On October 9, 2026, the Belgian Data Protection Authority (APD) issued a decision (available in French here) finding that a data exporter’s failure to conduct a Transfer Impact Assessment (TIA) rendered its EU Standard Contractual Clauses (SCCs) invalid. For companies sending personal data outside the EU, the message is clear: signing SCCs is only the first step. Without a TIA, a transfer of EU personal data to the U.S. may lack a valid transfer mechanism, and a vendor’s security measures will not fill the gap.
What Happened
In 2021, an individual applying for a government job filed a complaint with the APD after interviewing with Belgian public service agencies via Microsoft Teams. The complainant alleged that, by using Teams, the agencies had transferred the complainant’s personal data to the U.S. in breach of the GDPR’s rules on international data transfers.
The Agencies’ Defense
The agencies raised several defenses. First, they argued that the data processed through Teams was not “personal data” under the GDPR and that no processing had ultimately occurred because the meetings were not recorded. Second, they asserted that, even if transfers had occurred, they had signed SCCs with Microsoft, and any transfers posed a low risk given their temporary nature and the security measures Microsoft had implemented for Teams.
On that basis, the agencies did not consider it necessary to conduct either a data protection impact assessment (DPIA), which is a GDPR risk assessment for certain processing, before using Teams for interviews, or a TIA for the transfer of candidates’ personal data to the U.S. They also pointed to regulatory uncertainty at the time: the events took place between the July 2020 Schrems II judgment of the Court of Justice of the European Union (CJEU), the EU’s top court, and the 2021 recommendations on supplementary measures for data transfers issued by the European Data Protection Board (EDPB), the body of EU data protection regulators.
What the APD Decided
The data was personal data, and a transfer occurred. The APD confirmed that the data processed through Teams, including audio, video, and IP addresses, was personal data. It then found a transfer to a recipient outside the EU: the agencies, as data exporters, had made personal data available to Microsoft, a data importer and processor established outside the EU.
SCCs require a TIA. The APD addressed the GDPR’s hierarchy of transfer mechanisms. In plain terms, where no adequacy decision applies, organizations relying on “appropriate safeguards,” such as SCCs, must assess the level of data protection in the importer’s country before the transfer takes place. That assessment, the TIA, must take into account the concerns the CJEU identified in Schrems II and should follow the process in the EDPB’s 2021 recommendations.
No TIA means no valid SCCs. Crucially, the APD concluded that the agencies’ failure to conduct a TIA rendered their SCCs invalid. As a result, the transfers of personal data to the U.S. through Teams in 2020 and 2021 lacked an adequate transfer mechanism.
Vendor security measures are not a substitute. Relying solely on the security measures offered by Microsoft, as the agencies’ data importer and processor, was insufficient and could not substitute for a TIA. Responsibility for the TIA remained with the agencies as data controllers.
Why This Matters
The decision highlights the significant compliance challenges of transferring EU personal data outside the EU, particularly to the U.S. Its central lesson is that organizations relying on SCCs must conduct a TIA. Signing SCCs without the required TIA is not merely a documentation deficiency: it renders the SCCs invalid, leaves the transfer without an adequate transfer mechanism, and may expose the data exporter to significant GDPR enforcement risk.
The APD also confirmed that no TIA is required where personal data is transferred to the U.S. under the European Commission’s EU-U.S. adequacy decision and the U.S. recipient is certified under the DPF, so that the transfer falls within the scope of that decision. In that case, the adequacy decision itself provides the basis for the transfer (without the need to conduct a TIA).
What to Do Now
- Map your SCC-based transfers. Identify every flow of EU personal data to the U.S. or other non-EU countries that relies on SCCs, including flows through collaboration and videoconferencing tools such as Teams.
- Confirm a TIA exists for each one (and that it came first). The assessment must be completed before the transfer takes place. Check that each TIA takes into account the concerns identified in Schrems II and follows the EDPB’s 2021 recommendations.
- Do not rely solely on vendor security documentation. A vendor’s security measures alone cannot substitute for a TIA. If your organization is the controller, the TIA is your responsibility.
- Check DPF certification. Where a U.S. recipient is certified under the DPF and the transfer falls within the scope of the EU-U.S. adequacy decision, a TIA is not required. Confirm the certification status and scope for key U.S. vendors and affiliates.
- If you are the data importer outside of the EU, be ready to support your EU counterparts. Because the TIA obligation sits with the EU exporter, expect EU customers and affiliates to request information to support their assessments.
If your organization needs help navigating EU data transfer requirements, Alston & Bird’s Privacy, Cyber & Data Strategy team can help.
