SOC 2 under GDPR Art. 46(2)(f)

Not a valid transfer tool under Article 46(2)(f). The only criteria approved for that purpose are Europrivacy's.

Invalidation trigger

SOC 2-based criteria are approved under Article 42 and recognised by the Board as a transfer tool.

Sources

1. [1]Regulation (EU) 2016/679 (GDPR), Art. 46(2)(f) · retrieved 2026-09-17 · https://eur-lex.europa.eu/eli/reg/2016/679/oj
2. [2]EDPB register of certification mechanisms, seals and marks (filtered on certification as tool for transfers), 1 item, Europrivacy Certification Scheme Extension for Certifying Data Importers under Article 46 · retrieved 2026-09-17 · https://www.edpb.europa.eu/registers/register-of-consistency-and-of-accountability-tools/certification-mechanisms-and-data_en

Confidence

high

Jurisdiction

European Union · coverage drafting

Permanent URL

/effect/european-union/gdpr-46-2-f/soc-2