The CJEU judgment in Schrems II not only struck down the EU-US Privacy Shield, it also cast doubt on the future of data exports to the US and to other third countries which do not provide an adequate level of protection for the data. Debbie Heywood looks at the final guidance on supplementary measures, which may help allow transfer tools to ensure personal data transferred to third countries is adequately protected. She discusses the importance and role of supplementary measures and also addresses six steps from the EDPB to assess and mitigate risks associated with third-country transfers.
