Our software supplier is located outside the EU. What do we need to arrange?

First check whether the Commission has adopted an adequacy decision for that country under Article 45. If not, the transfer is allowed only with appropriate safeguards (paragraph 1). Usually you then choose an instrument from paragraph 2, such as the Commission's standard data protection clauses, which need no authorisation from the supervisory authority.

Can we adapt the standard clauses to fit our own contract?

You may include them in a wider contract and add extra safeguards (recital 109). You may not add clauses that directly or indirectly contradict the standard clauses or that prejudice the rights of data subjects. If you really want your own contractual clauses, you fall under paragraph 3 and need authorisation from the supervisory authority.

We are a processor and send data to a sub-processor outside the EU. Does this article apply to us too?

Yes. Paragraph 1 is addressed to the controller and to the processor. So you too must provide appropriate safeguards, for example by including the standard clauses in the contract with the sub-processor (recital 109).

Article 46: Transfers subject to appropriate safeguards

Praxikon tracks Article 46 (Transfers subject to appropriate safeguards) under the GDPR, alongside the EU AI Act, citing the source for every statement.

Chapter VIn force since 25-05-2018

Article 46 sets out how you may transfer personal data to a country outside the EU (a third country) or to an international organisation when the Commission has not adopted an adequacy decision for that country under Article 45. In that case a transfer is allowed only if the controller or processor provides appropriate safeguards and data subjects keep enforceable rights and effective legal remedies (paragraph 1). Paragraph 2 lists instruments you may use without any specific authorisation from the supervisory authority, such as standard data protection clauses adopted by the Commission, binding corporate rules under Article 47, and an approved code of conduct or certification combined with binding commitments. Paragraph 3 lists instruments that need authorisation from the competent supervisory authority, such as your own contractual clauses and administrative arrangements between public bodies; the supervisory authority applies the consistency mechanism of Article 63 for those (paragraph 4). The article exists because GDPR protection must not disappear once data leaves the EU: the safeguards have to compensate for the lack of protection in the third country (recital 108).

Key term: Appropriate safeguards: arrangements or rules that carry GDPR level protection with the data to a country outside the EU, so that data subjects keep enforceable rights there

Directly affects:controllerprocessordata subjectsupervisory authorityCommission

Praxikon’s reading of the text and the recitals; the official text below prevails.

Official text

In the absence of a decision pursuant to Article 45(3), a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.

The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authorisation from a supervisory authority, by: (a) a legally binding and enforceable instrument between public authorities or bodies; (b) binding corporate rules in accordance with Article 47; (c) standard data protection clauses adopted by the Commission in accordance with the examination procedure referred to in Article 93(2); (d) standard data protection clauses adopted by a supervisory authority and approved by the Commission pursuant to the examination procedure referred to in Article 93(2); (e) an approved code of conduct pursuant to Article 40 together with binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards, including as regards data subjects' rights; or (f) an approved certification mechanism pursuant to Article 42 together with binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards, including as regards data subjects' rights.

Subject to the authorisation from the competent supervisory authority, the appropriate safeguards referred to in paragraph 1 may also be provided for, in particular, by: (a) contractual clauses between the controller or processor and the controller, processor or the recipient of the personal data in the third country or international organisation; or (b) provisions to be inserted into administrative arrangements between public authorities or bodies which include enforceable and effective data subject rights.

The supervisory authority shall apply the consistency mechanism referred to in Article 63 in the cases referred to in paragraph 3 of this Article.

Authorisations by a Member State or supervisory authority on the basis of Article 26(2) of Directive 95/46/EC shall remain valid until amended, replaced or repealed, if necessary, by that supervisory authority. Decisions adopted by the Commission on the basis of Article 26(4) of Directive 95/46/EC shall remain in force until amended, replaced or repealed, if necessary, by a Commission Decision adopted in accordance with paragraph 2 of this Article.

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

What does this mean for you?

Controller

If you have data processed in a country without an adequacy decision, you first choose an instrument from paragraph 2, for example the Commission's standard data protection clauses or binding corporate rules for transfers within your own group (recital 110). If you want to use your own contractual clauses, you need prior authorisation from the supervisory authority (paragraph 3). You may include the standard clauses in a wider contract and add extra safeguards, as long as they do not contradict the standard clauses or prejudice the rights of data subjects (recital 109).

Processor

This article applies directly to you as well: a processor that moves data outside the EU, for example to a sub-processor, must itself provide appropriate safeguards (paragraph 1). You can include the standard clauses in the contract with that other processor (recital 109).

Data Protection Officer

You assess whether the chosen instrument fits the transfer and whether data subjects actually have enforceable rights and effective legal remedies (paragraph 1). You keep track of which transfers rely on paragraph 2 and which on paragraph 3, because paragraph 3 requires authorisation from the supervisory authority.

Data Subject

The article requires that you keep enforceable rights and effective legal remedies after the transfer, for example to seek administrative or judicial redress or to claim compensation (paragraph 1 and recital 108).

Compliance checklist

For every transfer to a country without an adequacy decision, it is recorded which instrument from paragraph 2 or paragraph 3 provides the appropriate safeguards.Data subjects have enforceable rights and effective legal remedies for every transfer (paragraph 1).Standard clauses in use are the versions adopted or approved by the Commission (paragraph 2(c) and (d)) and contain no additions that contradict them (recital 109).Transfers within the group rely on binding corporate rules only if those rules have been approved in accordance with Article 47 (paragraph 2(b)).Where a code of conduct under Article 40 or a certification under Article 42 serves as the safeguard, binding and enforceable commitments of the recipient in the third country are documented (paragraph 2(e) and (f)).For own contractual clauses or administrative arrangements, prior authorisation from the competent supervisory authority has been obtained (paragraph 3).Authorisations and decisions dating from before the GDPR have been checked: they remain valid until amended, replaced or repealed (paragraph 5).

Related recitals

(108)

In the absence of an adequacy decision, the controller or processor should take measures to compensate for the lack of data protection in a third country by way of appropriate safeguards for the data ...

(109)

The possibility for the controller or processor to use standard data-protection clauses adopted by the Commission or by a supervisory authority should prevent controllers or processors neither from in...

(110)

A group of undertakings, or a group of enterprises engaged in a joint economic activity, should be able to make use of approved binding corporate rules for its international transfers from the Union t...

Cross-references

Art. 26: Joint controllers Art. 40: Codes of conduct Art. 42: Certification Art. 45: Transfers on the basis of an adequacy decision Art. 47: Binding corporate rules Art. 63: Consistency mechanism Art. 93: Committee procedure

Frequently asked questions

← Art. 45: Transfers on the basis of an adequacy decision Art. 47: Binding corporate rules →

Connections

Case law

Schrems II: Privacy Shield invalid, transfers under standard clauses only with essentially equivalent protection
2020-07-16 · final, Hof van Justitie van de EU (Grote kamer), Data Protection Commissioner tegen Facebook Ireland Ltd en Maximillian Schrems

Guidelines

Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR
2023-02-14 · final, European Data Protection Board (EDPB)
Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data
2021-06-18 · final, European Data Protection Board (EDPB)

Enforcement and fines

100 million euro fine for MLU B.V. (Yango) for transfers to Russia
2026-04-01 · status not established, Autoriteit Persoonsgegevens