Third-Country Transfer Check

Pre-assess international data transfers legally

Q: When is a third-country transfer likely?

A third-country transfer can be relevant when personal data is transmitted to a country outside the EEA or when a recipient or support team outside the EEA gains access to personal data. This applies in particular to cloud, SaaS, tracking, support, HR, CRM and group set-ups.

Q: Which interfaces often matter?

Third-country transfers often touch on other topics such as a DPIA where the risk is high, the TDDDG for tracking and terminal device access, NIS2 or BSIG for security and incident processes, the AI Act for AI tools, the Data Act for data access models, the DSA for platforms, and contractual audit and evidence obligations towards customers. Requests for disclosure from third-country authorities do not on their own justify a transfer (Art. 48 GDPR, EDPB Guidelines 02/2024).

This checker helps businesses, SaaS providers, platforms, agencies and digital business models classify third-country transfers under the GDPR in a structured way: recipients, destination countries, transfer mechanism, safeguards, documentation and urgency. This lets you pre-assess international data transfers before a tool is approved or a contract is signed.

Start the check

GDPR Chapter V SCC & TIA EU-US DPF Cloud & SaaS Sub-processors

What is the check for?

The Third-Country Transfer Check gives an initial orientation on whether cloud tools, support access, international groups, tracking, sub-processors or direct recipients outside the EEA call for additional review. It does not replace advice on the individual case, but it helps with prioritisation, preparing documents and your inquiry.

Assessment of whether a third-country transfer or third-country access is likely.
Review of whether a sound transfer mechanism is documented.
Notes on TIA, SCC, DPF, BCR, DPA, TOMs and transparency obligations.
A copyable summary for a structured inquiry to ITMR.

Transfer map

From data flow to transfer decision

A robust third-country transfer does not start with contract templates but with a verifiable data flow: who accesses which data, from which country, in which role and with which guarantees?

Orientation: not yet assessed Start the questionnaire to classify the transfer mechanism, safeguards and urgency.

Process

Five steps to an initial risk assessment

Capture the transfer situation

Cloud, SaaS, support, group access, tracking, sub-processor or direct recipient.

Check the mechanism

Adequacy decision, EU-US DPF, SCC, BCR or a narrowly construed derogation.

Assess the data risk

Data types, sensitivity, volume, employee data, security logs and confidentiality.

Match safeguards

TIA, SCC module, DPA, sub-processors, encryption, pseudonymisation and access control.

Derive the priority

Go-live, ongoing operation, audit, authority, complaint, incident or preventive review.

Classification

What this check does

The check combines the transfer logic of data protection law with practical documentation requirements for digital business models. It takes particular account of GDPR accountability, DPAs, sub-processors, SCC/TIA, the EU-US Data Privacy Framework, technical supplementary measures, privacy notices, records of processing, DPIA interfaces and ongoing monitoring.

When is a third-country transfer likely?

A third-country transfer can already be relevant when personal data is transmitted to a country outside the EEA or when a recipient or support team outside the EEA gains access to personal data. This applies in particular to cloud, SaaS, tracking, support, HR, CRM and group set-ups.

Why is a contract or DPA alone often not enough?

A DPA governs processing on behalf of a controller, but it does not replace a transfer mechanism under Chapter V GDPR. Depending on the set-up, you need an adequacy decision, the EU-US DPF, standard contractual clauses, binding corporate rules or a narrowly justified derogation. With SCC, you regularly also need to check whether the destination country, recipient and access options can be controlled in practice.

Which interfaces often matter?

Third-country transfers often touch on other topics: a DPIA where the risk is high, the TDDDG for tracking and terminal device access, NIS2/BSIG for security and incident processes, the AI Act for AI tools, the Data Act for data access models, the DSA for platforms, and contractual audit and evidence obligations towards customers. Requests for disclosure from third-country authorities do not on their own justify a transfer (Art. 48 GDPR, EDPB Guidelines 02/2024).

Where are the limits of the check?

The checker does not replace a review of the specific data flow, recipient, destination country, contracts and technical access concept. Especially with sensitive data, a US connection, contact with authorities, a data breach, employee data, AI tools or an ongoing audit request, the assessment should be deepened for the individual case.

Interactive check

Assess the third-country transfer risk

Answer the following questions. At the end you receive a preliminary classification with reasons, review points, a document list and a copyable summary.

Step 1 of 5

1. Which transfer situation should be reviewed? Cloud, SaaS or IT tool with a third-country connectionMicrosoft 365, Google, AWS, Salesforce, HubSpot, Atlassian, OpenAI, CRM, support, HR, marketing or project tool. Processor or sub-processor in a third countryService provider, hosting, support, development, maintenance, analytics or subcontractor outside the EEA. Remote access or support from a third countryAdmin, support, maintenance, developer or security access from outside the EEA. Intra-group data transferParent, subsidiary, shared service, HR, CRM, finance or IT access within an international group of companies. Website, tracking, marketing or embedded third partiesAnalytics, ads, pixels, CDN, fonts, chatbot, video, social plugins, newsletter or tag management. Direct transfer to a recipient in a third countryCustomer, partner, adviser, lawyer, authority, insurer, platform, service provider or business partner outside the EEA. Unclear whether a third-country transfer takes placeData flows, hosting, support, sub-processors or recipients are not yet fully known.

