EDPB Recommendations on supplementary measures

Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data

The recommendations focus on the requirements for transferring personal data to third countries under GDPR, in response to the CJEU's Schrems II judgment. The document includes six steps for data exporters: mapping data transfers, verifying transfer mechanisms, assessing third-country laws, identifying supplementary measures, fulfilling procedural steps, and ongoing re-evaluation of data protection levels. The document includes an annex with examples of effective and non-effective supplementary measures (technical, organizational and contractual) applied to specific scenarios.