Appropriate safeguards
Appropriate safeguards are the transfer mechanisms listed in Art. 46 GDPR that allow personal data to be transferred to a third country in the absence of an adequacy decision, provided enforceable data subject rights and effective remedies are available.
The main instruments are standard contractual clauses adopted by the European Commission, binding corporate rules for intra-group transfers, approved codes of conduct and certification mechanisms, and, for public bodies, legally binding administrative arrangements. Since the Schrems II judgment (C-311/18), each safeguard must be accompanied by a transfer impact assessment and, where necessary, supplementary measures such as encryption or pseudonymisation with keys held in the EEA.
The GDPR also uses the phrase in other contexts: Art. 89 requires appropriate safeguards for processing for scientific research purposes, and Art. 9(2)(j) requires them for special category data processed for research. For a global clinical trial, the same data flow to a US sponsor may therefore need transfer safeguards under Art. 46 and research safeguards under Art. 89 at the same time.
No. Research safeguards protect people in the conduct of research, while transfer safeguards address disclosure to recipients outside the EEA. A multinational study may need both. For example, coding participant records does not itself establish an Article 46 transfer mechanism, and signed transfer clauses do not replace appropriate controls within the study.
