Transfers from a Luxembourg public authority or body to another public authority or body in a third country (i.e. outside the European Economic Area) may take place:
- with a legally binding and enforceable instrument between public authorities or bodies, without requiring any specific authorisation from the CNPD, or
- with provisions to be inserted into administrative arrangements between public authorities or bodies which include enforceable and effective data subject rights. These provisions have to be submitted to the CNPD according to Article 46 (3) (b) of the GDPR and subsequently these clauses will have to be approved by the European Data Protection Board in accordance with Article 46 (4) of the GDPR through the consistency mechanism.