Irish businesses using cloud software like Google Workspace or Slack, working with overseas suppliers, or having teams outside the EEA, especially SMEs handling personal data.
Readers will gain practical steps to map transfers, select mechanisms like SCCs and TIAs, avoid fines, and ensure GDPR compliance for international operations.
Key Takeaways
Cross-border transfers happen via cloud tools or overseas partners; require GDPR Chapter V mechanisms.
Use adequacy decisions for approved countries; SCCs plus TIA otherwise.
Conduct documented TIAs for non-adequate destinations, focusing on legal access risks.
Map data flows, build transfer register, review regularly to stay compliant.
Laura Ryan is a practising Barrister at the Bar of Ireland. She graduated from the Honourable Society of King’s Inns in 2024, having previously qualified and practised as a Chartered Accountant in a big four accounting firm.
A cross-border data transfer occurs when personal data moves from the EEA to a third country outside it, including EU states plus Iceland, Liechtenstein, Norway. Triggers include using US SaaS like Google Workspace, outsourcing to India, or UK parent companies. Applies to controllers and processors, even via cloud without conscious sending.
What is an adequacy decision?
An adequacy decision by the European Commission allows free data flows to third countries with equivalent GDPR protection, such as UK, Japan, Switzerland, US under Data Privacy Framework. Status must be monitored as revocations occur, like Privacy Shield in 2020.
What are Standard Contractual Clauses (SCCs)?
SCCs are pre-approved European Commission contract terms for transfers without adequacy. 2021 version has four modules for controller-to-controller, controller-to-processor, etc. Annexes detail data categories, purposes, security. Require Transfer Impact Assessment for non-adequate countries.
When is a Transfer Impact Assessment (TIA) required?
A TIA is needed for SCC-based transfers to countries without adequacy. It assesses destination country laws, identifies supplementary measures per EDPB six steps: map transfers, evaluate laws, implement measures, re-evaluate. Irish DPC fined TikTok €530M for inadequate TIA to China.
How can businesses ensure compliance with data transfers?
Map all international data flows including SaaS and processors, identify mechanisms like adequacy or SCCs, conduct TIAs, complete annexes, maintain a transfer register. Review annually or on changes. SCCs with TIA suit most Irish SMEs.
