Official guidance · EDPB Recommendations 01/2020, para. 30
Transfer impact assessment and supplementary measures
In plain English
Before relying on a transfer tool such as standard contractual clauses, the exporter checks whether the destination country's law or practice could undermine it, and if so adds measures to keep protection essentially equivalent.
The official text
You must first assess, where appropriate in collaboration with the importer, if there is anything in the law and/or practices in force … in the third country that may impinge on the effectiveness of the appropriate safeguards of the Article 46 GDPR transfer tool you are relying on, in the context of your specific transfer.
If your assessment under Step 3 has revealed that your Article 46 GDPR transfer tool is not effective, then you will need to consider, where appropriate in collaboration with the importer, if supplementary measures exist, which, when added to the safeguards contained in transfer tools, could ensure that the data transferred is afforded in the third country a level of protection essentially equivalent to that guaranteed within the EU.
a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available
26 decisions on Fino cite Article 46 GDPR. See them →
Related
The official text is quoted word for word from the English version of the source named under it; only the version published in the Official Journal of the EU is legally binding. The plain-English line is Fino’s own summary, not legal advice.