[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:gdpr\u002F46":3},{"item":4,"lessons":16,"controls":65,"related":94},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"gdpr","46","Article 46","Transfers subject to appropriate safeguards",15,"General Data Protection Regulation","**What it asks for.** Without an adequacy decision, personal data may be transferred to a third country or international organisation only if the controller or processor provides appropriate safeguards and enforceable rights and effective legal remedies are available to individuals. Safeguards include standard data protection clauses adopted by the Commission, binding corporate rules, approved codes of conduct or certification mechanisms with binding commitments, and some arrangements requiring authority authorisation.\n\n**In practice.** Organisations put the current standard contractual clauses in place for relevant transfers, choosing the correct module, and assess whether the law and practice of the destination country allow the safeguards to work. Supplementary measures, such as encryption with keys held in the EEA, are added where needed. Evidence includes signed clauses, transfer impact assessments and a transfer register.\n\n**Common gaps.** Clauses are signed but the assessment of the destination country is missing. Older contracts may still rely on outdated clauses.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32016R0679#art_46","Read the article on EUR-Lex","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"thousands-of-unvetted-public-mcp-servers-expose-ai-supply-chain-risks","Thousands of Unvetted Public MCP Servers Expose AI Supply Chain Risks","2026-10-06T12:21:49.607+00:00",{"slug":23,"title":24,"published_at":25},"cjeu-strikes-down-eu-us-privacy-shield-validating-sccs-with-conditions","CJEU Strikes Down EU-US Privacy Shield, Validating SCCs with Conditions","2026-09-16T08:20:36.179+00:00",{"slug":27,"title":28,"published_at":29},"eu-commission-reprimanded-for-unlawful-data-transfers-via-microsoft-365","EU Commission Reprimanded for Unlawful Data Transfers via Microsoft 365","2026-07-17T14:20:59.934+00:00",{"slug":31,"title":32,"published_at":33},"schrems-ii-eu-us-privacy-shield-invalidated-over-mass-surveillance-concerns","Schrems II: EU-US Privacy Shield Invalidated Over Mass Surveillance Concerns","2026-07-17T14:20:42.188+00:00",{"slug":35,"title":36,"published_at":37},"eu-commission-fined-for-unlawful-data-transfers-to-us-via-third-party-services","EU Commission Fined for Unlawful Data Transfers to US via Third-Party Services","2026-07-08T12:20:41.39+00:00",{"slug":39,"title":40,"published_at":41},"tiktok-gdpr-violation-unlawful-eea-data-transfers-to-china-upheld-by-irish-high-court","TikTok GDPR Violation: Unlawful EEA Data Transfers to China Upheld by Irish High Court","2026-06-30T14:21:15.169+00:00",{"slug":43,"title":44,"published_at":45},"supreme-court-ruling-threatens-eu-us-data-transfer-framework","Supreme Court Ruling Threatens EU-US Data Transfer Framework","2026-06-30T06:20:51.58+00:00",{"slug":47,"title":48,"published_at":49},"eu-court-orders-commission-to-pay-400-for-unlawful-us-data-transfers-via-third-party-services","EU Court Orders Commission to Pay €400 for Unlawful US Data Transfers via Third-Party Services","2026-06-24T10:21:21.593+00:00",{"slug":51,"title":52,"published_at":53},"tiktoks-data-transfer-case-highlights-regulator-due-diligence-gaps-in-cross-border-data-flows","TikTok's Data Transfer Case Highlights Regulator Due Diligence Gaps in Cross-Border Data Flows","2026-06-24T10:21:05.874+00:00",{"slug":55,"title":56,"published_at":57},"cnpd-refuses-to-investigate-rocketreach-over-gdpr-data-sales","CNPD Refuses to Investigate Rocketreach Over GDPR Data Sales","2026-06-23T15:20:39.363+00:00",{"slug":59,"title":60,"published_at":61},"tiktok-fined-530m-for-unlawful-eea-data-transfers-to-china-1781691766185","TikTok Fined €530M for Unlawful EEA Data Transfers to China","2026-06-17T10:22:45.807+00:00",{"slug":63,"title":60,"published_at":64},"tiktok-fined-530m-for-unlawful-eea-data-transfers-to-china","2026-06-17T10:21:54.925+00:00",[66,71,76,80,85,90],{"slug":67,"name":68,"problem":69,"stories":70},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",7,{"slug":72,"name":73,"problem":74,"stories":75},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",6,{"slug":77,"name":78,"problem":79,"stories":75},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":81,"name":82,"problem":83,"stories":84},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",3,{"slug":86,"name":87,"problem":88,"stories":89},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",1,{"slug":91,"name":92,"problem":93,"stories":89},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[95,101,107,112,117,121,126,130],{"family":96,"item":97,"code":98,"title":99,"together":100},"iso","27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems",13,{"family":102,"item":103,"code":104,"title":105,"together":106},"cis","3","Control 3","Data Protection",12,{"family":108,"item":109,"code":110,"title":111,"together":106},"nist-privacy","overview","Privacy Framework","NIST Privacy Framework",{"family":5,"item":113,"code":114,"title":115,"together":116},"44","Article 44","General principle for transfers",10,{"family":118,"item":109,"code":119,"title":119,"together":120},"itil","ITIL",9,{"family":5,"item":122,"code":123,"title":124,"together":125},"30","Article 30","Records of processing activities",5,{"family":102,"item":127,"code":128,"title":129,"together":125},"15","Control 15","Service Provider Management",{"family":131,"item":132,"code":133,"title":134,"together":125},"nist-800-53","pt-7","PT-7","Specific Categories of Personally Identifiable Information"]