Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data

What it is about

After the Schrems II judgment the EDPB describes in six steps how to assess a transfer to a third country: map transfers, choose a tool, assess the law and practice of the third country, choose supplementary measures, take formal steps and re-assess periodically. Version 2.0 adopted on 18 June 2021, final.

What this means in practice

For transfers outside the EEA based on an Article 46 tool (such as standard contractual clauses or BCRs) you must assess and document whether the law and practice of the third country undermine the protection; in practice this is called a Transfer Impact Assessment. If the country does not offer enough protection, you choose supplementary measures, such as encryption with the key kept under your control in the EEA, or you stop the transfer. You repeat the assessment when the law or practice changes.

The GDPR articles concerned

• Article 44: General principle for transfers
• Article 45: Transfers on the basis of an adequacy decision
• Article 46: Transfers subject to appropriate safeguards
• Article 49: Derogations for specific situations