5,0/5 Google · 167 reviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.Period: October 2016 to date · As of: 28 October 2026
Have your data transfer reviewed
Third-country transfers with a clear evidence trail
A cloud service is about to go live, a US provider is in procurement or a customer demands evidence? We check which data flows where, who can access it and which transfer instrument fits.
Please enter a short description first.
The first contact is free of charge. Before any costs arise, we will tell you expressly.
Response within 24 hours on working days
As of: 23 October 2026
Third-country transfer2 of 5
- Data flow and accessPresent
- Transfer instrumentCheck
- SCC annexes and TIACheck
- Documents alignedPresent
- Assessment by the authorityAuthority decidesMissing
Point of review: Is the specific service certified?
- 1Send documentsData flow and provider
- 2Review instrumentDPF, SCC, TIA
- 3Make the sign-off decisionLine and priorities
Schematic illustration. Simplified example.
We review data transfers for
- SaaS providers
- Groups
- HR systems
- AI projects
- Marketing teams
Key points at a glance
- A data transfer is robust when the data flow, transfer instrument, contract, technical measures and documentation all reflect the same processing.
- A single signed document is not enough for that.
- ITMR reviews international data transfers before sign-off, contract conclusion, customer audit, audit or contact with authorities.
- How a supervisory authority assesses the transfer is its own decision.
- Your contact is Dominik Skornia and his team. He is an AI Privacy Expert (GDDcert. EU). Response on working days within 24 hours.
- Third country
- A state outside the EU and the EEA. Data transfers there need a special legal basis.
- SaaS
- Software as a Service. Software used over the internet rather than installed.
- AVV
- Data processing agreement under Art. 28 GDPR. It governs how a service provider processes data on your behalf.
- DSGVO
- The EU General Data Protection Regulation (GDPR). It governs how companies may process personal data.
Starting position
When does a data transfer become a risk?
When a decision is due and the evidence does not fit together.
What matters is the actual data flow, not the heading of the contract.
A SaaS, cloud, HR, CRM or AI service from a third country is to go into production. It is unclear whether the DPF, SCCs, TIA and subcontractors cover the sign-off.
An enterprise customer demands evidence on the DPA, SCCs, storage locations and access from abroad.
SCCs are signed. Annexes, transfer description, technical measures or TIA are missing in whole or in part.
Data protection officers, supervisory authorities, investors or auditors ask questions. The transfer file must show which data flows where.
- For whom
- Data protection, IT, procurement, management
- Trigger
- Go-live, customer audit, audit
- Core
- Data flow, instrument, evidence
- Assessment
- by the supervisory authority
Admin access, remote maintenance, shared services and international group structures are also transfers if data becomes accessible from outside the EEA. AI projects with API use, logging or training also involve a third-country element.
Fundamental questions on the GDPR lead to data protection law for companies. If data processing on behalf is the focus, having your DPA reviewed is a better fit.
Send the data flow and provider documents using the form. We will get back to you on working days within 24 hours.
Process
How do we review your data transfer?
From data flow to sign-off in three steps.
01
Send documents A description of the service, DPA, SCCs, TOMs, list of sub-processors, information on hosting and access, and the specific sign-off question are enough.
02
Review instrument We assess whether an adequacy decision, the EU-US DPF, SCCs with a TIA, additional measures or another structure covers the data flow.
03
Make the sign-off decision You receive a line for procurement, data protection officers, management, customers or the supervisory authority, with risks and priorities.
Six review steps for third-country transfers
- 1
Clarify the data flow We fully record data categories, data subjects, systems, providers, sub-processors, hosting locations and onward transfers.
- 2
Determine the instrument Adequacy decision, EU-US DPF, SCCs, BCRs or a narrowly limited derogation under Art. 49 GDPR.
- 3
Complete the SCCs Module, parties, roles, purposes, data types, TOMs and order of precedence over the main agreement must fit the use.
