Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD) Art. 42: Obtain AEPD authorisation for transfers on non-standard clauses or non-binding public-sector arrangements

What does Art. 42 require?

Articles 40 to 42: transfers follow the GDPR, this law, government rules and authority circulars; authorities may adopt standard clauses and approve binding corporate rules (nine-month procedure); transfers to non-adequate countries without GDPR 46.2 safeguards need prior authorisation by the AEPD or regional authority where based on contractual clauses other than standard clauses, or for Article 77.1 public bodies on non-binding international arrangements with enforceable rights; the procedure lasts up to six months, suspended for the EDPB opinion.