Guidelines 2/2020 on articles 46 (2) (a) and 46 (3) (b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies

Section 2.6  Sensitive data

44. If an international agreement provides for the transfer of sensitive personal data within the meaning of Article 9 (1) of the GDPR, additional safeguards addressing the specific risks, to be implemented by the receiving public body, should be included. These could, for example, include restrictions as access restrictions, restrictions of the purposes for which the information may be processed, restrictions on onward transfers, etc. or specific safeguards, e.g. additional security measures, requiring specialized training for staff allowed to access the information.