Template for assessing a transfer of data abroad (TIA)
- Art. 16-17 FADP
- Art. 44-49 GDPR
- About 45 minutes
- Italiano · Deutsch · Français · English
In brief
The worksheet by which you assess a transfer of data to a country without adequate protection: on what basis it takes place, what the law of the country provides and which measures you add. You need it before entrusting data to a recipient in such a country.
- Who it is for
- Internal use: the internal contact and management. It is kept with the supplier's contract and shown to the authority on request.
- To decide first
- Who receives the data and in which country; then you describe the transfer, its basis (for example standard clauses), the risks of the country and the supplementary measures.
- Afterwards
- Have it approved, link it to the vendor concerned and repeat it if the supplier, the data or the situation in the country changes.
What it contains
- 1When to use this worksheet
- 2Description of the transfer
- 3Necessity of the transfer
- 4Basis of the transfer
- 5Law and practice of the country of destination
- 6Supplementary measures
- 7Residual risk
- 8Conclusion
- 9Review
- 10Approval
An excerpt
1. When to use this worksheet
A worksheet is completed for every transfer of personal data to a country that does not guarantee adequate protection, before the transfer begins. Remote access to the data from that country (for example for technical support) and storage with a cloud provider that processes the data abroad also count as a transfer.
For Switzerland, disclosure abroad is governed by Art. 16-17 FADP. The countries with adequate protection are listed in Annex 1 to the Data Protection Ordinance.
For the European Union, transfers to a third country are governed by Art. 44-49 GDPR. The countries with adequate protection are those covered by an adequacy decision of the European Commission; Switzerland is one of them.
The full text is generated on the platform, with your organisation's details already in place.
FADP and GDPR compared
| FADP (Switzerland) | GDPR (EU) | |
|---|---|---|
| Adequate countries | List of the Federal Council (Annex 1 Data Protection Ordinance) | Adequacy decisions of the Commission (Art. 45 GDPR) |
| Without adequacy | Appropriate safeguards, such as standard data protection clauses recognised by the FDPIC (Art. 16 para. 2 FADP) | Appropriate safeguards, such as standard contractual clauses (Art. 46 GDPR) |
| Derogations | Art. 17 FADP, for example explicit consent or performance of a contract | Art. 49 GDPR, interpreted restrictively |
The template adapts itself: it picks the paragraphs by the laws that apply to your organisation.
Related templates
- Template for notifying data subjects of a data security breach
- Data processing agreement template (Art. 9 FADP, Art. 28 GDPR)
- Internal form template for reporting a data security breach
Related question: Can I use vendors with servers in the United States or the EU?
A template is general information, not advice on your case: it must be adapted to your organisation. For a question on your case there is Advisorn's consulting. By Advisorn, updated on 20 October 2026.