Article 46. Transfers on the basis of appropriate safeguards

(1) In the absence of a decision pursuant to art. 45(3), a controller or processor shall transfer personal data to another state or to an international organisation only if the controller or processor provides appropriate safeguards, and on condition that enforceable rights and effective legal remedies are available to data subjects.

(2) The appropriate safeguards referred to in paragraph (1) may be provided, without requiring any specific authorisation from the Centre, by:

1. a) a binding and enforceable legal act between public authorities or institutions;
2. b) binding corporate rules in accordance with art. 47;
3. c) standard data protection clauses approved by the Centre or adopted by the European Commission;
4. d) a code of conduct approved in accordance with art. 40, together with a binding and enforceable commitment of the controller or processor in another state to apply appropriate safeguards, including as regards the rights of data subjects; or
5. e) a certification mechanism approved in accordance with art. 42, together with a binding and enforceable commitment of the controller or processor in another state to apply appropriate safeguards, including as regards the rights of data subjects.

(3) Subject to authorisation from the Centre, the appropriate safeguards referred to in paragraph (1) may also be provided, in particular, by:

1. a) contractual clauses between the controller or processor and the controller, processor or recipient of the personal data in another state or the international organisation; or
2. b) provisions to be inserted into administrative arrangements between public authorities or institutions which provide for enforceable and effective rights for data subjects.