# Codes of conduct 40(3) — GDPR — provision context

> Focused context for a single provision (40(3)), curated from overview.legal on 2026-08-22. Canonical: https://overview.legal/laws/gdpr/art-40#par-3
> Verify against the official text (EUR-Lex / wetten.overheid.nl) before relying on it.

Part of **Codes of conduct** (GDPR, full article: https://overview.legal/laws/gdpr/art-40).

## Provision text

### 40(3)

In addition to adherence by controllers or processors subject to this Regulation, codes of conduct approved pursuant to paragraph 5 of this Article and having general validity pursuant to paragraph 9 of this Article may also be adhered to by controllers or processors that are not subject to this Regulation pursuant to Article 3 in order to provide appropriate safeguards within the framework of personal data transfers to third countries or international organisations under the terms referred to in point (e) of Article 46(2). Such controllers or processors shall make binding and enforceable commitments, via contractual or other legally binding instruments, to apply those appropriate safeguards including with regard to the rights of data subjects.


## Topics on this provision

- **International Transfer** — https://overview.legal/topics/internationale-doorgifte
  Transfer of personal data outside the EU/EEA
- **Personal Data** — https://overview.legal/topics/persoonsgegevens
  Information relating to identified or identifiable natural persons

## Cited by (exact-provision citations)

- **Guidelines 1/2019 on Codes of Conduct and Monitoring Bodies under Regulation 2016/679** (guidance) — https://overview.legal/posts/38051
- **Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR** (guidance) — https://overview.legal/posts/125866
- **EDPB Annual Report 2021** (guidance) — https://overview.legal/posts/125941

---
Generated by overview.legal · https://overview.legal/laws/gdpr/art-40#par-3 · 2026-08-22