Make your website GDPR compliant today — Cookiebot automates cookie consent, scanning, and compliance so you don't have to.
Try Cookiebot Free
Article 46
Transfers subject to appropriate safeguards
Chapter 5|International Transfers|📖 5 min read
1. In the absence of a decision pursuant to Article 45(3), a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.
2. The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authorisation from a supervisory authority, by:
(a) a legally binding and enforceable instrument between public authorities or bodies;
(b) binding corporate rules in accordance with Article 47;
(c) standard data protection clauses adopted by the Commission in accordance with the examination procedure referred to in Article 93(2);
(d) standard data protection clauses adopted by a supervisory authority and approved by the Commission pursuant to the examination procedure referred to in Article 93(2);
(e) an approved code of conduct pursuant to Article 40 together with binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards, including as regards data subjects' rights; or
(f) an approved certification mechanism pursuant to Article 42 together with binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards, including as regards data subjects' rights.
3. Subject to the authorisation from the competent supervisory authority, the appropriate safeguards referred to in paragraph 1 may also be provided for, in particular, by:
(a) contractual clauses between the controller or processor and the controller, processor or the recipient of the personal data in the third country or international organisation; or
(b) provisions to be inserted into administrative arrangements between public authorities or bodies which include enforceable and effective data subject rights.
4. The supervisory authority shall apply the consistency mechanism referred to in Article 63 in the cases referred to in paragraph 3 of this Article.
5. Authorisations by a Member State or supervisory authority on the basis of Article 26(2) of Directive 95/46/EC shall remain valid until amended, replaced or repealed, if necessary, by that supervisory authority. Decisions adopted by the Commission on the basis of Article 26(4) of Directive 95/46/EC shall remain in force until amended, replaced or repealed, if necessary, by a Commission Decision adopted in accordance with paragraph 2 of this Article.
Understanding This Article
Article 46 provides the mechanisms for lawful international data transfers when the destination country lacks an adequacy decision under Article 45. This is the most commonly used legal basis for international transfers, particularly through Standard Contractual Clauses (SCCs).
The article distinguishes between mechanisms requiring no specific authorization (paragraph 2) and those requiring supervisory authority approval (paragraph 3). Standard Contractual Clauses adopted by the Commission are the most popular because they're pre-approved, standardized, and don't require case-by-case authorization. The European Commission updated the SCCs in 2021 to address the Schrems II concerns, adding requirements for transfer impact assessments and supplementary measures.
Binding Corporate Rules (BCRs) under paragraph 2(b) allow multinational corporations to establish internal data protection policies that govern intra-group transfers. BCRs require supervisory authority approval but provide long-term flexibility for complex multinational operations.
Critically, all mechanisms must ensure data subjects have enforceable rights and effective legal remedies. Post-Schrems II, this means organizations must assess whether the destination country's laws (particularly surveillance laws) might undermine the safeguards and, if so, implement supplementary measures like encryption, pseudonymization, or limiting data transfers to non-sensitive information.
Paragraph 3 allows custom contractual clauses and administrative arrangements, but these require supervisory authority authorization and consistency mechanism review, making them less practical for most organizations.
Key Points
Transfers without adequacy decisions require appropriate safeguards
Standard Contractual Clauses (SCCs) are most common mechanism, requiring no authorization
Codes of conduct and certification can be used with binding commitments
Practical Application
Example 1 - Standard Contractual Clauses: A Belgian SaaS company uses a US data center provider. Without a US adequacy decision (post-Privacy Shield), they implement the European Commission's 2021 Standard Contractual Clauses. They conduct a Transfer Impact Assessment (TIA) to evaluate US surveillance risks, determine their US provider is unlikely to be targeted by FISA 702 orders (based on the provider's legal analysis), implement encryption in transit and at rest, and include provisions requiring the provider to challenge unlawful government data requests. They document this assessment and make it available to supervisory authorities.
Example 2 - Binding Corporate Rules: A global pharmaceutical company with subsidiaries in 50 countries implements Binding Corporate Rules approved by their lead supervisory authority. The BCRs establish uniform data protection standards across all entities, define roles and responsibilities, provide mechanisms for data subjects to enforce their rights against any group entity, and establish liability rules. Employees in the US, Singapore, and Brazil can all access HR and R&D data within the framework, without needing individual contracts for each transfer.
Example 3 - Schrems II Supplementary Measures: A German bank wants to use an Indian IT services provider for software development. They sign SCCs but recognize India lacks comprehensive surveillance law protections. As supplementary measures, they: (1) implement strong encryption where the Indian provider doesn't hold keys, (2) pseudonymize customer identifiers, (3) conduct regular audits, (4) require the provider to challenge any government data requests and immediately notify the bank, and (5) establish contractual rights to terminate immediately if data protection is compromised. They document this in their TIA.
Example 4 - Public Authority Administrative Arrangements: French and Moroccan tax authorities want to exchange taxpayer data for bilateral treaty enforcement. They cannot use standard SCCs (designed for commercial relationships). Instead, they develop administrative arrangements under Article 46(3)(b), including provisions for data subject rights, data security, purpose limitations, and retention limits. They submit these to the French supervisory authority for approval under the consistency mechanism.
Example 5 - Certification Mechanism: A Brazilian cloud provider obtains GDPR certification under Article 42 and makes binding commitments to apply appropriate safeguards and respect data subject rights. EU companies can transfer data to this provider under Article 46(2)(f), relying on the certification plus the binding commitments. The certification provides evidence of compliance, while the commitments ensure enforceability and data subject rights.