How to suspend or end a data transfer: a runbook for engineers

The EDPB's roadmap says exporters should have mechanisms to promptly suspend or end a transfer if the importer cannot honour its commitments or supplementary measures stop being effective. A runbook with a named owner, a switch you can flip and a tested fallback turns that sentence into something you can actually do.

When you would need it

The Board names two triggers: the importer has breached or cannot honour the commitments in the Article 46 tool, or the supplementary measures are no longer effective in that country. A court ruling that removes a framework you rely on is a third kind of event worth planning for. See what happens if the EU US framework is struck down.

Build the switch before you need it

For each flow in your transfer map, decide in advance:

1. The owner who may order a pause, and the backup.
2. The mechanism: a feature flag, a routing rule, a revoked credential or a disabled integration.
3. What happens to the data in flight: queue, drop or store locally.
4. The fallback: another vendor, another region, or the feature switched off.
5. The user impact and who tells support.

Feature flags suit flows inside your own code. For a vendor integration, revoking the API key is often the fastest and most certain switch.

The runbook

1. Confirm the trigger and record the time and source.
2. Notify the privacy lead and the vendor owner.
3. Flip the switch and check that traffic stopped, using logs from your side, not the vendor's word.
4. Ask the vendor in writing to stop processing and to confirm return or deletion of data already sent, as your contract allows.
5. Record what was sent, when, and what remains with the importer.
6. Decide the path forward with counsel: new tool, new measures, or permanent exit.
7. Update the transfer map and the review date.

Test it

Run a drill on a low risk vendor once. You will find hidden callers, cached copies and batch jobs that ignore the flag. Quarterly backup restore drills are a useful model for how often and how formally to do it.

What the contract should say

Check your agreements for the right to suspend, deadlines for deletion on termination, and a duty on the importer to tell you if it can no longer comply. A contract that gives you none of these makes steps three and four harder than they should be.

Try it yourself

Click through it at your own pace, or open it full screen.

Watch how a change after an initial check triggers a new alert. Transfer reviews need the same habit: recheck on a schedule and when something changes.

Quick check

Sources

• EDPB Recommendations 01/2020, Step 6

This is educational content, not legal advice.

Last reviewed: 19 October 2026.