Counsel explores an approved code of conduct or certification mechanism, paired with binding enforceable commitments, to support transfers to a non-adequate recipient. How should that option be characterised?
Select an answer to reveal the explanation.
Short Explanation
Think of approved codes and certifications as another approved toolkit drawer for transfers—but only when the recipient is actually bound in a way people can enforce. A random wall plaque is not enough. Done right, they sit alongside SCCs and BCRs as possible Article 46-style pathways.
Full Explanation
Articles 46(2)(e) and (f) recognise approved codes of conduct and approved certification mechanisms, together with binding and enforceable commitments by the recipient, as possible appropriate safeguards for transfers. Counsel exploring that path is characterising a real Chapter V option—not a marketing gimmick—provided the code or certification is approved for that purpose and the enforceable commitments meet GDPR requirements. Civic and commercial exporters may consider these tools alongside SCCs and BCRs when they actually exist and fit the recipient.
Codes and certifications are not irrelevant to Chapter V. A generic ISO certificate does not automatically authorise unrestricted third-country transfers. Codes of conduct also do not replace the need for an Article 6 lawful basis for the underlying processing.
Exam caveat: transfer-ready codes/certifications require specific approval and binding commitments; ordinary security certificates alone are insufficient. Always pair safeguards with ongoing accountability.
Operational check: verify the instrument’s approval status and scope, obtain the recipient’s binding commitments, record the mechanism in the notice and RoPA, and monitor for suspension or withdrawal of the code/certification.