The situation
A client’s data flows to processors outside the EEA
A software company in Utrecht has moved its HR system to a US cloud provider and uses a support contractor in Bangalore whose engineers can see customer records. A large customer’s procurement team will not renew without a transfer assessment, and the client’s general counsel asks you to write it within three weeks.
The legal tests are known. What takes the days is mapping each flow to a transfer tool, checking the US provider’s certification, working through the EDPB’s steps for the Indian flow and describing the supplementary measures in terms the customer’s auditors will accept.
What the research has to settle
The rules behind the answer
- Every transfer needs a tool
- Under Chapter V of the GDPR, personal data may leave the EEA on an adequacy decision, on appropriate safeguards such as the Commission’s standard contractual clauses, or under a narrow derogation. Derogations suit occasional transfers, not a running support contract.
- US adequacy depends on certification
- The Commission’s adequacy decision for the EU-US Data Privacy Framework covers only US organisations certified under it. The assessment should record the provider’s certification and confirm the decision still stands on the date of the memo.
- Clauses need an assessment behind them
- Since Schrems II (C-311/18), an exporter relying on standard contractual clauses must assess whether the destination’s law and practice undermine them and add supplementary measures where they do. The EDPB’s Recommendations 01/2020 set out the steps.
- Remote access counts
- The EDPB treats making data available to a recipient outside the EEA, including by remote access for support, as a transfer. The Indian support flow needs its own tool and its own assessment.
How it runs in azta
From the question to the document
The question, as you would type it
Dutch controller, HR data hosted by a US cloud provider, customer records accessible by a support contractor in India via remote access. Which transfer tool applies to each flow, what must the transfer impact assessment for India cover, and which supplementary measures does the EDPB consider effective?
You start with
A client’s data flows to processors outside the EEA
- 01
Upload the data map and the contracts
Add the client’s record of processing, the processor agreements and the clauses signed. azta reads them and refers back to the passage it relied on.
File upload· Pro - 02
Research each flow
Ask which transfer tool applies to each flow and what the assessment must cover. azta cites the GDPR, the Court of Justice and the EDPB’s recommendations and guidelines.
Cited research· Free - 03
Draft the assessment
Ask for a memo with one section per flow: data, recipient, tool, assessment and measures. Edit it in Canvas and re-tone the summary for the customer’s auditors.
Canvas · Ask azta· Pro - 04
Export it for the client
Export to Word so the client can attach it to the procurement response under its own name.
Word export· Pro You send
A transfer assessment memo per flow, with the transfer tool and supplementary measures
What you get
A transfer assessment memo per flow, with the transfer tool and supplementary measures
Transfer assessment · draft
Transfers of personal data outside the EEA: HR system and customer support
Flow 1, HR data to the US cloud provider. The provider is certified under the EU-US Data Privacy Framework for HR data, as checked on the date of this memo. The transfer relies on the Commission’s adequacy decision. We recommend recording the certification and reviewing it each year.
Flow 2, remote access by the support contractor in India. No adequacy decision covers India. The transfer relies on the standard contractual clauses signed in May. Following the EDPB’s steps, we have assessed the access the contractor’s engineers have and the laws that could require disclosure.
Supplementary measures for Flow 2. Customer records are pseudonymised in the support view, and the keys stay in the EEA. Access is logged and limited to open tickets. On this basis, the clauses can be relied on, subject to the review set out in Section 5.
Outcomes on your numbers
What azta is worth on this task
Pro pays for itself after
8 minutes a month
At €230 an hour, that is all the time Pro (€27 a month) has to take off your desk to cover its price.
Example figures. Replace them with your own.
- Hours back a year
- 50
- Capacity at your rate
- €11,592
- More transfer assessments a quarter
- 1.5
- Return on Pro
- 35.8×
- Research
- Drafting
- Your review
A scenario you set, not a promise. The hours that come back go to another client, or deeper into this one.
Want these numbers on your team’s real workload?
Book a demoSources azta searches here
- EUR-Lex · Curia
- EDPB
- wetten.overheid.nl
- Rechtspraak.nl
What stays with you
- Confirming the facts of each flow with the client’s IT team.
- The judgement on whether the measures are effective in practice.
- Signing the assessment and keeping it under review.
Frequently asked questions
- Does azta hold the EDPB’s guidelines?
- Yes. EDPB material is in the source register alongside the GDPR and the Court of Justice’s decisions, and every point in the answer is cited.
- Can it tell me whether a provider is certified?
- No. Check the official Data Privacy Framework list yourself and record the date. azta researches what the certification means for the transfer.
- Where is the client’s data map stored?
- In the EU/EEA. Client documents are never used for training on any plan.
