UK GDPRUK · retained 2016/679
Digiphile
Regulation (EU) 2016/679 as retained in UK law (UK GDPR) – Article 46 – Transfers subject to appropriate safeguards

Articles

Article 46Transfers subject to appropriate safeguards

1. F1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
1A. [F2 A transfer of personal data to a third country or an international organisation by a controller or processor is made subject to appropriate safeguards only—
  • (a)
    in a case in which—
    • (i)
      safeguards are provided in connection with the transfer as described in paragraph 2 or 3 or regulations made under Article 47A(4), and
    • (ii)
      the controller or processor, acting reasonably and proportionately, considers that the data protection test is met in relation to the transfer or that type of transfer (see paragraph 6), or
  • (b)
    in a case in which—
    • (i)
      safeguards are provided in accordance with paragraph 2(a) by an instrument that is intended to be relied on in connection with the transfer or that type of transfer, and
    • (ii)
      each public body that is a party to the instrument, acting reasonably and proportionately, considers that the data protection test is met in relation to the transfers, or types of transfer, intended to be made in reliance on the instrument (see paragraph 6).]
2. The F3... safeguards referred to in [F4paragraph 1A(a)] may be provided for, without requiring any specific authorisation from [F5the [F6Commission]], by:
  • (a)
    a legally binding and enforceable instrument between [F7a public body and another relevant person or persons];
  • (b)
    binding corporate rules [F8approved] in accordance with Article 47;
  • (c)
    [F9 standard data protection clauses specified in regulations made by the Secretary of State under [F10Article 47A(1)] and for the time being in force;]
  • (d)
    [F11 standard data protection clauses specified in a document issued (and not withdrawn) by the [F6Commission] [F12for the purposes of this Article] under section 119A of the 2018 Act and for the time being in force;]
  • (e)
    an approved code of conduct pursuant to Article 40 together with binding and enforceable commitments of the controller or processor in the third country to apply the [F13safeguards provided by the code], including as regards data subjects' rights; or
  • (f)
    an approved certification mechanism pursuant to Article 42 together with binding and enforceable commitments of the controller or processor in the third country to apply the [F14safeguards provided by the mechanism], including as regards data subjects' rights.
3. [F15With authorisation from the [F6Commission]], the F16... safeguards referred to in [F17paragraph 1A(a)] may also be provided for F18... by:
  • (a)
    contractual clauses between the controller or processor and the controller, processor or the recipient of the personal data in the third country or international organisation; or
  • (b)
    provisions to be inserted into administrative arrangements between [F19a public body and another relevant person or persons] which include enforceable and effective data subject rights.
4. F20 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5. F20 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
6. [F21 For the purposes of this Article, the data protection test is met in relation to a transfer, or a type of transfer, of personal data if, after the transfer, the standard of the protection provided for the data subject with regard to that personal data by the safeguards required under paragraph 1A, and (where relevant) by other means, would not be materially lower than the standard of the protection provided for the data subject with regard to the personal data by or under—
  • (a)
    this Regulation,
  • (b)
    Part 2 of the 2018 Act, and
  • (c)
    Parts 5 to 7 of that Act, so far as relevant to processing to which this Regulation applies.
7. For the purposes of paragraph 1A(a)(ii) and (b)(ii), what is reasonable and proportionate is to be determined by reference to all the circumstances, or likely circumstances, of the transfer or type of transfer, including the nature and volume of the personal data transferred.
8. In this Article—
  • (a)
    references to the protection provided for the data subject are to that protection taken as a whole;
  • (b)
    “relevant person” means a public body or another person exercising functions of a public nature.]

Amended text

This Article is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.

Annotations and footnotes

Textual Amendments

  1. F1 Art. 46(1) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 7 para. 6(2); S.I. 2026/82, reg. 2(z9)
  2. F2 Art. 46(1A) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 7 para. 6(3); S.I. 2026/82, reg. 2(z9)
  3. F3 Word in Art. 46(2) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 7 para. 6(4)(a)(i); S.I. 2026/82, reg. 2(z9)
  4. F4 Words in Art. 46(2) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 7 para. 6(4)(a)(ii); S.I. 2026/82, reg. 2(z9)
  5. F5 Words in Art. 46(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 39(3)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  6. F6 Word in Art. 46(2)(3) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 41(3)(4)(s); S.I. 2026/1015, reg. 2(c)
  7. F7 Words in Art. 46(2)(a) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 7 para. 6(4)(b); S.I. 2026/82, reg. 2(z9)
  8. F8 Word in Art. 46(2)(b) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 7 para. 6(4)(c); S.I. 2026/82, reg. 2(z9)
  9. F9 Art. 46(2)(c) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 39(3)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  10. F10 Words in Art. 46(2)(c) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 7 para. 6(4)(d); S.I. 2026/82, reg. 2(z9)
  11. F11 Art. 46(2)(d) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 39(3)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  12. F12 Words in Art. 46(2)(d) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 7 (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)
  13. F13 Words in Art. 46(2)(e) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 7 para. 6(4)(e); S.I. 2026/82, reg. 2(z9)
  14. F14 Words in Art. 46(2)(f) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 7 para. 6(4)(f); S.I. 2026/82, reg. 2(z9)
  15. F15 Words in Art. 46(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 39(4) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  16. F16 Word in Art. 46(3) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 7 para. 6(5)(a); S.I. 2026/82, reg. 2(z9)
  17. F17 Words in Art. 46(3) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 7 para. 6(5)(b); S.I. 2026/82, reg. 2(z9)
  18. F18 Words in Art. 46(3) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 7 para. 6(5)(c); S.I. 2026/82, reg. 2(z9)
  19. F19 Words in Art. 46(3)(b) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 7 para. 6(5)(d); S.I. 2026/82, reg. 2(z9)
  20. F20 Art. 46(4)(5) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 39(5) (with reg. 5, Sch. 1 para. 80); 2020 c. 1, Sch. 5 para. 1(1)
  21. F21 Art. 46(6)-(8) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 7 para. 6(6); S.I. 2026/82, reg. 2(z9)

Related recitals

Rec. 108Rec. 109

https://uk-gdpr.digiphile.law/article/article-46.html

Text as at 17 September 2026.

This is an unofficial convenience version of the UK GDPR (Regulation (EU) 2016/679 as retained in UK law). It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.

Type to search the full text.