1. In the absence of adequacy regulations under section 17A of the 2018 Act, a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.
2. The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authorisation from the Commissioner, by:
(a) a legally binding and enforceable instrument between public authorities or bodies;
(b) binding corporate rules in accordance with Article 47;
(c) standard data protection clauses specified in regulations made by the Secretary of State under section 17C [Section 17C is inserted into the 2018 Act by these Regulations (see Sch. 2, para. 23).] of the 2018 Act and for the time being in force;
(d) standard data protection clauses specified in a document issued (and not withdra
…