--- title: "Art. 46 GDPR: Transfers subject to appropriate safeguards" canonical: "https://dposchool.com/gdpr/article/46" source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_46" source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en" publisher: "DPO School" --- Art. 46 GDPR · Chapter V: Transfers of personal data to third countries or international organisations # Article 46 GDPR: Transfers subject to appropriate safeguards Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review) ## Summary (not the official text) Without an adequacy decision, a transfer may take place only if the controller or processor has provided appropriate safeguards and enforceable rights and effective legal remedies for data subjects are available. Paragraphs 2 and 3 list the forms these safeguards may take, such as binding corporate rules and standard data protection clauses. ## Official text ### Article 46(1) **1.** In the absence of a decision pursuant to Article 45(3), a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available. ### Article 46(2) **2.** The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authorisation from a supervisory authority, by: #### Article 46(2)(a) **(a)** a legally binding and enforceable instrument between public authorities or bodies; #### Article 46(2)(b) **(b)** binding corporate rules in accordance with Article 47; #### Article 46(2)(c) **(c)** standard data protection clauses adopted by the Commission in accordance with the examination procedure referred to in Article 93(2); #### Article 46(2)(d) **(d)** standard data protection clauses adopted by a supervisory authority and approved by the Commission pursuant to the examination procedure referred to in Article 93(2); #### Article 46(2)(e) **(e)** an approved code of conduct pursuant to Article 40 together with binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards, including as regards data subjects' rights; or #### Article 46(2)(f) **(f)** an approved certification mechanism pursuant to Article 42 together with binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards, including as regards data subjects' rights. ### Article 46(3) **3.** Subject to the authorisation from the competent supervisory authority, the appropriate safeguards referred to in paragraph 1 may also be provided for, in particular, by: #### Article 46(3)(a) **(a)** contractual clauses between the controller or processor and the controller, processor or the recipient of the personal data in the third country or international organisation; or #### Article 46(3)(b) **(b)** provisions to be inserted into administrative arrangements between public authorities or bodies which include enforceable and effective data subject rights. ### Article 46(4) **4.** The supervisory authority shall apply the consistency mechanism referred to in Article 63 in the cases referred to in paragraph 3 of this Article. ### Article 46(5) **5.** Authorisations by a Member State or supervisory authority on the basis of Article 26(2) of Directive 95/46/EC shall remain valid until amended, replaced or repealed, if necessary, by that supervisory authority. Decisions adopted by the Commission on the basis of Article 26(4) of Directive 95/46/EC shall remain in force until amended, replaced or repealed, if necessary, by a Commission Decision adopted in accordance with paragraph 2 of this Article. ## Source Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu [Article 46 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_46) Text as of 28 October 2026. This is reference material, not legal advice. ## Related recitals This list is under review. - [Recital 108](https://dposchool.com/gdpr/recital/108) ## Court of Justice judgments ### [C-311/18, Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems](https://dposchool.com/gdpr/case/c-311-18) Judgment of 16 July 2020 · ECLI:EU:C:2020:559 Transfers under standard contractual clauses require essentially equivalent protection, assessed case by case including access by foreign authorities; authorities must suspend or prohibit transfers that cannot be protected; the Commission's SCC decision stays valid; the EU-US Privacy Shield decision is invalid. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-311/18&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62018CJ0311) ## EDPB guidance ### [Guidelines 07/2022 on certification as a tool for transfers](https://dposchool.com/gdpr/guidance/edpb-07-2022) EDPB 07/2022 · Final · First published 30 June 2022 · Final version 24 February 2023 [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-072022-on-certification-as-a-tool-for-transfers_en) ### [Guidelines 04/2021 on codes of conduct as tools for transfers](https://dposchool.com/gdpr/guidance/edpb-04-2021) EDPB 04/2021 · Final · First published 14 July 2021 · Final version 22 February 2022 [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-042021-on-codes-of-conduct-as-tools-for-transfers_en) ### [Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data](https://dposchool.com/gdpr/guidance/edpb-rec-01-2020) EDPB Rec 01/2020 · Final · Final version 18 June 2021 Version 2.0 is final; the EDPB's response to C-311/18. [Document on the EDPB website](https://www.edpb.europa.eu/documents/recommendation/recommendations-012020-on-measures-that-supplement-transfer-tools-to_en) ### [Guidelines 2/2020 on articles 46(2)(a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies](https://dposchool.com/gdpr/guidance/edpb-02-2020) EDPB 02/2020 · Final · First published 24 February 2020 · Final version 15 December 2020 [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-22020-on-articles-46-2-a-and-46-3-b-of-regulation-2016679-for_en) ### [Recommendations 02/2020 on the European Essential Guarantees for surveillance measures](https://dposchool.com/gdpr/guidance/edpb-rec-02-2020) EDPB Rec 02/2020 · Final · First published 10 November 2020 · Final version 10 November 2020 [Document on the EDPB website](https://www.edpb.europa.eu/documents/recommendation/recommendations-022020-on-the-european-essential-guarantees-for_en) ## Fines Amounts are shown in the currency in which the fine was imposed. ### [TikTok Technology Limited: EUR 530,000,000](https://dposchool.com/gdpr/fine/dpc-tiktok-2025-04) Data Protection Commission (Ireland), Ireland · Decision of 30 April 2025 · Appeal status: under appeal Allowed staff in China to access EEA users' data without showing equivalent protection, and did not tell users about these transfers. [Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-tiktok-technology-limited) ### [Meta Platforms Ireland Limited: EUR 1,200,000,000](https://dposchool.com/gdpr/fine/dpc-meta-2023-05) Data Protection Commission (Ireland), Ireland · Decision of 12 May 2023 · Appeal status: under appeal Kept transferring Facebook users' data to the US on standard contractual clauses after the Schrems II judgment, without addressing the risks the court identified. [Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-concerning-data-transfers-eueea-us-meta-platforms-ireland-limited-its-facebook-service) ## Navigation [GDPR Navigator](https://dposchool.com/gdpr) / [Chapter V](https://dposchool.com/gdpr/chapter/5) / Article 46 Previous: [Art. 45 GDPR: Transfers on the basis of an adequacy decision](https://dposchool.com/gdpr/article/45) Next: [Art. 47 GDPR: Binding corporate rules](https://dposchool.com/gdpr/article/47) Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/gdpr/llms.txt - JSON API: https://dposchool.com/gdpr/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents