After signing SCCs with a non-adequate vendor, a controller skips any transfer impact assessment because “the clauses are Commission-approved.” What step is still expected?
Select an answer to reveal the explanation.
Short Explanation
Commission-approved SCCs are a strong starting kit, not a magic force field. You still walk the destination’s legal landscape—who can demand data, what redress exists—and write down whether the clauses actually hold. Skipping that transfer impact thinking because the template looks official leaves a gap.
Full Explanation
Commission approval of the Standard Contractual Clauses text does not prove those clauses are effective in every destination fact pattern. After signing SCCs with a non-adequate vendor, exporters are still expected to evaluate third-country law and public-authority access risks—commonly documented as a transfer impact assessment—and to adopt supplementary measures where contractual safeguards alone may not deliver essentially equivalent protection. That discipline protects individuals whose data municipal contractors or private companies send abroad and reflects Schrems II accountability rather than checkbox contracting.
Filing SCCs with Europol does not activate supplementary measures. Replacing SCCs with Safe Harbor annexes when a TIA would be burdensome is historically void advice. Vendor marketing sites that merely mention encryption are not a documented effectiveness assessment and cannot replace a real review of law, practice, and technical control.
Exam caveat: TIAs should be proportionate and evidence-based, covering legal access powers, vendor practices, technical measures, and residual risk—not a one-line note that “SCCs are Commission-approved.”
Operational check: complete and retain a TIA for the vendor relationship, map identified risks to concrete measures such as encryption with appropriate key custody, access minimisation, or location controls, brief leadership on residual risk, and reopen the assessment when the vendor’s regions, ownership, or local law change.