Belgian DPA: EU SCCs Invalid Without Transfer Impact Assessment

The Belgian Data Protection Authority (APD) issued a decision on October 9, 2026, published in French, finding that a data exporter's failure to conduct a Transfer Impact Assessment (TIA) rendered its EU Standard Contractual Clauses invalid. On the available reporting, the failure is a missing TIA rather than a defect in the clauses themselves, so the decision reads as a process ruling: paper SCCs do not cure an unassessed transfer.

The cross-client significance is immediate. TIA obligations have sat inside the "appropriate safeguards" analysis since Schrems II, and DPAs have already signalled enforcement interest in transfers to jurisdictions with surveillance-law exposure. A national authority going further and treating the absence of a documented TIA as defeating the legal basis of the clauses gives privacy teams and deal teams a reason to audit whether every live SCC set, including intra-group and legacy vendor arrangements, is backed by a signed and current assessment.

The summary does not identify the exporter, the destination country, or whether the decision has been appealed, and it does not say whether the APD addressed its interaction with EDPB supplementary-measures guidance. Counsel should treat the reasoning as a compliance trigger rather than a settled pan-EU rule, and watch for the French decision text, any appeal, and whether other DPAs follow.