When no adequacy decision covers a destination, Article 46 of the GDPR lets you transfer personal data with appropriate safeguards. For most software companies that means standard contractual clauses. Binding corporate rules suit multinational groups. Codes of conduct and certifications exist but depend on approved schemes.
The common condition
Article 46(1) allows a transfer only if appropriate safeguards are in place and individuals have enforceable rights and effective legal remedies. Per the EDPB, the tool alone may not be enough: you still assess whether the destination's law undermines it. See the six step roadmap.
The options in Article 46(2)
- Public body instrument: a legally binding, enforceable instrument between public bodies. Used by public authorities.
- Binding corporate rules: rules binding a corporate group, approved under Article 47. Used by multinational groups.
- Commission standard clauses: model contract clauses adopted by the European Commission. Used by most vendors and customers.
- Supervisory authority clauses: clauses adopted by an authority and approved by the Commission. Rare in practice.
- Approved code of conduct: a code plus binding commitments from the importer. Used in sector schemes.
- Approved certification: a certification plus binding commitments from the importer. Used where a scheme exists.
None of these needs a specific authorisation from a supervisory authority, according to the text of Article 46(2).
Standard contractual clauses in practice
The Commission modernised the clauses on 4 June 2021 under Implementing Decision (EU) 2021/914, replacing three earlier sets. Its page says they apply to transfers from controllers or processors in the EU or EEA, or otherwise subject to the GDPR, to controllers or processors outside the EEA that are not subject to the GDPR. The Commission notes it is developing further sets for other cases.
For a developer this matters because clauses are signed per relationship. Your vendor list needs the signed clauses, the date and the annexes describing the data and security measures.
Binding corporate rules
BCRs are approved by the competent supervisory authority through the consistency mechanism. Article 47 requires them to be legally binding on every group member, to give individuals enforceable rights and to cover items such as the transfers concerned, liability, complaints, audits and training. They take time to get approved, which is why smaller companies rarely use them. They cover transfers inside the group only, not to outside vendors.
How to choose
- Is there an adequacy decision for this destination and recipient? Use it, and monitor it.
- Is it an intra group transfer in a large group? Consider BCRs.
- Otherwise, use the Commission's clauses with the right module and annexes.
- If an approved code or certification matches your sector, it can complement but check what the importer actually commits to.
- If none fits and the transfer is occasional, see Article 49 derogations.
Quick check
Are SCCs a complete answer?
No. They are a tool. You still assess the destination's laws and add supplementary measures where needed, per the EDPB.
Do we need regulator approval to use the standard clauses?
Article 46(2) says the Commission clauses need no specific authorisation from a supervisory authority.
Sources
This is educational content, not legal advice.
Last reviewed: 19 October 2026.
