Navigating international data transfers: TIAs vs TRAs

As businesses expand globally, transferring personal dataInformation which relates to an identified or identifiable natural person. across borders has become a routine part of operations. However, these transfers carry inherent risks that require careful consideration to safeguard data. Two key assessments, TransferThe movement of data from one place to another. This could be, for example, from one data controller to another, or from one jurisdiction to another. Impact Assessments (TIAs) and Transfer Risk Assessments (TRAs), play a critical role in safeguarding data during international transfers. 

Both assessments aim to evaluate data protection measures in countries outside the European Economic Area (EEA) or the UK, but they approach the evaluation processA series of actions or steps taken in order to achieve a particular end. differently. Understanding the distinctions between TIAs and TRAs, including their methodologies, when to conduct them, and their legal significance, is essential for organisations managing cross-border data transfers. 

In this blog, Katrina Leach, experienced Data Protection Officer and Head of Data Protection Operations at The DPO Centre, breaks down TIAs and TRAs, explaining when they’re required and how businesses can effectively manage risks while navigating international data transfers. 

What is a Transfer Impact Assessment?

A Transfer Impact Assessment (TIA) is used to evaluate personal data transfers to countries outside the European Economic Area (EEA). It assesses the legal framework of the destination country to ensure it provides adequate data protection in compliance with the EU’s General Data Protection RegulationRegulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). (GDPR).  

Data exporters relying on an Article 46 transfer tool, such as EU Standard Contractual ClausesStandard Contractual Clauses are legal tools to provide adequate safeguards for data transfers from the EU or the European Economic Area to third countries. (SCCs) or Binding Corporate RulesA series of data protection policies adhered to by companies established in the EU allowing for transfers of personal data outside the EU within a group of undertakings or enterprises. BCRs provide adequate safeguards when making restricted transfers within an international organisation if both sender and receiver has signed up to the BCRs. Guide to Binding Corporate Rules | ICO (BCRs), must complete a TIA when transferring personal data to non-EEA countries that do not have an adequacy decisionA decision adopted by the European Commission on the basis of Article 45 of the GDPR, which establishes that a third country (i.e. a country not bound by the GDPR) or international organisation ensures an adequate level of protection of personal data. Such a decision takes into account the country's domestic law, its supervisory authorities, and international commitments it has....  

What is a Transfer Risk Assessment?

A Transfer Risk Assessment (TRA) is the UK’s version of a TIA. It ensures countries outside the UK provide an adequate level of data protection in compliance with UK data protection laws. A TRA focuses specifically on the risks to individual’s rights and freedoms resulting from the data transfer.  

Organisations must complete a TRA when transferring data outside the UK using an International Data Transfer Agreement (IDTAThe International Data Transfer Agreement (IDTA) is a UK framework used as a mechanism to enable a data sharing agreement for the legal transfer of personal data to a country outside the UK. It came into force on 21 March 2022 and replaced the EU’s Standard Contractual Clauses (SCCs)), EU Standard Contractual Clauses (SCCs) with a UK AddendumAn additional document that modifies, clarifies, or supplements the terms of an existing legal document without nullifying the original content., or Binding Corporate Rules (BCRs).   

Does an organisation need to complete a TIA or TRA if it is already using SCCs or IDTA?

Yes! Transfer mechanisms like Standard Contractual Clauses (SCCs) are used to facilitate the safe transfer of data internationally, whereas TIAs and TRAs assess whether these mechanisms provide adequate protection for personal data during the transfer.  

EU Standard Contractual Clauses, Binding Corporate Rules (BCRs), the UK International Data Transfer Agreement, and UK Addendum require data exporters and importers to conduct a TIA (EU) or TRA (UK). By incorporating these transfer mechanisms into their agreements, organisations make a contractual commitment to conduct these assessments.  

Learn more about SCCs, UK Addendum and UK IDTA 

Do companies transferring data outside the EU and UK need to complete both assessments?

No, companies don’t need to complete both a TIA and a TRA. The specific assessment required depends on the transfer mechanism being used. 

