Transfer impact assessment: what a TIA is and when you need one

By the HRPricing editorial teamReviewed October 18, 2026How we research and score

A transfer impact assessment (TIA) is a documented check, made before personal data leaves the EU or UK, of whether the destination country's laws let the recipient honor the safeguards in the transfer contract, usually the standard contractual clauses. If you hire or pay people in Europe through a US payroll or EOR platform, their HR data is a transfer, and the provider should be able to show you its assessment.

A transfer impact assessment (TIA) is an exporter's documented assessment of whether personal data sent to a non-EU country under a transfer tool such as the standard contractual clauses will get protection essentially equivalent to the GDPR.

On this page
  1. Why TIAs exist
  2. An example: three employees in Germany through an EOR
  3. What to ask an EOR or payroll provider
  4. TIA vs SCC vs DPIA

Why TIAs exist

The Court of Justice's Schrems II judgment (2020) held that signing standard contractual clauses is not enough on its own: the exporter must check whether the law in the destination country undermines them. The European Commission adopted modernized SCCs on June 4, 2021 (Implementing Decision 2021/914). The UK ICO, for its own regime, added guidance on transfer risk assessments, the UK name for the same exercise.

The EDPB's Recommendations 01/2020 on measures that supplement transfer tools set out the steps most TIAs follow: map the transfers, identify the transfer tool, assess the destination's law and practice, add supplementary measures where needed, take any formal steps, and re-evaluate at intervals. "DTIA" (data transfer impact assessment) means the same thing.

An example: three employees in Germany through an EOR

You hire three people in Germany through an employer of record whose platform runs in the US. Each payroll record carries salary (say EUR 35,000), tax ID, bank details and health insurance fund. Data held by the EOR's German entity is not a transfer. When the same records are viewable from US dashboards or processed on US servers, they are. That US leg is what the TIA covers, along with any subprocessors in other countries.

Costs for the hire itself are on the Germany EOR page.

What to ask an EOR or payroll provider

  1. Which SCC module, or UK IDTA or Addendum, covers my employees' data?
  2. Can I see your TIA, or a summary, for the US and every subprocessor country?
  3. What supplementary measures apply, such as encryption and access controls?
  4. How often do you re-check it, and will you tell me if a subprocessor changes?

Vendors differ on how much they share. Compare providers in the best EOR providers and see how Deel and Remote describe their entities.

TIA vs SCC vs DPIA

  • SCCs: the contract that makes a transfer lawful.
  • TIA: the check that the contract can work in the destination country.
  • DPIA: a data protection impact assessment of a risky processing activity, whether or not data leaves the EU.

For running your own payroll in several countries, see EOR vs global payroll.

Frequently asked questions

What is a transfer impact assessment?
It is a documented check, before data is sent outside the EU or UK, of whether the destination country's laws let the recipient comply with the transfer safeguards, usually the standard contractual clauses.
What are the EDPB recommendations on transfer impact assessments?
The EDPB's Recommendations 01/2020 on measures that supplement transfer tools describe a step-by-step roadmap: know your transfers, identify the transfer tool, assess the destination's law, add supplementary measures, take procedural steps and re-evaluate.
What does DTIA mean?
DTIA stands for data transfer impact assessment. It is another name for a transfer impact assessment.
Is a TIA required when using SCCs?
Since the Schrems II judgment, exporters relying on SCCs are expected to assess the destination country's law before transferring. The UK ICO calls its version a transfer risk assessment.
Who carries out the TIA, the exporter or the importer?
The exporter is responsible, but it usually relies on information from the importer, such as an EOR or payroll vendor, about local law, government access requests and safeguards.
Sources (2)
  1. European Commission: Standard contractual clauses (SCC) (checked Oct 18, 2026)
  2. Information Commissioner’s Office (UK): International data transfer agreement and guidance (checked Oct 18, 2026)

This page is general information, not tax, legal or accounting advice. Rules and rates change, so check the official source linked above before you file or sign a contract. Read our disclaimer.