1st Transfer: SCC Module 2.  Initial cross-border transfer from EEA to United States utilizes SCC Module 2 designed for transfers from a controller to a non-EEA processor (First SCC).

2nd Transfer: No Mechanism. The GDPR and U.S. law do not require a company that transmits data from the United States to the EEA to utilize a safeguard mechanism.

Transfer Impact Assessments. Section 14 of the SCCs require all parties (Company A and Company Z) to document a transfer impact assessment of U.S. law to determine whether any party has reason to believe that the laws and practices of the United States apply to the personal data transferred prevent Company Z from fulfilling its obligations under the SCCs.

Law enforcement request policy. Section 15 of the SCCs require the data importer (Company Z) to take specific steps in the event that it receives a request from a public authority for access to personal data. As a result, Company Z might consider creating a written law enforcement request policy.