Our software supplier is located outside the EU. What do we need to arrange?

First check whether the Commission has adopted an adequacy decision for that country under Article 45. If not, the transfer is allowed only with appropriate safeguards (paragraph 1). Usually you then choose an instrument from paragraph 2, such as the Commission's standard data protection clauses, which need no authorisation from the supervisory authority.

Can we adapt the standard clauses to fit our own contract?

You may include them in a wider contract and add extra safeguards (recital 109). You may not add clauses that directly or indirectly contradict the standard clauses or that prejudice the rights of data subjects. If you really want your own contractual clauses, you fall under paragraph 3 and need authorisation from the supervisory authority.

We are a processor and send data to a sub-processor outside the EU. Does this article apply to us too?

Yes. Paragraph 1 is addressed to the controller and to the processor. So you too must provide appropriate safeguards, for example by including the standard clauses in the contract with the sub-processor (recital 109).

Article 46: Transfers subject to appropriate safeguards

Praxikon tracks Article 46 (Transfers subject to appropriate safeguards) under the GDPR, alongside the EU AI Act, citing the source for every statement.

Chapter VIn force since 25-05-2018

Article 46 sets out how you may transfer personal data to a country outside the EU (a third country) or to an international organisation when the Commission has not adopted an adequacy decision for that country under Article 45. In that case a transfer is allowed only if the controller or processor provides appropriate safeguards and data subjects keep enforceable rights and effective legal remedies (paragraph 1). Paragraph 2 lists instruments you may use without any specific authorisation from the supervisory authority, such as standard data protection clauses adopted by the Commission, binding corporate rules under Article 47, and an approved code of conduct or certification combined with binding commitments. Paragraph 3 lists instruments that need authorisation from the competent supervisory authority, such as your own contractual clauses and administrative arrangements between public bodies; the supervisory authority applies the consistency mechanism of Article 63 for those (paragraph 4). The article exists because GDPR protection must not disappear once data leaves the EU: the safeguards have to compensate for the lack of protection in the third country (recital 108).

Key term: Appropriate safeguards: arrangements or rules that carry GDPR level protection with the data to a country outside the EU, so that data subjects keep enforceable rights there

Directly affects:controllerprocessordata subjectsupervisory authorityCommission

Praxikon’s reading of the text and the recitals; the official text below prevails.

Official text

In the absence of a decision pursuant to Article 45(3), a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.

The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authorisation from a supervisory authority, by: (a) a legally binding and enforceable instrument between public authorities or bodies; (b) binding corporate rules in accordance with Article 47; (c) standard data protection clauses adopted by the Commission in accordance with the examination procedure referred to in Article 93(2); (d) standard data protection clauses adopted by a supervisory authority and approved by the Commission pursuant to the examination procedure referred to in Article 93(2); (e) an approved code of conduct pursuant to Article 40 together with binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards, including as regards data subjects' rights; or (f) an approved certification mechanism pursuant to Article 42 together with binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards, including as regards data subjects' rights.

Subject to the authorisation from the competent supervisory authority, the appropriate safeguards referred to in paragraph 1 may also be provided for, in particular, by: (a) contractual clauses between the controller or processor and the controller, processor or the recipient of the personal data in the third country or international organisation; or (b) provisions to be inserted into administrative arrangements between public authorities or bodies which include enforceable and effective data subject rights.

The supervisory authority shall apply the consistency mechanism referred to in Article 63 in the cases referred to in paragraph 3 of this Article.

Authorisations by a Member State or supervisory authority on the basis of Article 26(2) of Directive 95/46/EC shall remain valid until amended, replaced or repealed, if necessary, by that supervisory authority. Decisions adopted by the Commission on the basis of Article 26(4) of Directive 95/46/EC shall remain in force until amended, replaced or repealed, if necessary, by a Commission Decision adopted in accordance with paragraph 2 of this Article.

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

What does this mean for you?

Controller

If you have data processed in a country without an adequacy decision, you first choose an instrument from paragraph 2, for example the Commission's standard data protection clauses or binding corporate rules for transfers within your own group (recital 110). If you want to use your own contractual clauses, you need prior authorisation from the supervisory authority (paragraph 3). You may include the standard clauses in a wider contract and add extra safeguards, as long as they do not contradict the standard clauses or prejudice the rights of data subjects (recital 109).

Processor

This article applies directly to you as well: a processor that moves data outside the EU, for example to a sub-processor, must itself provide appropriate safeguards (paragraph 1). You can include the standard clauses in the contract with that other processor (recital 109).

Data Protection Officer

You assess whether the chosen instrument fits the transfer and whether data subjects actually have enforceable rights and effective legal remedies (paragraph 1). You keep track of which transfers rely on paragraph 2 and which on paragraph 3, because paragraph 3 requires authorisation from the supervisory authority.

Data Subject

The article requires that you keep enforceable rights and effective legal remedies after the transfer, for example to seek administrative or judicial redress or to claim compensation (paragraph 1 and recital 108).

