In short. Analytics transfers under GDPR Article 46 require appropriate safeguards, enforceable rights and effective legal remedies, with destination-country assessment.
Definition: For analytics involving personal data, Article 46 of the General Data Protection Regulation (GDPR) permits transfers outside the European Economic Area (EEA), in the absence of an applicable adequacy decision, through appropriate safeguards such as standard contractual clauses. Individuals must also have enforceable rights and effective legal remedies.
Key facts
- GDPR Article 46 requires enforceable individual rights and effective legal remedies alongside appropriate safeguards.
- The Commission's transfer clauses require specific descriptions of technical and organisational measures in Annex II, including which measures apply to each transfer.
- As of 17 October 2026, the European Data Protection Board's international transfers guide explains that organisations sending the data must assess whether destination-country law or practice undermines the safeguards, with supplementary measures where needed.
Which safeguards does Article 46 recognise?
Under GDPR Article 46(2), the available instruments include Commission-adopted standard data protection clauses and clauses adopted by a supervisory authority and approved by the Commission. Standard contractual clauses (SCCs) are standardised contracts for providing transfer safeguards.
Binding corporate rules are another route. These are internal data protection policies for a corporate group; Article 47 requires supervisory approval and enforceable rights for individuals.
Article 46(2) also recognises approved codes of conduct and approved certification mechanisms, each accompanied by binding and enforceable commitments from the overseas recipient. It separately recognises legally binding and enforceable instruments between public authorities or bodies.
These routes require no specific supervisory authorisation for the transfer. Bespoke contractual clauses under Article 46(3)(a) require authorisation from the competent supervisory authority. Article 46(3)(b) also permits authorised provisions in administrative arrangements between public authorities or bodies, with enforceable and effective rights.
What should an analytics transfer agreement contain?
The Commission's Decision (EU) 2021/914 contains modules for different relationships. A controller determines processing purposes and means; a processor processes personal data on the controller's behalf. Module Two covers controller-to-processor transfers, while Module Three covers processor-to-processor transfers.
The exporter sends the data; the importer receives it. Annex I identifies these parties and their roles. Its transfer description records the categories of people and personal data, transfer frequency, processing purposes and retention period or criteria. For transfers to processors, it also specifies the subject matter, nature and duration of processing.
Annex II requires specific security measures. Its examples include encryption, access authorisation and event logging. For an analytics arrangement, the completed annex must describe the measures implemented by the recipient in terms specific to the processing and its risks.
Clause 14 requires a documented assessment of destination-country laws and practices. The assessment considers the processing chain, onward transfers, storage location and relevant additional contractual, technical or organisational safeguards. Under Clause 14(f), the exporter must suspend the transfer if it considers that appropriate safeguards cannot be ensured.
When do these requirements apply to analytics?
The EDPB's guide for small businesses identifies a transfer when an organisation subject to the GDPR for the processing makes personal data available to another organisation outside the EEA, or to an international organisation. Making data available can qualify alongside transmission.
The guide explains that transfer requirements apply alongside the other GDPR rules. Analytics processing still needs an appropriate legal basis, necessary security measures and data minimisation. A recipient acting as a processor still requires a processor contract.
Related terms
- What must an analytics processor contract cover under GDPR Article 28?
- Can GDPR Article 49 be used for routine website data transfers?
- GDPR lawful basis for web data
FAQ
Can visitors enforce the contractual safeguards themselves?
Under SCC Clause 3, individuals can enforce specified clauses as third-party beneficiaries against the exporter or importer, subject to listed exceptions. For Modules One to Three, Clause 18 also allows proceedings before courts in the individual's EU Member State of habitual residence.
Does using SCCs require individual approval from a regulator?
GDPR Article 46(2) permits the listed standard clauses without specific supervisory authorisation for the transfer. Bespoke clauses under Article 46(3)(a) require authorisation.
Can consent replace this assessment for routine analytics transfers?
The EDPB's transfer guide treats Article 49 derogations, including explicit consent, as exceptional routes subject to specific conditions. It says derogations must remain restricted to specific situations and recommends assessing adequacy decisions or appropriate safeguards first.
Sources
- European Parliament and Council, "General Data Protection Regulation", 27 April 2016
- European Commission, "Commission Implementing Decision (EU) 2021/914", 4 June 2021
- European Data Protection Board, "International data transfers", undated
Check how a page reads to answer engines. Open the GEO score analyzer