Guidelines 04/2021 on Codes of Conduct as tools for transfers

What it covers

These guidelines specify the application of Article 40(3) GDPR, explaining how codes of conduct can be used as an appropriate safeguard for international transfers under Article 46(2)(e), including required content, the roles of code owners, monitoring bodies, supervisory authorities and the EDPB, and the adoption process for a transfer-specific code.

Why it matters

It gives organisations a practical route to design and adopt codes of conduct as an alternative to standard contractual clauses or binding corporate rules for framing international data transfers.

Refer to it when

• considering a code of conduct as a transfer mechanism instead of BCRs or standard contractual clauses
• drafting binding commitments for a third-country data importer
• understanding the roles of code owner and monitoring body in a transfer code
• amending an existing GDPR code to also cover transfers

Questions this document addresses

• What must a code of conduct contain to serve as a transfer tool under Article 46(2)(e)?
• Who are the actors involved in setting up and approving a transfer code of conduct?
• What binding and enforceable commitments must third-country adherents make?
• How does a code of conduct differ from binding corporate rules for framing transfers?

Topics

• International transfers
• Codes of conduct
• Controller & processor