Article 46 GDPR
Transfers subject to appropriate safeguards

1. In the absence of a decision pursuant to Article 45(3), the controller or processor may transfer personal data to a third country or an international organization only if they provide appropriate safeguards and provided that enforceable rights of data subjects and effective legal remedies are available.

2. Adequate safeguards referred to in paragraph 1 may be provided, without special authorization from the supervisory authority, by means of:

(a) a legally binding and enforceable instrument between public authorities or entities;

(b) binding corporate rules in accordance with Article 47;

(c) standard data protection clauses adopted by the Commission in accordance with the examination procedure referred to in Article 93(2);

(d) standard data protection clauses adopted by the supervisory authority and approved by the Commission in accordance with the examination procedure referred to in Article 93(2);

(e) an approved code of conduct pursuant to Article 40, together with binding and enforceable commitments by the controller or processor in the third country to apply appropriate safeguards, including with regard to the rights of data subjects; or

(f) an approved certification mechanism in accordance with Article 42, including binding and enforceable commitments by the controller or processor in the third country to apply appropriate safeguards, including with regard to the rights of data subjects.

3.

*

Subject to approval by the competent supervisory authority, the appropriate safeguards referred to in paragraph 1 may also be ensured, in particular, by means of:

(a) contractual clauses between the controller or processor and the controller, processor or recipient of personal data in a third country or an international organisation; or

(b) provisions of administrative arrangements between public authorities or bodies providing for enforceable and effective rights of data subjects.

4. In the cases referred to in paragraph 3 of this Article, the supervisory authority shall apply the consistency mechanism referred to in Article 63.

5. Authorizations issued by a Member State or a supervisory authority pursuant to Article 26(2) of Directive 95/46/EC shall remain valid until they are amended, replaced, or repealed, as necessary, by that authority. Decisions adopted by the Commission pursuant to Article 26(4) of Directive 95/46/EC shall remain in force until they are amended, replaced, or repealed, as necessary, by a Commission decision adopted in accordance with paragraph 2 of this Article.