feat: Adequacy decisions, DPF check, customer guidance for transfers
New: adequacy-decisions.ts - Complete list of 15 countries with EU adequacy decisions (Art. 45) - EU/EEA country set (30 countries) - getTransferRequirement() — determines SCC/TIA/certification needs per country code with human-readable explanations - US special handling: DPF certification required, check URL included Updated: transfers/page.tsx - "Was muss ich tun?" explanation section with 3 options: 1. Adequacy decision (green) — no action needed 2. DPF certification (blue, US only) — check dataprivacyframework.gov 3. SCC + TIA required (amber) — link to Document Generator - Collapsible adequacy countries table (15 countries with restrictions) - Schrems II background explanation for customers - Customer guidance written for non-experts who never heard of TIA/SCC Updated: templateRecommendations.ts - SCC+TIA rules now consider DPF certification and adequacy status - us_dpf_only → SCC/TIA optional (not required) - adequate_only → SCC/TIA not recommended Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Benjamin Admin
@@ -214,13 +214,18 @@ const TEMPLATE_RULES: TemplateRule[] = [
|
||||
},
|
||||
|
||||
// ── Drittlandtransfer (SCC + TIA) ───────────────────────────────────────
|
||||
// SCC+TIA nur erforderlich wenn Drittlandtransfer OHNE Angemessenheitsbeschluss/DPF
|
||||
{
|
||||
templateType: 'transfer_impact_assessment',
|
||||
label: 'Transfer Impact Assessment (TIA)',
|
||||
condition: (answers) => {
|
||||
const thirdCountry = answers.get('tech_third_country')
|
||||
if (thirdCountry && thirdCountry !== 'no') return 'required'
|
||||
return null
|
||||
if (!thirdCountry || thirdCountry === 'no') return null
|
||||
// Wenn nur DPF-zertifizierte US-Anbieter: empfohlen statt pflicht
|
||||
if (thirdCountry === 'us_dpf_only') return 'optional'
|
||||
// Wenn nur Laender mit Angemessenheitsbeschluss: nicht noetig
|
||||
if (thirdCountry === 'adequate_only') return null
|
||||
return 'required'
|
||||
},
|
||||
},
|
||||
{
|
||||
@@ -228,8 +233,10 @@ const TEMPLATE_RULES: TemplateRule[] = [
|
||||
label: 'Standardvertragsklauseln (SCC) — Anhaenge',
|
||||
condition: (answers) => {
|
||||
const thirdCountry = answers.get('tech_third_country')
|
||||
if (thirdCountry && thirdCountry !== 'no') return 'required'
|
||||
return null
|
||||
if (!thirdCountry || thirdCountry === 'no') return null
|
||||
if (thirdCountry === 'us_dpf_only') return 'optional'
|
||||
if (thirdCountry === 'adequate_only') return null
|
||||
return 'required'
|
||||
},
|
||||
},
|
||||
|
||||
|
||||
@@ -2,6 +2,7 @@
|
||||
|
||||
import { useMemo, useState } from 'react'
|
||||
import { useVendorCompliance } from '@/lib/sdk/vendor-compliance'
|
||||
import { getTransferRequirement, ADEQUACY_DECISIONS, type AdequacyDecision } from '@/lib/sdk/vendor-compliance/adequacy-decisions'
|
||||
import Link from 'next/link'
|
||||
|
||||
// ============================================================================
|
||||
@@ -240,11 +241,99 @@ export default function TransfersPage() {
|
||||
</table>
|
||||
</div>
|
||||
|
||||
{/* Help text */}
|
||||
{/* Explanation: What do I need to do? */}
|
||||
<div className="bg-white rounded-xl border border-gray-200 p-6 space-y-4">
|
||||
<h3 className="text-lg font-semibold text-gray-900">Was muss ich tun?</h3>
|
||||
<p className="text-sm text-gray-600">
|
||||
Wenn Ihr Unternehmen personenbezogene Daten an Empfaenger ausserhalb der EU/des EWR uebermittelt,
|
||||
muessen Sie sicherstellen, dass ein angemessenes Datenschutzniveau besteht. Es gibt drei Wege:
|
||||
</p>
|
||||
|
||||
<div className="grid md:grid-cols-3 gap-4">
|
||||
{/* Option 1: Adequacy */}
|
||||
<div className="border border-green-200 rounded-lg p-4 bg-green-50">
|
||||
<div className="flex items-center gap-2 mb-2">
|
||||
<span className="w-3 h-3 rounded-full bg-green-500" />
|
||||
<span className="font-medium text-green-800">Angemessenheitsbeschluss</span>
|
||||
</div>
|
||||
<p className="text-xs text-green-700">
|
||||
Die EU-Kommission hat fuer bestimmte Laender festgestellt, dass ein angemessenes Datenschutzniveau
|
||||
besteht. Fuer diese Laender sind <strong>keine SCC und kein TIA erforderlich</strong>.
