Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data

What it covers

These recommendations set out a six-step roadmap for exporters to assess and, where necessary, supplement Article 46 GDPR transfer tools following the CJEU's Schrems II judgment, so that transferred personal data receives an essentially equivalent level of protection in the destination country. It includes guidance on mapping transfers, assessing third-country law and practice, and identifying technical, contractual and organisational supplementary measures.

Why it matters

It is the principal EDPB reference for conducting transfer impact assessments and selecting supplementary measures after Schrems II invalidated reliance on transfer tools alone in certain circumstances.

Refer to it when

• conducting a transfer impact assessment for a third-country data flow
• selecting supplementary measures to accompany standard contractual clauses
• documenting accountability for a transfer decision
• responding to a supervisory authority enquiry about international transfers

Questions this document addresses

• What steps should an exporter follow to assess and supplement a transfer tool?
• How is the essential equivalence standard from Schrems II applied in practice?
• What technical, contractual and organisational measures can supplement Article 46 transfer tools?
• When must a transfer be suspended because no supplementary measure is effective?

Topics

• International transfers
• Security of processing
• Supervisory authorities