Transfers based on appropriate safeguards
In the absence of a decision under Article 45(3), a transfer of personal data to a third country or an international organization by a controller or processor may take place only if they provide appropriate safeguards and data subjects have enforceable rights and effective remedies.
The appropriate safeguards referred to in paragraph 1 may be provided by the following instruments, without requiring specific authorization from a supervisory authority:
A legally binding and enforceable instrument between government agencies or bodies;
binding corporate rules in accordance with Article 47;
standard data protection provisions adopted by the Commission in accordance with the examination procedure referred to in Article 93(2);
standard data protection provisions adopted by a supervisory authority and approved by the Commission in accordance with the examination procedure referred to in Article 93(2);
a code of conduct approved in accordance with Article 40, together with binding and enforceable commitments by the controller or processor in the third country to implement the appropriate safeguards, including for data subjects' rights; or
a certification mechanism approved in accordance with Article 42, together with binding and enforceable commitments by the controller or processor in the third country to implement the appropriate safeguards, including for data subjects' rights.
Subject to the approval of the competent supervisory authority, the appropriate safeguards referred to in paragraph 1 may also be provided by, in particular:
contractual clauses between the controller or processor and the controller, processor or recipient of the personal data in the third country or international organization; or
provisions to be included in administrative arrangements between government agencies or bodies, including enforceable and effective rights of data subjects.
The supervisory authority shall apply the coherence mechanism referred to in Article 63 in the cases specified in paragraph 3 of this Article.
Authorizations granted by a Member State or a supervisory authority pursuant to Article 26(2) of Directive 95/46/EC shall remain in force until amended, replaced or repealed, as appropriate, by that supervisory authority. Decisions adopted by the Commission pursuant to Article 26(4) of Directive 95/46/EC shall remain in force until amended, replaced or repealed, as appropriate, by a Commission decision adopted pursuant to paragraph 2 of this Article.