|
||||
</p>
|
||||
</div>
|
||||
|
||||
{/* Option 2: DPF */}
|
||||
<div className="border border-blue-200 rounded-lg p-4 bg-blue-50">
|
||||
<div className="flex items-center gap-2 mb-2">
|
||||
<span className="w-3 h-3 rounded-full bg-blue-500" />
|
||||
<span className="font-medium text-blue-800">DPF-Zertifizierung (nur USA)</span>
|
||||
</div>
|
||||
<p className="text-xs text-blue-700">
|
||||
US-Unternehmen koennen sich nach dem <strong>EU-US Data Privacy Framework</strong> zertifizieren.
|
||||
Pruefen Sie unter{' '}
|
||||
<a href="https://www.dataprivacyframework.gov/list" target="_blank" rel="noopener noreferrer" className="underline">
|
||||
dataprivacyframework.gov
|
||||
</a>{' '}
|
||||
ob Ihr US-Dienstleister zertifiziert ist. Falls ja: <strong>keine SCC/TIA noetig</strong>.
|
||||
</p>
|
||||
</div>
|
||||
|
||||
{/* Option 3: SCC + TIA */}
|
||||
<div className="border border-amber-200 rounded-lg p-4 bg-amber-50">
|
||||
<div className="flex items-center gap-2 mb-2">
|
||||
<span className="w-3 h-3 rounded-full bg-amber-500" />
|
||||
<span className="font-medium text-amber-800">SCC + TIA erforderlich</span>
|
||||
</div>
|
||||
<p className="text-xs text-amber-700">
|
||||
Fuer alle anderen Drittlaender muessen Sie <strong>EU-Standardvertragsklauseln (SCC)</strong> abschliessen
|
||||
und ein <strong>Transfer Impact Assessment (TIA)</strong> durchfuehren. Beides finden Sie im{' '}
|
||||
<Link href="/sdk/document-generator" className="underline">Document Generator</Link> unter "Drittlandtransfer".
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
{/* Adequacy countries list */}
|
||||
<details className="bg-white rounded-xl border border-gray-200">
|
||||
<summary className="px-6 py-4 cursor-pointer text-sm font-medium text-gray-700 hover:text-purple-600">
|
||||
Laender mit Angemessenheitsbeschluss anzeigen ({ADEQUACY_DECISIONS.length} Laender)
|
||||
</summary>
|
||||
<div className="px-6 pb-4">
|
||||
<table className="w-full text-sm">
|
||||
<thead>
|
||||
<tr className="border-b border-gray-100">
|
||||
<th className="text-left py-2 font-medium text-gray-500">Land</th>
|
||||
<th className="text-left py-2 font-medium text-gray-500">Seit</th>
|
||||
<th className="text-left py-2 font-medium text-gray-500">Einschraenkung</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody className="divide-y divide-gray-50">
|
||||
{ADEQUACY_DECISIONS.map((d: AdequacyDecision) => (
|
||||
<tr key={d.countryCode}>
|
||||
<td className="py-2 text-gray-900">
|
||||
{d.countryName}
|
||||
{d.requiresCertification && (
|
||||
<span className="ml-2 text-xs text-blue-600 font-medium">Zertifizierung erforderlich</span>
|
||||
)}
|
||||
</td>
|
||||
<td className="py-2 text-gray-600">{d.since}</td>
|
||||
<td className="py-2 text-gray-500 text-xs">
|
||||
{d.restriction || d.expires || '—'}
|
||||
</td>
|
||||
</tr>
|
||||
))}
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
</details>
|
||||
|
||||
{/* Schrems II info */}
|
||||
<div className="bg-blue-50 border border-blue-200 rounded-lg p-4 text-sm text-blue-800">
|
||||
<strong>Hinweis:</strong> Fuer Datenuebermittlungen in Drittlaender ohne Angemessenheitsbeschluss sind
|
||||
EU-Standardvertragsklauseln (SCC) und ein Transfer Impact Assessment (TIA) erforderlich (EuGH Schrems II, Art. 46 DSGVO).
