Cabo Advisory

← Insights··Updated

Transfer Impact Assessments in 2026: Between Paranoia and Paper Exercise

Six years after Schrems II invented the Transfer Impact Assessment, most organizations still treat it as either an impossible demand or a template to be signed and filed. TikTok's €530 million lesson — confirmed on appeal in June 2026 — shows regulators expect something in between: an assessment that is honest about risk without pretending to eliminate it.

Where the TIA came from, and why it never went away

When the CJEU struck down Privacy Shield in Schrems II (2020), it left standard contractual clauses standing — but on a condition that changed everything: exporters relying on Article 46 safeguards must verify, case by case, whether the law and practice of the destination country undermine those safeguards, and add supplementary measures where they do. The EDPB's Recommendations 01/2020 turned that condition into the now-familiar six-step exercise: map your transfers, identify your tools, assess third-country law and practice, adopt supplementary measures, take the procedural steps, and re-evaluate at appropriate intervals. The Transfer Impact Assessment was born — and with it, a persistent temptation to treat it as paperwork.

The enforcement record since has steadily raised the price of that temptation. Meta's €1.2 billion fine in 2023 established that transfer failures attract the largest penalties in GDPR history. The Dutch authority's €290 million Uber decision showed that transfers made with no valid mechanism at all still happen at major companies. And then came TikTok.

TikTok: the anatomy of a failed assessment

In May 2025, the Irish Data Protection Commission fined TikTok €530 million over transfers of EEA user data to China — €485 million for infringing Article 46(1) and €45 million for transparency failures under Article 13(1)(f) — with an order to bring processing into compliance within six months. In June 2026, the Irish High Court upheld the substantive findings and the €530 million fine, while directing the DPC to reconsider its suspension order and referring questions on fining methodology to the Court of Justice of the EU. The liability analysis, in other words, now carries judicial endorsement. Three lessons stand out.

Remote access is a transfer. TikTok's EEA user data was stored in Singapore and the United States — not in China. The infringement arose because staff in China could remotely access it. The physical location of servers was irrelevant: when an employee in a third country views or processes EEA personal data, Chapter V is engaged. Every organization with development, support, or administration teams outside the EEA should re-read its data map with that sentence in mind, because a "no transfers" conclusion based on server geography is now indefensible.

Your own analysis can convict you. The DPC found that TikTok's documentation itself identified Chinese anti-terrorism, counter-espionage and related laws as materially diverging from EU standards — and that TikTok then failed to assess the impact of those laws or adopt measures answering them. In the regulator's formulation, the company "failed to verify, guarantee and demonstrate" essentially equivalent protection. A TIA that spots the problem and stops there is worse than none: it is documentary evidence that the exporter knew.

Transparency about transfers is part of the same package. €45 million of the fine attached to a privacy policy that neither named the third countries involved nor explained the nature of the processing that constituted the transfer. That thread runs directly into 2026: the EDPB's coordinated enforcement action this year — with 25 authorities participating — targets transparency and information obligations under Articles 12–14, which include precisely the Article 13(1)(f) disclosures about third-country transfers. Even organizations confident in their transfer mechanics should expect their descriptions of those transfers to be read closely.

The other ditch: paranoia

If the paper-exercise TIA is one failure mode, the opposite ditch is just as real. Freshfields' 2026 analysis captures the point: exporters should not adopt an unworkable strategy of trying to exclude every hypothetical risk of governmental access from the assessment. The GDPR standard is essential equivalence, not perfection; the TIA asks whether problematic laws are relevant to this transfer in practice — the data categories, the importer's exposure to the relevant regimes, the realistic likelihood of access requests, documented past practice — and whether supplementary measures (strong encryption with keys held in the EEA, pseudonymization, split processing, organizational access controls) close the gap that remains. An assessment that concludes "risk exists somewhere, therefore nothing may flow" is not rigor; it is the abdication of the judgment the exercise exists to record. The defensible middle is a documented, risk-based, specific analysis that reaches a conclusion and shows its work.

2026's special problem: reassessing the United States

Step six of the EDPB roadmap — re-evaluate at appropriate intervals — has just become the hard part. The DPF remains valid, but Trump v. Slaughter (29 June 2026) dissolved the FTC's statutory independence, the EDPB has asked the Commission to reassess the framework, and the Latombe appeal is pending before the CJEU (the companion post in this series unpacks that fragility). Critically, noyb's argument reaches beyond DPF-certified transfers: SCCs and BCRs to the US rest on the same underlying assessment of US law, so the standard fallback does not exempt anyone from the analysis — it relocates it into the TIA. A US transfer assessment written in 2023 and untouched since is, today, a stale document about a different legal system. The pragmatic response is not to suspend US transfers; it is to refresh the assessment now: record the Slaughter development and the redress mechanism's current state, distinguish which safeguards in your analysis depend on FTC enforcement versus the signals-intelligence framework, and define in advance the trigger events (Commission action, CJEU ruling, executive-order changes) that would prompt escalation. A TIA with a documented monitoring trigger list is the cheapest insurance available in this market.

Making the exercise real

A TIA that would survive the TikTok test tends to have five properties. It is built on an actual data map, including remote-access paths and vendor subprocessor chains, not on contract schedules. It engages specifically with the destination country's access laws rather than reciting them. It matches supplementary measures to the identified risks and is honest where measures cannot help (data accessed in the clear by design cannot be saved by encryption at rest). It reaches a reasoned conclusion a regulator could disagree with but not dismiss. And it has a review clause that has actually fired at least once. Worth noting, too, that the toolbox is growing: in April 2026 the EDPB approved Europrivacy as the first certification mechanism usable for international transfers under Article 46 — a sign that, even amid the turbulence, the machinery of Chapter V keeps being built out rather than abandoned.

Between paranoia and paper exercise lies something regulators have now described, fined against, and had confirmed in court: an assessment that verifies, guarantees, and demonstrates. Two of those three verbs are about doing the work. The third is about being able to prove it.

Sources and further reading

This post is general commentary, not legal advice. Specific transactions or transfers should be reviewed by qualified counsel in the relevant jurisdictions.