1. In the absence of a decision pursuant to Article 45(3), a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.
Article 46 GDPR - Transfers subject to appropriate safeguards
2. The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authorisation from a supervisory authority, by:
(a) a legally binding and enforceable instrument between public authorities or bodies;
(b) binding corporate rules in accordance with Article 47;
(c) standard data protection clauses adopted by the Commission in accordance with the examination procedure referred to in Article 93(2);
(d) standard data protection clauses adopted by a supervisory authority and approved by the Commission pursuant to the examination procedure referred to in Article 93(2);
(e) an approved code of conduct pursuant to Article 40 together with binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards, including as regards data subjects’ rights; or
(f) an approved certification mechanism pursuant to Article 42 together with binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards, including as regards data subjects’ rights.
3. Subject to the authorisation from the competent supervisory authority, the appropriate safeguards referred to in paragraph 1 may also be provided for, in particular, by:
(a) contractual clauses between the controller or processor and the controller, processor or the recipient of the personal data in the third country or international organisation; or
(b) provisions to be inserted into administrative arrangements between public authorities or bodies which include enforceable and effective data subject rights.
4. The supervisory authority shall apply the consistency mechanism referred to in Article 63 in the cases referred to in paragraph 3 of this Article.
5. Authorisations by a Member State or supervisory authority on the basis of Article 26(2) of Directive 95/46/EC shall remain valid until amended, replaced or repealed, if necessary, by that supervisory authority. Decisions adopted by the Commission on the basis of Article 26(4) of Directive 95/46/EC shall remain in force until amended, replaced or repealed, if necessary, by a Commission Decision adopted in accordance with paragraph 2 of this Article.
Frequently Asked Questions
Short answers to common questions about this provision. They are general information and not legal advice.
In the absence of an adequacy decision pursuant to Article 45(3), Article 46(1) permits a controller or processor to transfer personal data to a third country or international organisation only if it has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available. Both conditions must be met; the safeguard instrument alone does not suffice if data subjects cannot enforce their rights.
Paragraph 2 lists a legally binding and enforceable instrument between public authorities or bodies, binding corporate rules in accordance with Article 47, standard data protection clauses adopted by the Commission, standard data protection clauses adopted by a supervisory authority and approved by the Commission, an approved code of conduct pursuant to Article 40, and an approved certification mechanism pursuant to Article 42. For codes and certifications, the importer in the third country must additionally give binding and enforceable commitments to apply the safeguards, including as regards data subjects' rights.
Yes, but only with authorisation. Under point (a) of paragraph 3, contractual clauses between the exporter and the controller, processor or recipient in the third country may provide appropriate safeguards subject to the authorisation of the competent supervisory authority, and paragraph 4 requires the authority to apply the consistency mechanism of Article 63 in such cases. This distinguishes ad hoc clauses from the standard clauses of points (c) and (d) of paragraph 2, which need no specific authorisation.
They may rely on a legally binding and enforceable instrument under point (a) of paragraph 2 without specific authorisation, or, under point (b) of paragraph 3, on provisions inserted into administrative arrangements which include enforceable and effective data subject rights, subject to authorisation by the competent supervisory authority. The distinction turns on whether the instrument is legally binding; non-binding administrative arrangements require the authorisation route and the consistency mechanism.
Yes. Paragraph 5 keeps authorisations by a Member State or supervisory authority based on Article 26(2) of Directive 95/46/EC valid until amended, replaced or repealed, if necessary, by that supervisory authority, and Commission decisions based on Article 26(4) of the Directive remain in force until amended, replaced or repealed, if necessary, by a Commission decision adopted in accordance with paragraph 2.