Transfer Impact Assessment: Subprocessor Leaves the EEA

A transfer impact assessment is the homework that starts when personal data will leave the EEA under a contractual safeguard, especially after a vendor adds or relocates a subprocessor outside Europe. This post is the operational sequence for the day the notice lands, not a restatement of every Chapter V theory.

For how standard contractual clauses and the EU–US Data Privacy Framework differ as tools, use our guide on standard contractual clauses versus the Data Privacy Framework. Here we stay on triggers, clocks and the file you should open before the objection window in your DPA closes.

When a subprocessor location change triggers a transfer impact assessment

Under the GDPR, transfers of personal data to a third country need a Chapter V mechanism: an adequacy decision (Article 45), an appropriate safeguard such as standard contractual clauses (Article 46(2)(c)), or another listed tool. The Schrems II judgment (Case C-311/18, 16 July 2020) made clear that SCCs alone are not a rubber stamp: the parties must assess whether the destination country’s law and practice let the importer honour the clauses, and add supplementary measures where they cannot. The EDPB Recommendations 01/2020 on measures that supplement transfer tools are the primary practical source for that supplementary-measures analysis.

That assessment is what practitioners call a TIA (sometimes a transfer risk assessment). It is not a separate statute. It is the documented Clause 14 assessment in the 2021 SCCs (Clause 14(b) lists the factors), applied to a real destination and a real processing.

A usable trigger for SaaS teams is narrower and louder than “we might transfer someday”:

• A vendor’s subprocessor list adds an entity whose location is outside the EEA, or adds a new non-EEA location to an existing entity.
• A vendor moves processing for your product from an EU region to a US or other third-country region.
• A thin location (“global”, “various”, “closest data centre”) appears where you previously had a country you had assessed.

Additions inside the EEA, or to a country with a current adequacy decision for the data you send, are different work. They may still need Article 28 review and ROPA updates. They are not the same transfer homework.

What the notice usually gives you (and what it withholds)

Most SaaS data processing agreements promise advance notice before a new subprocessor processes your data, plus a short window to object on data-protection grounds. The email or portal update is your clock. It is rarely your full fact pack. Use the period stated in your DPA (often around 30 days’ advance notice, or an objection window measured from notification); do not invent a shorter internal deadline that the contract does not set.

Typical notice content: entity name, a one-line purpose, a country or region, and a link to the updated list. Typical gaps: categories of personal data, whether the new location is for all products or one feature, whether the vendor already has SCCs or Data Privacy Framework coverage with that subprocessor, and whether supplementary measures apply.

You still have to assemble the assessment from the list row, the DPA’s transfer clause, and any AI or product schedule that explains what content can reach the new party. For why list rows must carry name, purpose and location in the first place, see what a subprocessor is and our post on reading a subprocessor list for gaps.

Dated examples of outside-EEA destinations on live lists

Current list rows, extracted 25 September 2026, already place processing outside the EEA. Treat them as the kind of destination a notice would force you to assess.

On Atlassian’s list, OpenAI, L.L.C. appears for generative AI features and support, location USA, against customer personal data in applicable cloud products or shared in support. AWS Bedrock and Google Vertex AI appear for intelligence features with multi-region footprints that include the United States. Cloudflare’s location text describes global processing at the nearest data centre: accurate for a CDN, awkward for a country-level transfer file.

Several SaaS vendors name OpenAI with a United States location (and Zoom also naming the EU); see our OpenAI subprocessors list roundup and the live OpenAI company page. If your stack already concentrates on that provider, a new US-located AI subprocessor on another vendor is not an isolated ticket; it is another path into a destination you should already have assessed once and may need to refresh.

Where location is not stated on the row (for example Deepgram’s OpenAI entry in that same dated extract), you cannot finish the assessment from the list alone. Ask the vendor for the country or region before you sign off.

The file to open when the notice lands

Your transfer impact assessment file should exist before the objection window in the DPA closes. Work in this order. Stop when a step fails; do not jump to “accept with residual risk” until the facts are written down.

