In the absence of a decision pursuant to Article 45(3), a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards and, on condition that enforceable data subject rights and effective legal remedies for data subjects are available.

The appropriate safeguards may be provided without specific supervisory authorisation by: (a) a legally binding and enforceable instrument between public authorities or bodies; (b) binding corporate rules in accordance with Article 47; (c) standard data protection clauses adopted by the Commission; (d) standard data protection clauses adopted by a supervisory authority and approved by the Commission; (e) an approved code of conduct together with binding and enforceable commitments in the third country; or (f) an approved certification mechanism together with binding and enforceable commitments. Subject to supervisory authorisation, safeguards may also be provided by contractual clauses or enforceable provisions in administrative arrangements; the supervisory authority shall apply the consistency mechanism in Article 63 in those cases. Authorisations under Article 26(2) of Directive 95/46/EC remain valid until amended, replaced or repealed, and Commission decisions under Article 26(4) of Directive 95/46/EC remain in force until amended, replaced or repealed.