GDPR Art 46 (International Transfers) in Hotel RFPs (Plain English Definition + Examples)

Definition

GDPR Article 46 governs the lawful basis for transferring EU/EEA personal data to third countries without an adequacy decision — requiring appropriate safeguards such as Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), or approved certification schemes.

In European MICE sourcing, gdpr art 46 (international transfers) sits inside a broader workflow that includes the brief, the longlist, the shortlist, the contract negotiation, and the post-event reconciliation. Understanding it in isolation is not enough — what matters is how it interacts with the other levers a planner can pull. The definition above is the textbook version; the sections below explain how it actually behaves in real RFPs.

Why GDPR Art 46 (International Transfers) matters

Art 46 matters for any event involving non-EU venues, non-EU attendees, or non-EU sub-processors (US-based registration platforms, for example). The 2020 Schrems II decision invalidated the EU-US Privacy Shield and tightened SCC use; the 2023 EU-US Data Privacy Framework is now the primary US transfer mechanism, with SCCs as fallback. Always confirm the legal basis in the DPA before the data moves.

Example

EU pharma planner uses a US-based registration platform for a Madrid event. Attendee data flows EU → US daily. Legal basis: DPF certification of the US platform + SCCs in the DPA as fallback. Without these, the transfer is unlawful under Art 46 and the planner organization is exposed to fines up to 4% of global turnover.

Where GDPR Art 46 (International Transfers) appears in contracts

Art 46 mechanisms (SCCs, DPF, BCRs) are referenced in the DPA accompanying the hotel/vendor contract. Schedule the legal basis explicitly — do not assume the vendor's standard DPA covers it.

Related terms

Deeper reading