When relying on private sector safeguards (e.g., binding corporate rules), a prior authorisation is needed from the national data protection authority to ensure that the exported data is sufficiently protected. This entails a combination of private and government level safeguards. Note that when invoking pre-approved standard contractual clauses, authorisation may not be needed but notification is nonetheless required. See also: Directive 95/46/EC on the protection of individuals with regard to the processing of personal data, Article 26.