Blog category
schrems-ii
DPAFlow blog posts in schrems-ii.
Search this category
Showing 1–8 of 8.
Posts
2026-07-29 · schrems-ii
When Is a Transfer Impact Assessment Required?
Whether you need a Transfer Impact Assessment depends on the transfer tool you rely on, not on the sensitivity of the data. A walkthrough of adequacy decisions, Article 46 safeguards, and Article 49 derogations, plus the subprocessor legs that pull transfers into scope unnoticed.
2026-07-25 · schrems-ii
How to Verify a US Vendor's Data Privacy Framework Certification
A certification claim can remove the need for Standard Contractual Clauses, or be true in general and inapplicable to your transfer. Five checks: the entity, currency, scope, the receiving party, and whether a fallback exists.
2026-07-25 · schrems-ii
International Data Transfer Checklist for SaaS Vendors
An eight-step operational checklist for a single vendor: establish whether there is a transfer at all, map destinations including access and backups, pick a mechanism per destination, check the clauses were completed, and record what invalidates the analysis.
2026-07-25 · schrems-ii
Standard Contractual Clauses and Subprocessors: What to Review
The clauses are boilerplate; the annexes and the onward transfer provisions carry the substance. Which module applies, what defective annexes look like, how Clause 8.8 and the docking clause govern the chain, and what to check.
2026-07-25 · schrems-ii
Data Residency vs Data Location vs International Data Transfer
Three phrases used interchangeably that mean different things. A transfer can happen without data moving at all, because access is enough. What residency is still worth, and the four questions that produce usable answers.
2026-07-25 · schrems-ii
Schrems II in Practice for SMEs
What the Schrems II judgment decided, what the EU-US Data Privacy Framework changed, the transfer toolbox as it stands, and the concrete steps an SME using everyday SaaS should take, including the UK angle.
2026-07-25 · schrems-ii
When a Subprocessor Moves Data Outside the EEA
When a processor adds or relocates a subprocessor outside the EEA, Chapter V applies to that leg too. The assessment sequence to run, the SCC contract mechanics, when to object, and how to document the decision.
2026-07-25 · schrems-ii
Transfer Impact Assessments: A Practical Walkthrough
A practical walkthrough of Transfer Impact Assessments: where the duty comes from, when you need one, the EDPB six-step method in practice, and how to keep TIAs current as vendors and subprocessors change.
Monitor subprocessor changes before they become audit work.
Create a vendor watchlist, receive risk-ranked alerts, and keep Article 28 evidence ready.