Article 46 of the GDPR: Appropriate guarantees for data transfers
Article 46 of the GDPR: Appropriate guarantees for data transfers
Summary
Article 46 of the GDPR provides that, in the absence of an adequacy decision, transfers of personal data to third countries can still be carried out, provided that the data controller or subcontractor provides appropriate guarantees.
Article 46 of the GDPR explained
When the destination country does not benefit from an adequacy decision, the following guarantees can be implemented:
- Standard Contractual Clauses (SCCs) adopted by the European Commission;
- Binding Corporate Rules (BCR) validated by protection authorities;
- Ad hoc contractual clauses approved by a supervisory authority;
- Binding and enforceable commitments of the recipient.
These guarantees must be accompanied by enforceable rights for data subjects and of effective remedies.
Why is this article important for your GDPR compliance?
Article 46 allows maintain protection equivalent to that provided by the GDPR, even outside the EU. It offers a legal solution to companies with international activities in the absence of an adequacy decision.
How to comply with Article 46 of the GDPR?
- Identify transfers outside the EU to unsuitable countries;
- Select the appropriate guarantee (CCT, BCR, approved clauses...);
- Verify that people's rights are guaranteed in practice;
- Document the entire process in your processing register.
Examples of application of Article 46 of the GDPR
- A company signs standard contractual clauses with a service provider based in India;
- An international group is setting up BCRs to regulate its internal data flows;
- A legal firm designs tailor-made clauses, validated by the CNIL, for an African client.
Related Resources
Accelerate your compliance in just a few clicks
With our all-in-one solution, you can accelerate and ensure compliance easily:
- Automate your compliance with our GDPR software
- Supported or outsourced by our DPO experts
- Raise awareness among your teams with our GDPR training e-learning
Assess your situation in 15 minutes with our free, no-obligation GDPR self-diagnosis.
