Without an adequacy decision, GDPR Article 46 allows a transfer of personal data to a third country only if appropriate safeguards are in place, with enforceable rights and effective remedies for the people concerned. The main tools are standard contractual clauses and binding corporate rules.
The safeguards listed in Article 46
Several need no specific approval from a supervisory authority:
- A legally binding instrument between public bodies.
- Binding corporate rules that meet Article 47.
- Standard clauses adopted by the European Commission.
- Standard clauses adopted by a supervisory authority and approved by the Commission.
- An approved code of conduct with binding commitments from the recipient.
- An approved certification mechanism with binding commitments from the recipient.
Others, such as bespoke contractual clauses, require authorisation from the competent supervisory authority.
Where adequacy fits in
Article 46 applies when there is no adequacy decision under Article 45(3). If the Commission has decided that a country ensures adequate protection, a transfer to that destination does not need these extra safeguards. For the United States, the relevant decision relates to the EU US Data Privacy Framework.
Status of the US framework, as reported
According to a law firm summary, the EU General Court dismissed a challenge to the framework on 3 September 2025, and the applicant appealed to the Court of Justice on 31 October 2025. A report dated June 2026 described the appeal as still pending, so check the Court of Justice register for the current status before relying on the framework. The same summary advises organisations to monitor the appeal, keep mapping US bound data flows and keep an alternative mechanism such as standard clauses available.
A practical transfer checklist
- Map every flow of EU personal data to a country outside the EU, including remote access by support staff.
- For each, record the mechanism: adequacy, standard clauses, BCRs or other.
- Check the vendor's certification status if you rely on the framework, and write down the date you checked.
- Keep standard clauses signed as a fallback where you can.
- Reflect the transfers in your record of processing and privacy notice.
- Review the list when you add a vendor or region.
Why the paperwork matters
Transfers to third countries sit in the upper fine tier under Article 83(5). See GDPR fines explained.
Quick check
Is remote access from outside the EU a transfer?
Making data accessible from outside is commonly treated as a transfer. Confirm with your counsel and regulator guidance.
Are standard clauses enough on their own?
The article requires appropriate safeguards and effective remedies. Whether extra assessment is needed depends on the destination, so seek advice.
Sources
- GDPR Article 46, transfers subject to appropriate safeguards
- GDPR Article 83, fines
- WilmerHale, European Court of Justice to review challenge to EU US Data Privacy Framework
Last reviewed: 19 October 2026.