• If transferring from the UK:
  The Information Commissioner’s OfficeThe United Kingdom’s independent ‘supervisory authority’ for ensuring compliance with the UK GDPR, Data Protection Act 2018, the Privacy and Electronic Communications Regulations etc. (ICOThe United Kingdom’s independent supervisory authority for ensuring compliance with the UK GDPR, Data Protection Act 2018, the Privacy and Electronic Communications Regulations etc.) requires organisations to complete a TRA to assess the risk of the transfer when relying on UK IDTA or UK BCRs. However, if the organisation is using EU SCCs with a UK Addendum, the ICO allows the use of a TIA – this equivalency simplifies compliance for organisations transferring UK personal data internationally.  
• If transferring from the EEA:
  Organisations must complete a TIA to assess whether the chosen transfer mechanism, such as SCCs, ensures adequate protection in the destination country. 

It is important to note that a TRA conducted under UK regulations is not regarded as an equivalent substitute for a TIA by EU authorities. 

Can organisations face legal consequences for failing to conduct a TIA or TRA?

Organisations may face legal consequences for failing to adequately safeguard international data transfers.  Whilst the GDPR doesn’t explicitly mandate TIAs and TRAs, they are widely recognised as essential tools for demonstrating compliance with its requirement to ensure adequate protection for cross-border data transfers. Failure to assess and address risks in these transfers could lead to non-compliance, resulting in potential fines or enforcement actions by regulators.  

How often should businesses re-assess TIAs and TRAs for ongoing contracts? 

The ICO and European Data Protection Board (EDPB) do not specify how often TIAs or TRAs should be re-assessed, but both stress the importance of regular reviews to ensure compliance with data protection regulations.  

The UK’s ICO highlights the need to re-assess TRAs when there are significant changes, such as updates to data protection laws, changes in the nature of data transfers, or modifications to contractual relationships. 

The EU’s EDPB recommends that data exporters, in collaboration with importers, regularly monitor developments in the recipient country, including changes to the legal framework or practices that may affect the effectiveness of transfer tools and supplementary measures.  

These regular reviews ensure ongoing compliance and help address emerging risks associated with international data transfers.  

What can organisations do to ensure effective TIAs and TRAs?

To ensure TIAs and TRAs cover all necessary aspects of data protection, organisations should follow the methodology provided by the supervisory authorities: 

• The European Data Protection Board’s Recommendations 01/2020 includes a 6-step approach to conducting Transfer Impact Assessments
• The ICO’s Transfer Risk Assessment Tool 

Final thoughts on TIAs and TRAs

Transfer Impact Assessments (TIAs) and Transfer Risk Assessments (TRAs) are valuable tools for evaluating whether adequate data protection measures are in place for international transfers, helping organisations identify and address potential risks. 

Both assessments evaluate whether the destination country offers a level of data protection equivalent to that required under the GDPR. These assessments complement transfer mechanisms, such as Standard Contractual Clauses (SCCs) or Binding Corporate Rules (BCRs), by identifying and addressing any risks to data protection in cross-border transfers. 

Failing to complete these assessments risks exposing personal data to inadequate protection in destination countries, potentially violating GDPR requirements. Conducting TIAs and TRAs is essential to identify and address data protection risks, ensure appropriate safeguardsWhen transferring personal data to a third country, organisations must put in place appropriate safeguards to ensure the protection of personal data. Organisations should ensure that data subjects' rights will be respected and that the data subject has access to redress if they don't, and that the GDPR principles will be adhered to whilst the personal data is in the... are in place, and uphold individuals’ data rights. Regularly reassessing these assessments demonstrates accountabilityPerhaps the most important GDPR principle, which requires controllers to take responsibility for complying with the GDPR and, document their compliance., maintains customer trust, and ensures compliance with legal and regulatory obligations for cross-border data transfers.

Need help with your international data transfers?

The DPO Centre has one of the largest teams of specialist Data Protection Officers (DPOs) available. We offer a range of data protection and privacy compliance services including fractional DPOs, Interim DPOs, and Data Protection Consultancy. If you business would benefit from our support, please contact us and we can discuss your needs.

______________________________________________________________________________________________________________________________

In case you missed it… 

• • Understanding GDPR territorial scope: Essential compliance guide
  • How data protection builds customer trust and loyalty
  • Compliance with the AI Act Part 4: Essential strategies

______________________________________________________________________________________________________________________________

For more news and insights about data protection follow The DPO Centre on LinkedIn