Transfer Impact Assessment

Last updated: August 7, 2026 · Version 2.0
Prepared by: NEMANJA MILJKOVIĆ PR RAČUNARSKO PROGRAMIRANJE SHIELDOME KRAGUJEVAC — [email protected]

1. Purpose and Methodology

This TIA has been prepared in accordance with:

• The European Data Protection Board (EDPB) Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data;
• The requirements of EU Commission Implementing Decision (EU) 2021/914 (Standard Contractual Clauses), which conditions the effectiveness of SCCs on an assessment of whether the law or practice of the third country impairs the SCCs' effectiveness;
• The Serbian Law on Personal Data Protection (LPDP, Official Gazette RS, No. 87/2018), which substantially mirrors the GDPR.

The methodology follows the six-step framework recommended by the EDPB: (1) identify the transfer, (2) identify the transfer tool, (3) assess the third country law, (4) assess whether the tool is effective, (5) identify and adopt supplementary measures if needed, (6) take formal procedural steps.

2. Data Flows and Transfer Overview

3. EU/EEA Data Storage (No Transfer)

All Customer account data and scan data is stored in AWS eu-central-1 (Frankfurt, Germany), within the European Economic Area. This storage does not constitute an international transfer. No data is routed through or stored in non-EEA AWS regions.

Access by Shieldome's personnel in Serbia to data stored in Frankfurt is covered by the EU adequacy decision for Serbia (Commission Decision 2013/65/EU) and does not constitute a transfer requiring additional safeguards.

4. Serbian Legal Framework

Serbia is the location of Shieldome as Processor. The Serbian legal context is relevant to assessing whether government access to Personal Data processed by Shieldome could impair the effectiveness of the SCCs.

4.1 Data Protection Law

Serbia's Law on Personal Data Protection (LPDP, 2018) is substantively equivalent to the GDPR. It was the basis for the EU adequacy decision. The Serbian Commissioner for Personal Data Protection (Poverenik) acts as an independent supervisory authority with enforcement powers comparable to EU DPAs.

4.2 Government Access and Surveillance Law

• Serbia has no equivalent of the US FISA Section 702 or Executive Order 12333 bulk surveillance programmes that were central to the invalidation of Privacy Shield in Schrems II.
• Serbia has no equivalent of the US CLOUD Act. Serbian law does not permit US-style extraterritorial compelled disclosure orders against Serbian entities.
• Law enforcement access to personal data in Serbia requires a judicial authorisation (court order or similar warrant) based on reasonable suspicion of a specific offence. Bulk or generalised access is not permitted.
• Serbia is a Council of Europe member state and a signatory to the Budapest Convention on Cybercrime, which includes proportionality requirements for data access by authorities.
• Serbian intelligence services operate under parliamentary oversight and are subject to constitutional protections on privacy equivalent to those in EU Member States.

4.3 Assessment

The Serbian legal framework does not present material risks to the effectiveness of transfer safeguards. The adequacy decision itself reflects the European Commission's assessment that Serbia provides an equivalent level of protection to the EU.

5. Transfer Assessment: Resend Inc. (US)

5.1 US Legal Framework Relevant to Resend

The United States does not have a comprehensive federal data protection law equivalent to the GDPR. Key surveillance laws relevant to US-based providers include:

• FISA Section 702 (50 U.S.C. § 1881a): Permits the NSA to compel US-based electronic communications service providers to disclose communications of non-US persons located outside the US. The scope of "electronic communications service provider" covers email providers.
• Executive Order 12333: Authorises foreign intelligence collection outside the US, including in transit.
• CLOUD Act (2018): Permits US law enforcement to seek stored communications from US-based providers with a US court order.

US Executive Order 14086 (2022) introduced enhanced safeguards for EU data including a Data Protection Review Court for EU residents to challenge US intelligence access. This partially restores the legal framework that was found deficient in Schrems II but does not fully eliminate the risk of FISA 702 access.

5.2 Data Minimisation Assessment

5.3 Likelihood of Government Access

• FISA 702 targets communications of specific non-US persons of foreign intelligence interest. Shieldome's customers are businesses and professionals conducting authorised security assessments. This is not a profile that would attract foreign intelligence interest.
• The data transferred consists of minimal PII (email + name + notification text). Even if accessed, it would yield no meaningful intelligence value and would reveal no sensitive personal details about the subject.
• Resend as an email delivery provider handles the same category of data as any transactional email service. The risk of targeted government access to routine "scan complete" notifications is assessed as negligible.
• Resend has published commitments to transparency (annual transparency report) and to challenge overbroad government requests where legally permitted.

5.4 Risk Rating: Resend

6. Transfer Assessment: Google LLC (US)

6.1 Scope of Transfer

The transfer to Google occurs only when a user elects to use "Sign in with Google" (OAuth 2.0) as their authentication method. This is an optional feature; users may instead register with email and password.

The OAuth flow involves:

1. The user's browser redirects to Google's authorisation endpoint.
2. Google authenticates the user and returns an OAuth authorisation code to Shieldome.
3. Shieldome exchanges the code for a token and retrieves the user's email address and display name from Google's API.
4. Shieldome uses the email address and name to create or identify the user's account.

6.2 Data Minimisation Assessment

6.3 Likelihood of Government Access

• The data exchanged with Google during the OAuth flow (email + name) is the same minimal identifier data that a user's Google Account already contains. No incremental disclosure of sensitive data occurs.
• Google is among the largest recipients of FISA 702 orders globally. However, the data that Shieldome exchanges with Google (login identifiers) is not data that would be of foreign intelligence interest independent of the user's broader Google Account.
• Google maintains transparency reporting, publishes National Security Letter counts, and has publicly committed to challenging overbroad government data requests.
• The European Commission's adequacy decision for the EU-US Data Privacy Framework (where Google is certified) reflects an assessment that enhanced protections under EO 14086 reduce — though do not eliminate — the risk of bulk surveillance.
• The risk of government access to Shieldome-specific OAuth login identifiers via Google is assessed as remote given the non-sensitive nature of the data and the profile of Shieldome's user base.

6.4 Risk Rating: Google

7. Supplementary Measures

In addition to the SCCs, the following supplementary measures are in place to reduce the risk of government access impairing the effectiveness of the transfer safeguards:

8. Conclusion and Overall Risk Rating

9. Review Schedule

This TIA will be reviewed:

• Annually as part of Shieldome's annual security assessment cycle;
• Upon any material change to the data transferred, the sub-processors involved, or the legal framework in Serbia or the United States (including any new court decisions or legislation materially affecting surveillance law);
• Upon a significant change in the EU-US legal landscape (e.g., invalidation of the EU-US Data Privacy Framework or significant changes to EO 14086).

The next scheduled review is August 2027. The current version of this TIA is maintained at /legal/transfer_impact_assessment.html.