Standard Contractual Clauses and the transfer impact assessment

Transfers of personal data out of the EEA are restricted. Without an adequacy decision for India, they typically rely on Standard Contractual Clauses, accompanied by an assessment of whether the law and practice in the destination country undermine the protection those clauses promise. Note the direction of the presumption: under the GDPR a transfer is prohibited until something permits it, which is the reverse of India’s own rule for data leaving.

Practically, your customer sends you a questionnaire. The useful thing is to answer it precisely: where the data physically sits, which of your staff can access it and from where, under what legal circumstances a third party could compel disclosure, and what technical measures — encryption, key custody, access controls, pseudonymisation — reduce that exposure.

Answer it once, accurately, and keep the answers. The same questions arrive from every European customer, and the firms that answer precisely move through procurement noticeably faster than the ones improvising each time.