Appropriate Safeguards

Under GDPR Article 46, transfers to a country without an adequacy decision require 'appropriate safeguards' that ensure enforceable data subject rights and effective legal remedies. The main mechanisms are Standard Contractual Clauses, Binding Corporate Rules, approved codes of conduct, and approved certification mechanisms. Each must be paired with a transfer impact assessment showing that the destination country's law does not undermine the safeguard in practice — the Schrems II requirement.

Other regimes use similar devices with different names. The UK GDPR adopts its own International Data Transfer Agreement. ASEAN uses the ASEAN Model Contractual Clauses. Under the DPDP Act, Rule 15 does not operate on an 'appropriate safeguards' framework — transfers are permitted unless the destination is notified as restricted — but DPAs between the Fiduciary and its processors still carry the same practical function of binding the recipient to DPDP-equivalent handling.