Data exporters may also rely on so-called “ad hoc clauses”,[1] which may for example address the situation where personal data are initially transferred by a controller to a processor within the EU and then subsequently transferred by the processor (data exporter) to a non-EU sub processor (data importer) and subsequent sub-processors. Data exporters aiming to use ad hoc clauses must obtain an authorisation from the competent supervisory authority (for example, the CNPD) which will coordinate with other supervisory authorities in accordance with the consistency mechanism set out in Article 63 of the GDPR.[2]
In accordance with Regulation n°7/2020 of 3 April 2020 of the CNPD laying down the amount and payment terms of the fees within the framework of its powers of authorisation and consultation, each controller or processor established on the territory of Luxembourg, who submits contractual clauses for authorisation to the CNPD pursuant to Article 46, paragraph 3, letter a) of the GDPR, must pay a fee of 1.500 € to the CNPD[3].
[1] Article 46, paragraph 3, letter a) of the GDPR.
[2] Article 46, paragraph 4 of the GDPR.
[3] Available at : https://cnpd.public.lu/content/dam/cnpd/fr/decisions-avis/2020/07-2020-reglement-CNPD-redevances-signe.pdf.