Art. 46 GDPR · Chapter V: Transfers of personal data to third countries or international organisations
Article 46 GDPR: Transfers subject to appropriate safeguards
Text as of 28 October 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the official text)
Without an adequacy decision, a transfer may take place only if the controller or processor has provided appropriate safeguards and enforceable rights and effective legal remedies for data subjects are available. Paragraphs 2 and 3 list the forms these safeguards may take, such as binding corporate rules and standard data protection clauses.
Official text
In the absence of a decision pursuant to Article 45(3), a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.
The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authorisation from a supervisory authority, by:
a legally binding and enforceable instrument between public authorities or bodies;
binding corporate rules in accordance with Article 47;
standard data protection clauses adopted by the Commission in accordance with the examination procedure referred to in Article 93(2);
standard data protection clauses adopted by a supervisory authority and approved by the Commission pursuant to the examination procedure referred to in Article 93(2);
an approved code of conduct pursuant to Article 40 together with binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards, including as regards data subjects' rights; or
an approved certification mechanism pursuant to Article 42 together with binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards, including as regards data subjects' rights.
Subject to the authorisation from the competent supervisory authority, the appropriate safeguards referred to in paragraph 1 may also be provided for, in particular, by:
contractual clauses between the controller or processor and the controller, processor or the recipient of the personal data in the third country or international organisation; or
provisions to be inserted into administrative arrangements between public authorities or bodies which include enforceable and effective data subject rights.
The supervisory authority shall apply the consistency mechanism referred to in Article 63 in the cases referred to in paragraph 3 of this Article.
Authorisations by a Member State or supervisory authority on the basis of Article 26(2) of Directive 95/46/EC shall remain valid until amended, replaced or repealed, if necessary, by that supervisory authority. Decisions adopted by the Commission on the basis of Article 26(4) of Directive 95/46/EC shall remain in force until amended, replaced or repealed, if necessary, by a Commission Decision adopted in accordance with paragraph 2 of this Article.
Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu
Text as of 28 October 2026.
This is reference material, not legal advice.
Related recitals
This list is under review.
Court of Justice judgments
- C-311/18, Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems
Judgment of 16 July 2020ECLI:EU:C:2020:559
Transfers under standard contractual clauses require essentially equivalent protection, assessed case by case including access by foreign authorities; authorities must suspend or prohibit transfers that cannot be protected; the Commission's SCC decision stays valid; the EU-US Privacy Shield decision is invalid.
EDPB guidance
- Guidelines 07/2022 on certification as a tool for transfers
EDPB 07/2022FinalFirst published 30 June 2022Final version 24 February 2023
- Guidelines 04/2021 on codes of conduct as tools for transfers
EDPB 04/2021FinalFirst published 14 July 2021Final version 22 February 2022
- Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data
EDPB Rec 01/2020FinalFinal version 18 June 2021
Version 2.0 is final; the EDPB's response to C-311/18.
- Guidelines 2/2020 on articles 46(2)(a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies
EDPB 02/2020FinalFirst published 24 February 2020Final version 15 December 2020
- Recommendations 02/2020 on the European Essential Guarantees for surveillance measures
EDPB Rec 02/2020FinalFirst published 10 November 2020Final version 10 November 2020
Fines
Amounts are shown in the currency in which the fine was imposed.
- TikTok Technology Limited: EUR 530,000,000
Data Protection Commission (Ireland), IrelandDecision of 30 April 2025Appeal status: under appeal
Allowed staff in China to access EEA users' data without showing equivalent protection, and did not tell users about these transfers.
- Meta Platforms Ireland Limited: EUR 1,200,000,000
Data Protection Commission (Ireland), IrelandDecision of 12 May 2023Appeal status: under appeal
Kept transferring Facebook users' data to the US on standard contractual clauses after the Schrems II judgment, without addressing the risks the court identified.