This article explains how the Schrems II judgment changed international data transfers under the GDPR. It outlines the role of Standard Contractual Clauses, Transfer Impact Assessments and risk-based compliance for companies transferring personal data outside the EEA.