.