§ 47 NDSG
Data transfer subject to appropriate safeguards
(1)Where, contrary to § 46(1) number 2, no adequacy decision pursuant to Article 36(3) of Directive (EU) 2016/680 has been adopted, a transfer shall also be lawful where the other conditions of § 46 are met if
(2)a legally binding instrument provides appropriate safeguards for the protection of personal data, or
(3)the controller, having assessed all the circumstances surrounding the transfer, has concluded that appropriate safeguards exist for the protection of personal data.
(4)1The controller shall document transfers pursuant to paragraph 1 number 2. 2The documentation shall contain the time of the transfer, information about the receiving competent authority, the reason for the transfer and the personal data transferred. 3It shall be made available to the authority headed by the Land Commissioner for Data Protection upon request.
(5)1The controller shall inform the authority headed by the Land Commissioner for Data Protection at least annually of transfers that have been made on the basis of an assessment pursuant to paragraph 1 number 2. 2In the notification, the controller may categorise the recipients and the transfer purposes in an appropriate manner.