GDPR Art. 49 EN
LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this article. Contains: the article text, related recitals, cases citing it, enforcement stats and top fines, guidance, and related topics. Everything links back to its source on overview.legal — legal information, not advice.

Derogations for specific situations

Personal Data Controllers Legitimate Interest International Transfer Lawful Basis Privacy Shield Codes of Conduct Supervisory Authorities
In force — consolidated2016-05-04 · CELEX 02016R0679-20160504 · ELI ↗
Version history 2
  • 2016-05-04in force CELEX 02016R0679-20160504
  • 2016-04-27 CELEX 32016R0679
  1. 1.

    In the absence of an adequacy decision pursuant to Article 45(3), or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only on one of the following conditions:

    Codes of Conduct Lawful Basis Legitimate Interest 27
    1. a)
      the data subject has explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards;
      Privacy Shield International Transfer Personal Data
    2. b)
      the transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of pre-contractual measures taken at the data subject's request;
      Controllers Personal Data
    3. c)
      the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and another natural or legal person;
      Controllers Personal Data
    4. d)
      the transfer is necessary for important reasons of public interest;
    5. e)
      the transfer is necessary for the establishment, exercise or defence of legal claims;
    6. f)
      the transfer is necessary in order to protect the vital interests of the data subject or of other persons, where the data subject is physically or legally incapable of giving consent;
      Lawful Basis Consent Personal Data
    7. g)
      the transfer is made from a register which according to Union or Member State law is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate a legitimate interest, but only to the extent that the conditions laid down by Union or Member State law for consultation are fulfilled in the particular case.
      Legitimate Interest
    8. Where a transfer could not be based on a provision in Article 45 or 46, including the provisions on binding corporate rules, and none of the derogations for a specific situation referred to in the first subparagraph of this paragraph is applicable, a transfer to a third country or an international organisation may take place only if the transfer is not repetitive, concerns only a limited number of data subjects, is necessary for the purposes of compelling legitimate interests pursued by the controller which are not overridden by the interests or rights and freedoms of the data subject, and the controller has assessed all the circumstances surrounding the data transfer and has on the basis of that assessment provided suitable safeguards with regard to the protection of personal data. The controller shall inform the supervisory authority of the transfer. The controller shall, in addition to providing the information referred to in Articles 13 and 14, inform the data subject of the transfer and on the compelling legitimate interests pursued.
      Personal Data Supervisory Authorities International Transfer
  2. 2.

    A transfer pursuant to point (g) of the first subparagraph of paragraph 1 shall not involve the entirety of the personal data or entire categories of the personal data contained in the register. Where the register is intended for consultation by persons having a legitimate interest, the transfer shall be made only at the request of those persons or if they are to be the recipients.

    Legitimate Interest Personal Data 1
  3. 3.

    Points (a), (b) and (c) of the first subparagraph of paragraph 1 and the second subparagraph thereof shall not apply to activities carried out by public authorities in the exercise of their public powers.

    11
  4. 4.

    The public interest referred to in point (d) of the first subparagraph of paragraph 1 shall be recognised in Union law or in the law of the Member State to which the controller is subject.

    Controllers 2
  5. 5.

    In the absence of an adequacy decision, Union or Member State law may, for important reasons of public interest, expressly set limits to the transfer of specific categories of personal data to a third country or an international organisation. Member States shall notify such provisions to the Commission.

    International Transfer Personal Data Privacy Shield
  6. 6.

    The controller or processor shall document the assessment as well as the suitable safeguards referred to in the second subparagraph of paragraph 1 of this Article in the records referred to in Article 30.