1. Capture the artefact. Save the notice, the prior list version if you have it, and the current list URL. Note the objection or notice deadline from the DPA in your calendar with an owner.
2. Map products in scope. Confirm which of your order forms and regions the new subprocessor actually touches. A Twilio-style “specific products and services” purpose, or an Atlassian “Applicable Cloud Products” bound, can shrink or expand the transfer.
3. Read the destination. Country or region on the row; whether the entity is the vendor’s affiliate or a third party; whether the purpose is hosting, support, payments or generative AI (AI purposes change what content may leave).
4. Read the transfer tool in the DPA. SCCs (which module), the EU–US Data Privacy Framework for certified US organisations, binding corporate rules, or adequacy for the destination. Check whether the DPA says the vendor flows the same tool down to subprocessors.
5. Draft the assessment. For SCC destinations, address the Clause 14 factors: what is transferred, who imports it, what public-authority access laws apply, whether the importer can in practice honour the clauses, and which supplementary measures (encryption, pseudonymisation, access controls, split processing) apply, following EDPB Recommendations 01/2020. For a transfer to an organisation certified under the Data Privacy Framework, no transfer impact assessment is required for that transfer; what you record is the certification check (entity, covered data, status) plus the fallback language if the framework fell away.
6. Decide and record. Accept, object, disable the feature, renegotiate, or exit. Store the decision next to the notice. Update the record of processing activities and any customer-facing disclosures that name recipients or transfer tools.

If the DPA’s objection window is shorter than your legal review cycle, escalate on day one rather than waiting for the last days of the stated period.

Re-use the method, not a generic US file

Do not paste a generic US TIA into every ticket. A payments subprocessor in the United States, a support desk in the Philippines and a model provider processing ticket text are three assessments that share a method and diverge on facts. Re-use the method; refresh the facts when the list changes. The learn guide on SCCs versus the DPF compares the tools; this worksheet applies them to one subprocessor, one location and one data set.

The one check worth making this week

Pick one live vendor whose list already shows a non-EEA location for a subprocessor that touches personal data you care about. Without waiting for a new notice, run a transfer impact assessment (steps 3 to 6 above) on that row and file the result. The next time an email says “we are adding a subprocessor in …”, you will only be updating a known template instead of inventing the process inside the DPA’s stated notice or objection period.

ClauseTrail monitors vendor subprocessor lists and DPAs so location and transfer-wording changes surface when they publish. See vendors that already name OpenAI as a subprocessor and pricing.

Frequently Asked Questions

What is a transfer impact assessment?

A transfer impact assessment is the documented analysis, before or when personal data is sent to a third country under a safeguard such as standard contractual clauses, of whether the destination’s law and practice allow the importer to honour that safeguard, and which supplementary measures are needed if not. Practitioners use it to meet the Schrems II and Clause 14 expectations in real vendor reviews.

Does every new non-EEA subprocessor require a full transfer impact assessment?

If the destination is covered by a valid adequacy decision for the data you send, including a transfer to a Data Privacy Framework-certified US organisation, the Chapter V analysis differs from an SCC case and no TIA is required for that transfer. If you rely on SCCs (or similar safeguards) for that destination, you need an assessment tied to that importer and processing. Thin or missing locations on the list mean you cannot finish until the vendor states where processing happens.

How fast must we act after a subprocessor notice?

Follow the notice and objection period in your data processing agreement, often around 30 days. Start the transfer impact assessment as soon as the notice arrives; waiting until the last days leaves no room to object, disable a feature or escalate.

Is the EU–US Data Privacy Framework a substitute for a transfer impact assessment?

The Data Privacy Framework adequacy decision can be the Chapter V mechanism for transfers to certified US organisations. For those transfers, no transfer impact assessment is required. You should still verify certification, scope of data and fallback language in the DPA, and record that check.

What if the vendor only says the subprocessor operates “globally”?

Treat “global”, “various” or “nearest data centre” as incomplete for transfer decisions. Ask for countries or regions relevant to your data, or accept the opacity with a recorded risk decision. You cannot honestly complete a transfer impact assessment against an unnamed destination.