The European Data Protection Board gives exporters a six step roadmap: know your transfers, identify your transfer tools, assess whether the tool is effective, adopt supplementary measures if needed, take procedural steps, and re-evaluate at intervals. Steps one and six are where engineering teams do most of the work.
Step 1: Know your transfers
You cannot assess what you have not mapped. The EDPB says this mapping can be complex when you use many processors and sub-processors, and that you can build on your Article 30 records of processing. It also tells you to include onward transfers, for example a processor passing data to a sub-processor in another country.
Two details catch engineering teams out. Remote access from a third country, for example for support, counts as a transfer. So does storage in a cloud outside the EEA. The Board adds that if you use an international cloud, you must check whether data will reach third countries and where, unless the provider is established in the EEA and its contract clearly says data will not be processed in third countries at all.
Step 2: Identify the transfer tools
For each transfer, name the Chapter V basis: an adequacy decision, an Article 46 tool such as standard contractual clauses or binding corporate rules, or a derogation under Article 49. If you rely on an adequacy decision, the roadmap says you can stop there for that transfer. If you rely on a derogation, you also skip step three. Everything else continues.
Step 3: Assess whether the tool is effective
Here you check whether the law or practice of the destination country undermines the safeguards in your Article 46 tool, in the context of your transfer. This is a legal assessment, usually done with counsel and the importer's help. Engineers supply the facts: what data, which fields, in what format, who can access it, and for how long.
Step 4: Adopt supplementary measures
If the tool alone is not effective, you look for supplementary measures. They can be contractual, technical or organisational. The EDPB states that contractual and organisational measures alone will generally not overcome access by public authorities under problematic legislation. Technical measures are often the deciding factor. See encryption as a supplementary measure for the cases the Board describes.
Step 5: Procedural steps
If you found effective supplementary measures, there may be procedural steps, such as consulting a supervisory authority in certain cases. The roadmap lays these out by transfer tool, so read the relevant part of the document for your tool.
Step 6: Re-evaluate
The Board says you must monitor developments in the destination country and have mechanisms to suspend or end transfers promptly if the importer cannot honour its commitments or the supplementary measures stop being effective. Accountability is continuing. A transfer that was fine in January needs a dated review.
What to hand over at each step
- Step 1: a data flow map with vendor, country, data categories and support access paths.
- Step 2: the mechanism per flow and the date it was last verified.
- Step 3 and 4: technical facts on encryption, key custody and field level minimisation.
- Step 6: a runbook to pause a flow. See how to suspend or end a transfer.
Safeguard's asset discovery and SBOM scanning can help you find which services and third party components exist in your estate, which feeds step one. You can try a free scan at gold.safeguard.sh/scan.
Quick check
Is the roadmap law?
It is guidance from the EDPB, the body of EU data protection regulators. It explains how they read Chapter V of the GDPR. The legal duties come from the regulation and court rulings.
Does an adequacy decision remove the need for steps three to five?
According to the roadmap, if the destination is covered by an adequacy decision for your transfer, you can continue without further transfer tool steps, while still monitoring that the decision stays in force.
Sources
This is educational content, not legal advice.
Last reviewed: 19 October 2026.
