Standard contractual clauses are a contract between data exporter and importer. A contract, however, binds no authorities in the recipient state. The transfer impact assessment therefore answers the question of whether the clauses deliver in the specific case what they promise.
Origin
In its Schrems II judgment of July 2020 (case C-311/18), the Court of Justice of the EU struck down the then Privacy Shield and held that exporters relying on standard contractual clauses must check whether the recipient state’s law allows an essentially equivalent level of protection. The European Data Protection Board published recommendations describing the approach. The Swiss FDPIC also expects such an assessment for disclosures from Switzerland.
When it is needed
A TIA is needed when personal data is transferred to a state without an adequacy decision and the transfer relies on standard contractual clauses or similar safeguards. It is not needed where the recipient state is recognised as adequate, such as the EU and EEA states from a Swiss perspective, or where the US recipient is certified under the Data Privacy Framework.
What is assessed
The circumstances of the transfer: which data, for what purpose, to whom, via which routes and sub-processors. The law and practice of the recipient state: government access rights, legal redress for data subjects, experience with access requests. And whether supplementary measures close the gap.
Supplementary measures
The most effective technical measure is encryption where the recipient has no access to the keys, or pseudonymisation where the mapping stays with the exporter. Contractually, obligations to report access requests and to challenge them help. Organisationally, data minimisation helps: what is not transferred need not be protected. For services that must process data in clear text, such as many AI models, technical measures reach their limits.
Documenting pragmatically
A TIA need not be an expert opinion. For many standard cases a structured record per vendor covering data, recipient state, legal position, risk and measures, updated when things change, is enough. The overall framework is described in our article on data transfers between Switzerland, the EU and third countries.