DPA, SCCs and TIA: which transfer documents do you need?

RGPD Conseil Maroc · Updated 6 October 2026

A DPA describes the processing relationship, SCCs can provide a mechanism for certain international transfers, and a TIA examines the transfer context and safeguards. These documents answer different questions. Their necessity and interaction depend on roles, countries, recipients and the chosen mechanism.

Start with the flow before choosing documents

List exporter, importer, service, data categories and access. Include downstream providers and intended duration. A commercial title does not define a legal role. An annotated diagram supports document selection and avoids signing appendices describing a different service from the one actually used.

Match appendices to the service

Check instructions, contacts, measures, retention and deletion arrangements. Appendices should not remain blank or repeat an unverified catalogue of controls. Assign responsibility for missing information. Technical details should be confirmed by the relevant team before signature.

Preserve the assessment rationale

A transfer impact assessment should make the decision, supporting information and limitations understandable. Avoid copying a general country conclusion without examining the service. Describe supplementary measures operationally. Prepare a list of changes that would trigger another review.

Coordinate follow-up

Retain signed versions, approvals and action owners. New subprocessors, access arrangements or features should feed into change management. RCM can review documentary consistency and organise actions; complex legal negotiations and specialist technical testing require separately defined work with appropriate professionals.

Illustrative example: a supplier receives a DPA and SCCs for signature but the appendices name no hosting provider. The priority is to complete and reconcile the facts before signing. Adding more documents without describing the flow does not resolve the gap.

Your starting dossier

• Exporter–importer diagram
• Roles and mechanism assessment
• Completed, verified appendices
• Decision, measures and review triggers

Describe the situation without submitting customer records, passwords or confidential documents in the initial form.

Practical questions

What should I prepare before contacting RCM?

Prepare: Exporter–importer diagram; Roles and mechanism assessment; Completed, verified appendices; Decision, measures and review triggers. Include your deadline and unresolved decisions. A summary is enough for the initial conversation.

Does an introductory call replace the engagement?

No. The introductory conversation clarifies your requirements. A proposal then defines documents reviewed, deliverables, responsibilities and price before work starts. Customer or regulator decisions are not guaranteed.

Continue preparing

European client GDPR requirements: documents for Moroccan suppliers

Prepare GDPR contracts, data-flow records and supporting evidence when a European customer reviews your Moroccan company. Practical supplier checklist.

Read the guide

GDPR vendor questionnaire: prepare answers and supporting evidence

Answer GDPR vendor questionnaires with evidence on roles, contracts, hosting, access and corrective actions. A practical guide for suppliers and buyers.

Read the guide

EU hosting with overseas support: GDPR access checks

EU servers and overseas teams? Map support access, exports, providers and legal entities before assessing GDPR international transfers.

Read the guide

Keep reading

• Call centre GDPR audit: prepare your Moroccan BPO for a client review
• When is a DPIA required?
• EU hosting with overseas support: GDPR access checks
• European client GDPR requirements: documents for Moroccan suppliers