|
||||
Templates fuer SCC und TIA finden Sie im Document Generator unter der Kategorie "Drittlandtransfer".
|
||||
<strong>Hintergrund — EuGH Schrems II:</strong> Der EuGH hat 2020 das EU-US Privacy Shield fuer ungueltig erklaert
|
||||
und klargestellt, dass bei Drittlandtransfers immer geprueft werden muss, ob die Gesetze des Empfaengerstaats
|
||||
den Schutz der uebermittelten Daten beeintraechtigen (z.B. durch Massenueberwachung oder fehlende Rechtsbehelfe).
|
||||
Das TIA dokumentiert genau diese Pruefung. Seit Juli 2023 gibt es mit dem EU-US Data Privacy Framework einen neuen
|
||||
Angemessenheitsbeschluss fuer DPF-zertifizierte US-Unternehmen.
|
||||
</div>
|
||||
</div>
|
||||
)
|
||||
|
||||
@@ -0,0 +1,130 @@
|
||||
/**
|
||||
* EU-Angemessenheitsbeschluesse (Art. 45 DSGVO)
|
||||
*
|
||||
* Laender mit Angemessenheitsbeschluss benoetigen KEINE SCC und KEIN TIA
|
||||
* fuer Datenuebermittlungen. Die Liste wird von der EU-Kommission gefuehrt.
|
||||
*
|
||||
* WICHTIG: USA hat Sonderstatus — Angemessenheit gilt NUR fuer Unternehmen,
|
||||
* die nach dem EU-US Data Privacy Framework (DPF) zertifiziert sind.
|
||||
* Nicht-zertifizierte US-Unternehmen brauchen weiterhin SCC + TIA.
|
||||
*
|
||||
* Quelle: https://commission.europa.eu/law/law-topic/data-protection/
|
||||
* international-dimension-data-protection/adequacy-decisions_en
|
||||
*/
|
||||
|
||||
export interface AdequacyDecision {
|
||||
/** ISO 3166-1 alpha-2 Laendercode */
|
||||
countryCode: string
|
||||
/** Laendername (deutsch) */
|
||||
countryName: string
|
||||
/** Jahr des Angemessenheitsbeschlusses */
|
||||
since: number
|
||||
/** Einschraenkungen (z.B. nur bestimmte Sektoren) */
|
||||
restriction?: string
|
||||
/** Befristet? */
|
||||
expires?: string
|
||||
/** Sonderstatus (z.B. DPF-Zertifizierung erforderlich) */
|
||||
requiresCertification?: boolean
|
||||
/** Name der erforderlichen Zertifizierung */
|
||||
certificationName?: string
|
||||
/** Pruef-URL fuer die Zertifizierung */
|
||||
certificationCheckUrl?: string
|
||||
}
|
||||
|
||||
/**
|
||||
* Vollstaendige Liste der Laender mit EU-Angemessenheitsbeschluss.
|
||||
* Stand: Mai 2026
|
||||
*/
|
||||
export const ADEQUACY_DECISIONS: AdequacyDecision[] = [
|
||||
{ countryCode: 'AD', countryName: 'Andorra', since: 2010 },
|
||||
{ countryCode: 'AR', countryName: 'Argentinien', since: 2003 },
|
||||
{ countryCode: 'FO', countryName: 'Faeroeer-Inseln', since: 2010 },
|
||||
{ countryCode: 'GG', countryName: 'Guernsey', since: 2003 },
|
||||
{ countryCode: 'IM', countryName: 'Isle of Man', since: 2004 },
|
||||
{ countryCode: 'IL', countryName: 'Israel', since: 2011 },
|
||||
{ countryCode: 'JP', countryName: 'Japan', since: 2019 },
|
||||
{ countryCode: 'JE', countryName: 'Jersey', since: 2008 },
|
||||
{
|
||||
countryCode: 'CA', countryName: 'Kanada', since: 2001,
|
||||
restriction: 'Nur Unternehmen, die dem Personal Information Protection and Electronic Documents Act (PIPEDA) unterliegen',
|
||||
},
|
||||
{ countryCode: 'NZ', countryName: 'Neuseeland', since: 2012 },
|
||||
{ countryCode: 'KR', countryName: 'Republik Korea (Suedkorea)', since: 2022 },
|
||||
{ countryCode: 'CH', countryName: 'Schweiz', since: 2000 },
|
||||
{
|
||||
countryCode: 'GB', countryName: 'Vereinigtes Koenigreich (UK)', since: 2021,
