2.
Without prejudice to paragraph 1, a Member State may authorize a transfer or a set of transfers of personal data to a third country which does not ensure an adequate level of protection within the meaning of Article 25 (2), where the controller adduces adequate safeguards with respect to the protection of the privacy and fundamental rights and freedoms of individuals and as regards the exercise of the corresponding rights; such safeguards may in particular result from appropriate contractual clauses.
← (f) · All articles · 3. →
Source: EUR-Lex (Cellar) · retrieved 2026-10-09 · Text as adopted (Official Journal); later amendments are not incorporated in this text.