Transfer impact assessments: what SaaS vendors give you

If you transfer personal data out of the EEA under the Standard Contractual Clauses, you have to assess whether the destination country's laws let them work, and document it. Vendors know their own data flows and the requests they receive; some publish what they know. Here is what each of 160 vendors gives you, from its own pages.

"None found" means our search of the vendor's own sites found nothing, not that the vendor has nothing: many keep such documents in a trust centre behind a login. Two vendors appear in search with a TIA we could not read on 20 October 2026, so they are counted as none found until we can: Adobe's server refused our crawler, and Salesforce's robots.txt disallows the folder its transfer risk assessment is in. Of 18 dated documents, 6 predate the Data Privacy Framework adequacy decision of 10 July 2023.

Vendor by vendor

Laws named in the 33 assessments and transfer papers: FISA Section 702 in 14, Executive Order 12333 in 13, Executive Order 14086 in 4, the CLOUD Act in 5. Counted only where the document names the law; a document can address a law without naming it.

What a transfer impact assessment is

After the Court of Justice struck down the Privacy Shield in Schrems II (C-311/18, July 2020), the EDPB set out how an exporter checks that a transfer tool holds up in the destination country. Its Recommendations 01/2020 (version 2.0, adopted 18 June 2021) give six steps:

1. Know your transfers, including onward transfers by the vendor's own subprocessors.
2. Identify the transfer tool you rely on: an adequacy decision, the SCCs, binding corporate rules.
3. Assess whether that Article 46 tool is effective, given the destination's law and practice on access by public authorities, "where appropriate in collaboration with the importer".
4. Adopt supplementary measures where it is not: technical (such as encryption with keys held in the EEA), contractual or organisational.
5. Take any procedural steps those measures need.
6. Re-evaluate at appropriate intervals.

Step 3 is where the vendor's documents help: it knows where its subprocessors sit, which of its services fall under laws such as FISA Section 702, and how many requests it has received. Clause 14 of the 2021 Standard Contractual Clauses makes both parties warrant they have no reason to believe local law prevents compliance, and requires the assessment to be documented and made available to the supervisory authority on request.

Since the adequacy decision for the EU-U.S. Data Privacy Framework (10 July 2023), transfers to a certified US company can rely on adequacy instead, and need no SCCs or assessment. Which vendors are certified is on the Data Privacy Framework page, checked weekly against the official list.

Questions

What is a transfer impact assessment?

A documented check, made by the data exporter, that the safeguards of an Article 46 GDPR transfer tool such as the Standard Contractual Clauses work in practice in the destination country, given its laws on public-authority access. The EDPB sets out six steps in Recommendations 01/2020; Clause 14 of the 2021 SCCs requires the parties to document the assessment and make it available to the supervisory authority on request.

Do I need a TIA for a US vendor on the Data Privacy Framework list?

Not for transfers made under the adequacy decision of 10 July 2023 to a company certified under the EU-U.S. Data Privacy Framework: an adequacy decision is not an Article 46 tool. Transfers made under SCCs, to an uncertified recipient or onward to another country, still need one.

Which SaaS vendors publish a transfer impact assessment?

Of 160 vendors in this registry, 26 publish a document meant to support a customer's assessment, and 5 offer one on request. The table lists each, with its date and the laws it addresses.

Download the data (CSV): every row with its source and the date it was read.Cite as: eucsoft, “Transfer impact assessment documents published by SaaS vendors”, https://eucsoft.com/en/transfer-impact-assessments/, data read up to 2026-10-20.

How this was read

Documents were found by searching each vendor's own sites on 20 October 2026, and read by the registry's crawler, which obeys robots.txt. Each row was extracted with its title quoted from the document; a law is listed only where the document names it, and a person reviewed every row before publication. The DPA column is the registry's reading of each data processing agreement. Documents are re-read weekly. Full method on the methodology page.