- 4
Assess the TIA We assess third-country law, access scenario, data format, encryption, pseudonymisation and operational controls together.
- 5
Check the DPF We check whether the specific US organisation is actively certified and whether the certification covers the service.
- 6
Align the evidence The DPA, record of processing activities, privacy notices, TOMs and internal sign-off must not contradict each other.
How long does it take? We complete most work steps within a few working days. How quickly it goes depends on the scope and your feedback. Do you have a fixed date, such as a launch? Tell us right away in your enquiry and we will plan for it.
Service
What does the review include?
Service package: data transfers
Transfer mapping Record data flows, recipients, countries, access, sub-processors and roles.
SCC and DPA review Review modules, annexes, TOMs, rules on sub-processors, audit and deletion.
TIA and risk line Assess third-country exposure, access scenario, safeguards and residual risk in a structured way.
DPF and US review Assess certification status, the service covered and an alternative SCC set-up.
Align documents Synchronise the DPA, record of processing activities, privacy notices, DPIA and decision paper.
Sign-off priorities Set red lines for procurement, data protection, security, sales and providers.
- For whom
- Controllers and providers with a third-country element
- First response
- within 24 hours on working days
- Costs
- We tell you the costs transparently before you instruct us.
- Not included
- Technical review of encryption. Security service providers handle this separately.
Who delivers what and who decides
- Description of the service and its use
- DPA, SCCs and TOMs
- List of sub-processors
- Questions from customer, DPO or authority
- Transfer mapping
- Review of SCCs, TIA and DPF
- Alignment of documents
- Sign-off line and remediation
- You decide on sign-off
- The supervisory authority decides on its assessment
How does the engagement work?
- 1
First assessment You send the data flow and provider documents using the form. We assess which scope fits. The first contact is free of charge.
- 2
Offer Before we start, we tell you the scope and costs transparently.
- 3
Court steps separately We agree authority proceedings, court proceedings and representation separately.
Transfer instruments
Which transfer instrument fits?
The choice depends on the specific processing.
| Instrument | What counts legally | Typical warning sign |
|---|---|---|
| Adequacy or EU-US DPF | Does the decision or certification cover the recipient, service and scope of data? | The certified US entity is not the contracting party |
| Standard contractual clauses | Appropriate module, complete annexes, chain of sub-processors, TOMs | Signed, but annexes and country assessment remain generic |
| Transfer impact assessment | Third-country law, access options, data format and safeguards together | Template text without reference to the service and data types |
| Binding corporate rules | Approved internal rules for intra-group transfers | Misunderstood as a solution for external providers |
| Derogations under Art. 49 GDPR | Only for specific, narrowly limited cases | An ongoing process permanently relies on a derogation |
Case groups
Where do transfers quickly become a liability issue?
Six constellations we review in practice.
CRM, ticketing, HR, analytics, hosting and backup are quickly introduced. It only becomes robust once the provider chain is recorded.
Providers must show that their DPA, SCCs and transfer documents are ready for customers.
Employee data, shared services and payroll structures are closely intertwined.
Prompt processing, logging, training and provider chains create additional review pressure.
AdTech, newsletter and analytics tools combine consent, TDDDG, GDPR and third-country transfers.
Transfer gaps become visible when data rooms and contracts have to be answered reliably at short notice.
Points of attack
Which mistakes make transfers vulnerable?
Six patterns we often see in our reviews.
Access from abroad, sub-processors and group access must be reviewed separately.
The DPF only helps if the specific US organisation is actively certified and the service is covered.
Clauses without annexes, data description and country assessment look like formal documents in an audit.
If the DPA, record, notices and TIA name different recipients, an evidence gap arises.
Business units review the benefit, data protection catches up with the transfer situation later.
Ongoing cloud or group processes need a permanently effective instrument.
Legal framework
Which rules apply to third-country transfers?
Chapter V GDPR governs transfers to third countries. Art. 45 permits them on the basis of an adequacy decision, Art. 46 with appropriate safeguards such as standard contractual clauses.