    Controllers Processors

Connections by provision

49(1) 20 Case Law 5 Guidance 2 Literature .md
Case Law 20
Judgment of the Court (Grand Chamber) of 5 June 2023.#European Commission v Republic of Poland.#Failure of a Member State to fulfil obligations – Second subparagraph of Article 19(1) TEU – Article 47 of the Charter of Fundamental Rights of the European Union ‐ Rule of law – Effective legal protection in the fields covered by EU law – Independence of judges – Article 267 TFEU – Possibility of making a reference to the Court for a preliminary ruling – Primacy of EU law – Jurisdiction in relation t Judgment of the Court (Grand Chamber) of 10 February 2026.#WhatsApp Ireland Ltd v European Data Protection Board.#Appeal – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 63 – Consistency mechanism – Article 65 – Dispute resolution by the European Data Protection Board – Binding decision – Action for annulment – First paragraph of Article 263 TFEU – Act open to challenge – Fourth paragraph of Article 263 TFEU – Condition that the Order of the Vice-President of the Court of 21 April 2023.#European Commission v Republic of Poland.#Interim relief – Article 163 of the Rules of Procedure of the Court of Justice – Application to cancel or vary an order for interim measures – Second subparagraph of Article 19(1) TEU – Article 47 of the Charter of Fundamental Rights of the European Union – Effective judicial protection – Independence of judges – Non-execution – Change in circumstances – Periodic penalty payment.#Case C-204/21 R- Order of the Vice-President of the Court of 27 October 2021.#European Commission v Republic of Poland.#Interim relief – Article 279 TFEU – Application for interim measures – Second subparagraph of Article 19(1) TEU – Article 47 of the Charter of Fundamental Rights of the European Union – Effective judicial protection – Independence of judges – Disciplinary regime for judges – Examination of questions of law concerning the lack of independence of judges – Periodic penalty payment.#Case C-204/21 R Order of the Vice-President of the Court of 14 July 2021.#European Commission v Republic of Poland.#Interim relief – Article 279 TFEU – Application for interim measures – Second subparagraph of Article 19(1) TEU – Independence of the Izba Dyscyplinarna (Disciplinary Chamber) of the Sąd Najwyższy (Supreme Court, Poland) – Charter of Fundamental Rights of the European Union – Article 47 – Effective judicial protection – Independence of judges – Disciplinary regime for judges – Examination of quest Spanish court reviews DPA decision on KFC Spain website privacy information and DPO ¶6 Judgment of the Court (First Chamber) of 18 December 2025.#Integritetsskyddsmyndigheten v AB Storstockholms Lokaltrafik.#Request for a preliminary ruling from the Högsta förvaltningsdomstolen.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Articles 13 and 14 – Scope – Personal data collected by means of body cameras worn by ticket inspectors on public transport – Legal basis for the obligation on the data controller to provide information to the dat ¶146 Judgment of the Court (Grand Chamber) of 21 June 2022.#Ligue des droits humains ASBL v Conseil des ministres.#Request for a preliminary ruling from the Cour constitutionnelle.#Reference for a preliminary ruling – Processing of personal data – Passenger Name Record (PNR) data – Regulation (EU) 2016/679 – Article 2(2)(d) – Scope – Directive (EU) 2016/681 – Use of PNR data of air passengers of flights operated between the European Union and third countries – Power to include data of air passengers +12 more
Guidance 5
Contribution of the EDPB to the evaluation of the GDPR under Article 97 EDPB-EDPS Joint Opinion 03/2021 on the Proposal for a regulation of the European Parliament and of the Council on European data governance (Data Governance Act) Joint Guidelines on the Interplay between the Digital Markets Act and the General Data Protection Regulation Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679 ¶140 EDPB-EDPS Joint Opinion 03/2021 on the Proposal for a regulation of the European Parliament and of the Council on European data governance (Data Governance Act)
Literature 2
Data Protection Regulation and International Arbitration: Can There Be Harmonious Coexistence (with the GDPR Requirements Concerning Cross-Border Data Transfer)? If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation
49(1)(a) 1 Literature .md
Literature 1
Data Protection Regulation and International Arbitration: Can There Be Harmonious Coexistence (with the GDPR Requirements Concerning Cross-Border Data Transfer)?