2. What should the transfer be based on? Adequacy decisionThe recipient country or specific sector is recognised as adequate by the European Commission. EU-US Data Privacy FrameworkThe US recipient is certified and the specific transfer falls within the certified scope. Standard contractual clauses / SCCEU standard contractual clauses have been or are to be concluded. Binding Corporate Rules / BCRBinding intra-group data protection rules exist or are to be used. Art. 49 derogationConsent, contractual necessity, legal claims, public interest or an exceptional case. Only a contract, DPA or provider termsThere is a contract, but no clear transfer mechanism is documented. Unclear / not yet reviewedThe transfer mechanism, destination country or certification has not been verified.

3. Which data and risks are affected?

Please tick everything that applies.

Ordinary personal dataName, email, phone number, account data, customer, user or contact data. Employee, applicant or HR dataPersonnel files, payroll, applications, performance data, working hours or internal communication. Special categories or very sensitive dataHealth, religion, political opinions, trade union membership, biometric data, children, patients or particularly vulnerable persons. Credentials, logs or security dataPasswords, tokens, IP addresses, admin access, log files, telemetry, security events. Trade secrets or confidential communicationSource code, contracts, strategies, client/patient communication, M&A or internal documents. Large volume or continuous synchronisationMany data subjects, CRM sync, HR system, data warehouse, tracking, platform operation or permanent API access. Pseudonymised, encrypted or heavily minimised dataIdentifying data is separated, encrypted, hashed, tokenised or technically heavily reduced. Anonymous data onlyPersonal reference can no longer be established; re-identification is not realistic. Unclear / data types not inventoriedIt is not yet known which data is transferred or made accessible.

5. Is there concrete urgency?

Please tick everything that applies.

Tool, contract or transfer is about to go liveProcurement, rollout, SaaS launch, vendor approval or contract signing is imminent. Transfer is already in productionTool, tracking, support, sub-processor or group access is already active. New sub-processor, new destination country or new support structureThe provider announces new subcontractors, US support, a cloud region or international access. Customer, procurement, DPO or auditor requests evidenceQuestionnaire, vendor assessment, DPA review, audit, group review or data protection approval. Supervisory authority, complaint or data subject requestAn authority, DPO, works council, customer or data subject asks specifically about the third-country transfer. Data breach, access, leak or security incidentUnauthorised access, support access, misconfiguration, data leakage or provider incident. DPIA, sensitive project or works council issueHR, monitoring, AI, tracking, health data, employee data or extensive profiling. Preventive reviewNo acute case, but the transfer inventory, SCC, TIA or tool stack should be properly documented.

Risks & deadlines

Typical review points for third-country transfers

Situation	Risk note	Typical measure	Priority
US tool or US support	DPF certification, SCC and the actual access situation must fit together.	Check DPF scope, provider name, sub-processors, SCC/TIA and TOMs.	Before go-live and when the provider changes
SCC without TIA	Standard contractual clauses are important, but they do not replace a review of the practical risks of the transfer.	Document a TIA with data types, destination country, recipient, access and supplementary measures.	At short notice
Tracking and marketing	Terminal device access, personal IDs and third parties can combine data protection and TDDDG risks.	Check CMP, consent logs, providers, data flows, privacy notices and third countries.	Ongoing and when campaigns change
Data breach or access incident	In the event of a personal data breach, a 72-hour review for notification to the supervisory authority may become relevant.	Secure breach triage, logs, recipients, third-country access, risk to data subjects and communication.	Immediately
Data subject request	Data subject rights generally have to be handled within one month.	Document recipients, guarantees, data categories and the information provided.	Deadline control
AI, HR or security tool	Sensitive data, employee data, monitoring, AI and security logs raise the requirements.	Clarify the DPIA interface, works council, roles, access concept, AI/vendor review and TOMs.	Before productive use

Sensible next steps

Related ITMR checkers and follow-up reviews

DPA CheckReviews processing on behalf, sub-processors, TOMs and contractual data protection obligations. GDPR Roles SimulatorHelps with the roles of controller, processor, joint controller and recipient. DPIA CheckAssesses whether a DPIA is likely for sensitive, large-scale or new processing. Data Breach Risk CheckSupports you with incidents, the 72-hour review, risk to data subjects and first measures. SaaS Contract CheckCombines data protection, cloud, SLA, support, exit, security and international providers. Document Dossier BuilderStructures evidence for vendor assessments, audits, data protection approvals and inquiries.

Have your third-country transfer reviewed in detail

If a tool is about to be rolled out, a customer requests evidence, a change of sub-processor has been announced or an incident is already on the table, the transfer review should be based on the actual documents rather than in the abstract.

Send an inquiry to ITMR

Legal orientation note

This Third-Country Transfer Check is a structured initial orientation for typical set-ups of digital business models. It does not replace a legal review of the individual case. What matters are the specific data flow, the parties involved, roles, destination countries, contract documents, technical safeguards, current practice of authorities and courts, and ongoing developments, for example regarding the EU-US Data Privacy Framework, SCC/TIA requirements and adjacent digital regulation. Remote access from third countries to data stored in the EEA can constitute a transfer within the meaning of Chapter V GDPR according to EDPB Guidelines 05/2021. How we legally secure data transfers to third countries is explained under Data transfer; companies without an EU establishment will find information on the EU representative under Art. 27 GDPR.