Art. 47 GDPR governs binding corporate rules within a group. Art. 49 GDPR contains narrowly limited derogations for specific cases.
For the USA, the adequacy decision on the EU-US Data Privacy Framework applies. The General Court of the EU dismissed the action for annulment in case T-553/23 on 3 September 2025.
The EDPB Recommendations 01/2020 provide guidance on supplementary measures for SCC transfers.
- GDPR, Chapter V Art. 44 to 50 GDPR.
- Standard contractual clauses Implementing Decision (EU) 2021/914.
- EU-US Data Privacy Framework List of certified organisations.
- General Court T-553/23 Latombe v Commission.
- EDPB Recommendations 01/2020 Supplementary measures.
Limits
What does the review not cover?
Clear limits protect your planning.
- 1
No technical review Security service providers review encryption and access controls separately.
- 2
No promise of outcome How a supervisory authority or court assesses the transfer is their own decision.
- 3
No provider commitment Whether a provider improves its documents is its own decision.
- 4
The decision remains yours Whether you sign off a service is your decision.
What you can expect as a result
- A clear assessment of the data flow.
- A statement on the appropriate transfer instrument.
- Specific remediation points and a sign-off line.
Your contact
Lawyer · AI-Privacy-Expert (GDDcert. EU) · External data protection officer
View profile Düsseldorf, Schirmerstraße 80 · Hamburg, Palmaille 124
At ITMR, Jean Paul Bohne, Andreas Buchholz and Dr. Alexander Pleh hold the title of specialist lawyer for information technology law.
ReviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.
What clients say
5,0 von 5 · 71 Bewertungen auf anwalt.dePeriod: October 2018 to date · As of: 28 October 2026
“Competent, motivated and always available. A very good law firm.” (translated from German)
“I was and am more than satisfied with the advice and the resulting outcome! Many thanks.” (translated from German)
“I had a very good experience with ITMR Rechtsanwälte in a file-sharing/copyright matter that was very stressful for me. … The matter was resolved out of court with a significantly reduced settlement amount. I would particularly like to thank Mr Skornia for the professional support and the fast handling of my case.” (translated from German)
FAQ
What do companies ask about data transfers?
When is a transfer review needed?
As soon as personal data goes to recipients outside the EEA or is accessible from there. This concerns SaaS, cloud, HR, AI and group structures.
Are standard contractual clauses enough on their own?
No. SCCs must fit the constellation, be completed and be supported by an assessment of the third-country situation and the safeguards.
When is a TIA required?
Above all when a transfer is based on SCCs. It must then be checked whether law and practice in the recipient country impair compliance with the clauses.
Does the DPF secure every US transfer?
No. The DPF only helps if the specific US organisation is actively certified and the certification covers the service and the scope of data.
Is EU hosting enough for providers from third countries?
EU hosting is one building block but does not replace a review. Access from abroad, sub-processors, backups and onward transfers also count.
What do you review for sub-processors?
Role, country, purpose, data categories, scope of access, technical measures, contractual integration and objection mechanisms.
How quickly can a case be assessed?
If the description, DPA, SCCs, TOMs and the sign-off question are available, a first assessment is possible at short notice. The scope depends on the number of providers.
Next step
Is your data transfer documented robustly?
Before procurement, a customer, data protection officers or the authority block it, we check which data flows where and which evidence is missing.
Helpful for your enquiry
- Description of the service
- DPA, SCCs and TOMs
- List of sub-processors
- The specific open decision
A few documents are enough to get started.
Classify your data transfer case
For companies before sign-off, contract conclusion, customer audit, audit or contact with authorities.
Briefly describe provider, data flow and reason.
Related services
Data protection law Fundamental questions on the GDPR.IT-Recht Software, SaaS and cloud.Implement the Data Act Data access and contracts.EU representative under Art. 27 GDPR For companies without an EU seat.Data processing agreement Review your DPA.Service packages All packages.