The European Data Protection Board (EDPB) adopted, on 18 June, final Recommendations on Supplementary Measures (Recommendations) (1) for data transfers to third countries, published in response to the Court of Justice of the European Union (CJEU) ruling in Schrems II. The Recommendations contain a six-step methodology to assess transfers of personal data from the European economic Area (EEA) to those countries outside the EEA that have not been approved by the European Commission as providing adequacy. The Recommendations also contain various supplementary measures that can be used if the transfer tools an organisation has selected does provide an equivalent level of protection to that offered under the GDPR and individual’s rights and freedoms under the EU Charter of Fundamental Rights. The Recommendations contain practical guidance where there is “problematic legislation” in an importing country such that public and governmental authorities would be able to access individuals’’ personal data.