Compliance checklist

For every transfer to a country without an adequacy decision, it is recorded which instrument from paragraph 2 or paragraph 3 provides the appropriate safeguards.Data subjects have enforceable rights and effective legal remedies for every transfer (paragraph 1).Standard clauses in use are the versions adopted or approved by the Commission (paragraph 2(c) and (d)) and contain no additions that contradict them (recital 109).Transfers within the group rely on binding corporate rules only if those rules have been approved in accordance with Article 47 (paragraph 2(b)).Where a code of conduct under Article 40 or a certification under Article 42 serves as the safeguard, binding and enforceable commitments of the recipient in the third country are documented (paragraph 2(e) and (f)).For own contractual clauses or administrative arrangements, prior authorisation from the competent supervisory authority has been obtained (paragraph 3).Authorisations and decisions dating from before the GDPR have been checked: they remain valid until amended, replaced or repealed (paragraph 5).

Related recitals

(108)

In the absence of an adequacy decision, the controller or processor should take measures to compensate for the lack of data protection in a third country by way of appropriate safeguards for the data ...

(109)

The possibility for the controller or processor to use standard data-protection clauses adopted by the Commission or by a supervisory authority should prevent controllers or processors neither from in...

(110)

A group of undertakings, or a group of enterprises engaged in a joint economic activity, should be able to make use of approved binding corporate rules for its international transfers from the Union t...

Cross-references

Art. 26: Joint controllers Art. 40: Codes of conduct Art. 42: Certification Art. 45: Transfers on the basis of an adequacy decision Art. 47: Binding corporate rules Art. 63: Consistency mechanism Art. 93: Committee procedure

In addition to the overview at the bottom of this page: rulings, guidelines and fines that interpret or apply this article, newest first. Each item was checked against the official source.

Case law (1)

8 January 2025 · T-354/22 · General CourtRegulation 2018/1725
Bindl v Commission
The General Court orders the Commission to pay 400 euros: a Facebook sign-in link on its website sent an IP address to the US without an appropriate safeguard. Decided under Regulation 2018/1725.

Guidelines and decisions (4)

14 February 2023 · v2.0 · EDPB
Guidelines 07/2022 on certification as a tool for transfers
Explains how a certification with binding commitments from the importer can serve as a safeguard for transfers outside the EEA, and which criteria apply.
22 February 2022 · v2.0 · EDPB
Guidelines 04/2021 on Codes of Conduct as tools for transfers
Explains how a code of conduct with binding commitments from importers can serve as a safeguard for transfers to countries outside the EEA.
4 June 2021 · (EU) 2021/914 · European Commission
Standard contractual clauses for transfers to third countries
Modular standard contractual clauses for transfers to third countries, with a mandatory assessment of the law and practice in the country of destination.
10 November 2020 · EDPB
Recommendations 02/2020 on the European Essential Guarantees for surveillance measures
Describes four guarantees that public authority access in a third country must meet to justify interference with privacy and data protection.

Fines (2)

30 April 2025 · Data Protection Commission (Ireland)€530,000,000
TikTok: transfers of data to China
Staff in China had remote access to European users' data, without TikTok verifying and demonstrating that the data received essentially equivalent protection there. Its privacy policy also failed to clearly name the countries the data went to.
Decision of 30 April 2025, announced on 2 May 2025. TikTok appealed to the Irish courts, which stayed the orders to suspend the transfers pending the outcome.
12 May 2023 · Data Protection Commission (Ireland)€1,200,000,000
Meta: transfers of Facebook data to the US
After the Schrems II judgment Meta kept transferring Facebook users' personal data to the US on standard contractual clauses, without addressing the risks of US government access. A binding EDPB decision required a fine to be imposed.
Decision of 12 May 2023, announced on 22 May 2023. Meta has challenged the decision.

Line of case lawTransfers to the US: from Safe Harbour to the Data Privacy Framework

When may personal data go to the US and other third countries?

Safe Harbour (adequacy decision, invalid) (2000)First US adequacy arrangement, based on self-certification.
Schrems I (2015)The Court invalidates Safe Harbour; supervisory authorities must be able to examine transfer complaints.
EU-US Privacy Shield (adequacy decision, invalid) (2016)Successor with an Ombudsperson as an extra safeguard.
Schrems II (2020)Privacy Shield falls too; standard contractual clauses survive, but with an assessment per transfer.
Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data (2021)The EDPB sets out how to carry out that assessment and which supplementary measures fit.
Standard contractual clauses for transfers to third countries (2021)New standard contractual clauses that build in the Schrems II assessment.
Meta: transfers of Facebook data to the US (2023)Largest GDPR fine to date, for transfers of Facebook data to the US.
EU-US Data Privacy Framework (adequacy decision) (2023)Third US adequacy decision, with a new redress mechanism.
Bindl v Commission (2025)First damages awarded for an unlawful transfer to the US, by an EU institution.
Latombe v Commission (2025)The General Court upholds the Data Privacy Framework; an appeal is pending.

Checked on 5 November 2026

Frequently asked questions

← Art. 45: Transfers on the basis of an adequacy decision Art. 47: Binding corporate rules →

Connections

Case law

Schrems II: Privacy Shield invalid, transfers under standard clauses only with essentially equivalent protection
2020-07-16 · final, Hof van Justitie van de EU (Grote kamer), Data Protection Commissioner tegen Facebook Ireland Ltd en Maximillian Schrems

Guidelines

Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR
2023-02-14 · final, European Data Protection Board (EDPB)
Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data
2021-06-18 · final, European Data Protection Board (EDPB)

Enforcement and fines

100 million euro fine for MLU B.V. (Yango) for transfers to Russia
2026-04-01 · status not established, Autoriteit Persoonsgegevens