Set by the law · GDPR Art. 46(1)
Appropriate safeguards
In plain English
Without an adequacy decision, data may go outside the EU only with appropriate safeguards, such as standard contractual clauses or binding corporate rules, and with enforceable rights and effective remedies for people.
The official text
In the absence of a decision pursuant to Article 45(3), a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.
The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authorisation from a supervisory authority, by: … (b) binding corporate rules in accordance with Article 47; (c) standard data protection clauses adopted by the Commission
26 decisions on Fino cite Article 46 GDPR. See them →
Related
The official text is quoted word for word from the English version of the source named under it; only the version published in the Official Journal of the EU is legally binding. The plain-English line is Fino’s own summary, not legal advice.