Third country transfers
Transfers outside the EU with a legal basis, a six-step TIA assistant and periodic review.
As soon as an AI service runs outside the EU (which is the case for most large model providers), you have a transfer to a third country. It needs a basis under Art. 44 et seq. GDPR. Where it rests on standard contractual clauses or binding corporate rules, an assessment of the legal framework in the destination country is required as well: the transfer impact assessment (TIA). The third-country tracker keeps both together.
At a glance
- Included from
- Enterprise
- Where in the app
- GDPR → Capture → Third-country transfers
- Output
- Transfer register with legal basis, TIA report, traffic light and review date
- Legal basis
- Art. 44–49 GDPR; EDPB Recommendations 01/2020
- API
- /api/v1/dsgvo-transfers
Legal bases of the transfer
Fixed values, no free text: the authority pack is grouped by legal basis, and the vendor register uses the same values.
| Value | Meaning | TIA |
|---|---|---|
| ANGEMESSENHEITSBESCHLUSS | Adequacy decision of the EU Commission (Art. 45). | Not required |
| DPF | EU-US Data Privacy Framework: the adequacy decision for the USA (Implementing Decision (EU) 2023/1795). Only covers US recipients certified on the DPF list; the app does not accept the value for other countries. | Not required |
| STANDARDVERTRAGSKLAUSELN | Standard contractual clauses (Art. 46(2)(c)), with module 1–4. | Required (Clause 14) |
| BCR | Binding corporate rules (Art. 47), typically within a group. | Required |
| AUSNAHME_ART49 | Derogation for specific situations (Art. 49). The app requires the specific case under Art. 49(1) and a justification of at least 20 characters (documentation under Art. 49(6)). Not viable as a permanent solution for regular transfers. | Not required |
| UNBEKANNT | Not yet clarified: open work, not a result. | Undetermined |
The TIA assistant: six steps under EDPB Recommendations 01/2020
Every step has a traffic light (green, yellow, red), a note field and, where the procedure foresees one, a result. The traffic light is a SimpleAct display value, not a legal category.
- 1Know your transfers: purpose and data categories (Clause 14(b)(i)) are taken from the transfer record.
- 2Identify the transfer tool: adequacy decision, standard contractual clauses, BCR, another Art. 46 safeguard, Art. 49 derogation or none.
- 3Assess effectiveness in the destination country: result A (no impairment), B (supplementary measures required), C1 (suspend the transfer), C2 (only with effective supplementary measures) or C3. The app blocks results that contradict your answers, such as A where authorities act problematically in practice.
- 4Supplementary measures: technical, contractual, organisational; result: effective, not effective or open.
- 5Procedural steps for the supplementary measures.
- 6Re-evaluate at appropriate intervals: review interval and date of the next review.
Periodic review
- The default review interval is 12 months. 24 months can only be chosen with a written justification of at least 20 characters.
- The review date in step 6 is also the review date of the transfer. The app rejects a date beyond the end of the interval.
- Without an explicit date, the interval counts from completion of the TIA; for an adequacy decision or the DPF from the last change to the record.
- Transfers based on an adequacy decision, the DPF, standard contractual clauses and BCR are monitored. An adequacy decision can also fall away, as Schrems II showed for the Privacy Shield. Due reviews appear in the summary.
AI suggestion (beta)
If the AI assistant is enabled for your organisation, the TIA assistant can propose a draft for individual steps, such as a country assessment. The proposal is labelled "AI suggestion: please review"; the app stores which fields came from the proposal and whether a person verified them. Check every statement against the sources and add the references.
TIA status
| Status | Meaning |
|---|---|
| NICHT_ERFORDERLICH | No TIA needed, for an adequacy decision, the DPF or an Art. 49 derogation. |
| AUSSTEHEND | Required, not started. |
| IN_BEARBEITUNG | Assessment under way. |
| ABGESCHLOSSEN | Completed, with a completion date. Counts as done in the summary. |
| ABGELEHNT | Negative outcome: additional measures or a different provider needed. |
What a transfer records
- Recipient and destination country, data categories transferred and purpose.
- Legal basis, the module for standard contractual clauses, certification evidence for the DPF; optionally standard contractual clauses as a fallback.
- TIA with six steps, status, completion date and review interval; exportable as a report.
- Links to the vendor in the vendor register and the processing record concerned.
- Optionally a multi-stage approval of the TIA (approvals module, object type TIA).
The possibility of access counts too
For every AI service, check not only the server location but also who has operational access, for example the provider’s support teams outside the EU.