Cross-border employee monitoring after Schrems II — US-based HRIS with EU subsidiaries?

Our US HQ runs Workday for all employees globally. EU subsidiaries (DE, FR) have works councils demanding data processing agreements and transfer impact assessments. Jurisdiction: EU, DE What technical supplements (encryption, pseudonymization, access controls) have proven effective for SCC-based transfers of HR data to the US?