|
||||
expires: 'Befristet, verlaengert bis 2029',
|
||||
},
|
||||
{ countryCode: 'UY', countryName: 'Uruguay', since: 2012 },
|
||||
{
|
||||
countryCode: 'US', countryName: 'Vereinigte Staaten (USA)', since: 2023,
|
||||
restriction: 'Nur Unternehmen, die nach dem EU-US Data Privacy Framework (DPF) zertifiziert sind',
|
||||
requiresCertification: true,
|
||||
certificationName: 'EU-US Data Privacy Framework (DPF)',
|
||||
certificationCheckUrl: 'https://www.dataprivacyframework.gov/list',
|
||||
},
|
||||
]
|
||||
|
||||
/** Set der EU/EWR-Laender (kein Angemessenheitsbeschluss noetig) */
|
||||
export const EU_EEA_COUNTRIES = new Set([
|
||||
'AT', 'BE', 'BG', 'HR', 'CY', 'CZ', 'DK', 'EE', 'FI', 'FR',
|
||||
'DE', 'GR', 'HU', 'IE', 'IT', 'LV', 'LT', 'LU', 'MT', 'NL',
|
||||
'PL', 'PT', 'RO', 'SK', 'SI', 'ES', 'SE',
|
||||
// EWR (nicht EU, aber gleicher Datenschutzraum)
|
||||
'IS', 'LI', 'NO',
|
||||
])
|
||||
|
||||
/** Set der Laendercodes mit Angemessenheitsbeschluss */
|
||||
export const ADEQUATE_COUNTRIES = new Set(
|
||||
ADEQUACY_DECISIONS.map((d) => d.countryCode)
|
||||
)
|
||||
|
||||
/**
|
||||
* Prueft ob ein Land einen Angemessenheitsbeschluss hat.
|
||||
* Gibt das Decision-Objekt zurueck oder null.
|
||||
*/
|
||||
export function getAdequacyDecision(countryCode: string): AdequacyDecision | null {
|
||||
return ADEQUACY_DECISIONS.find((d) => d.countryCode === countryCode) || null
|
||||
}
|
||||
|
||||
/**
|
||||
* Bestimmt den Transfer-Status fuer ein Land.
|
||||
*/
|
||||
export function getTransferRequirement(countryCode: string): {
|
||||
isEU: boolean
|
||||
isAdequate: boolean
|
||||
requiresSCC: boolean
|
||||
requiresTIA: boolean
|
||||
requiresCertification: boolean
|
||||
explanation: string
|
||||
} {
|
||||
if (EU_EEA_COUNTRIES.has(countryCode)) {
|
||||
return {
|
||||
isEU: true, isAdequate: true,
|
||||
requiresSCC: false, requiresTIA: false, requiresCertification: false,
|
||||
explanation: 'EU-/EWR-Mitgliedstaat — keine zusaetzlichen Massnahmen erforderlich.',
|
||||
}
|
||||
}
|
||||
|
||||
const decision = getAdequacyDecision(countryCode)
|
||||
if (decision) {
|
||||
if (decision.requiresCertification) {
|
||||
return {
|
||||
isEU: false, isAdequate: true,
|
||||
requiresSCC: false, requiresTIA: false, requiresCertification: true,
|
||||
explanation: `Angemessenheitsbeschluss seit ${decision.since}. ${decision.restriction || ''} Pruefung der Zertifizierung unter: ${decision.certificationCheckUrl || ''}`,
|
||||
}
|
||||
}
|
||||
return {
|
||||
isEU: false, isAdequate: true,
|
||||
requiresSCC: false, requiresTIA: false, requiresCertification: false,
|
||||
explanation: `Angemessenheitsbeschluss der EU-Kommission seit ${decision.since}.${decision.restriction ? ` Einschraenkung: ${decision.restriction}` : ''}${decision.expires ? ` (${decision.expires})` : ''}`,
|
||||
}
|
||||
}
|
||||
|
||||
return {
|
||||
isEU: false, isAdequate: false,
|
||||
requiresSCC: true, requiresTIA: true, requiresCertification: false,
|
||||
explanation: 'Kein Angemessenheitsbeschluss — EU-Standardvertragsklauseln (SCC) und Transfer Impact Assessment (TIA) erforderlich (Art. 46 Abs. 2 lit. c DSGVO, EuGH Schrems II).',
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user