49(1)(b) 1 News .md
News 1
Is the DPC actually stopping Facebook's EU-US data transfers?! ..maybe half-way!
49(1)(d) 1 Case Law 2 Guidance .md
Case Law 1
Cour Administrative - 49701C
Guidance 2
Guidelines 02/2024 on Article 48 GDPR Guidelines 02/2024 on Article 48 GDPR
49(1)(e) 1 Literature .md
Literature 1
Data Protection Regulation and International Arbitration: Can There Be Harmonious Coexistence (with the GDPR Requirements Concerning Cross-Border Data Transfer)?
49(1)(g) 2 Guidance .md
Guidance 2
EDPB Document on response to the request from the European Commission for clarifications on the consistent application of the GDPR, focusing on health research ¶61 EDPB Document on response to the request from the European Commission for clarifications on the consistent application of the GDPR, focusing on health research
49(2) 1 News .md
News 1
A call to EU legislators: protect rights and reject the call to delete transparency safeguard in AI Act
49(3) 11 Case Law .md
Case Law 11
Judgment of the Court (Grand Chamber) of 5 March 2024.#Marián Kočner v European Union Agency for Law Enforcement Cooperation (Europol).#Appeal – Law enforcement cooperation – Regulation (EU) 2016/794 – Article 49(3) and Article 50 – Protection of personal data – Unlawful data processing – Criminal proceedings brought in Slovakia against the appellant – Expert’s report drawn up by the European Union Agency for Law Enforcement Cooperation (Europol) for the purposes of the investigation – Retrieval ¶83 Judgment of the Court (Grand Chamber) of 5 March 2024.#Marián Kočner v European Union Agency for Law Enforcement Cooperation (Europol).#Appeal – Law enforcement cooperation – Regulation (EU) 2016/794 – Article 49(3) and Article 50 – Protection of personal data – Unlawful data processing – Criminal proceedings brought in Slovakia against the appellant – Expert’s report drawn up by the European Union Agency for Law Enforcement Cooperation (Europol) for the purposes of the investigation – Retrieval ¶66 Judgment of the Court (Grand Chamber) of 5 March 2024.#Marián Kočner v European Union Agency for Law Enforcement Cooperation (Europol).#Appeal – Law enforcement cooperation – Regulation (EU) 2016/794 – Article 49(3) and Article 50 – Protection of personal data – Unlawful data processing – Criminal proceedings brought in Slovakia against the appellant – Expert’s report drawn up by the European Union Agency for Law Enforcement Cooperation (Europol) for the purposes of the investigation – Retrieval ¶71 Judgment of the Court (Grand Chamber) of 5 March 2024.#Marián Kočner v European Union Agency for Law Enforcement Cooperation (Europol).#Appeal – Law enforcement cooperation – Regulation (EU) 2016/794 – Article 49(3) and Article 50 – Protection of personal data – Unlawful data processing – Criminal proceedings brought in Slovakia against the appellant – Expert’s report drawn up by the European Union Agency for Law Enforcement Cooperation (Europol) for the purposes of the investigation – Retrieval ¶28 Judgment of the Court (Grand Chamber) of 5 March 2024.#Marián Kočner v European Union Agency for Law Enforcement Cooperation (Europol).#Appeal – Law enforcement cooperation – Regulation (EU) 2016/794 – Article 49(3) and Article 50 – Protection of personal data – Unlawful data processing – Criminal proceedings brought in Slovakia against the appellant – Expert’s report drawn up by the European Union Agency for Law Enforcement Cooperation (Europol) for the purposes of the investigation – Retrieval ¶29 Judgment of the Court (Grand Chamber) of 5 March 2024.#Marián Kočner v European Union Agency for Law Enforcement Cooperation (Europol).#Appeal – Law enforcement cooperation – Regulation (EU) 2016/794 – Article 49(3) and Article 50 – Protection of personal data – Unlawful data processing – Criminal proceedings brought in Slovakia against the appellant – Expert’s report drawn up by the European Union Agency for Law Enforcement Cooperation (Europol) for the purposes of the investigation – Retrieval ¶31 Judgment of the Court (Grand Chamber) of 5 March 2024.#Marián Kočner v European Union Agency for Law Enforcement Cooperation (Europol).#Appeal – Law enforcement cooperation – Regulation (EU) 2016/794 – Article 49(3) and Article 50 – Protection of personal data – Unlawful data processing – Criminal proceedings brought in Slovakia against the appellant – Expert’s report drawn up by the European Union Agency for Law Enforcement Cooperation (Europol) for the purposes of the investigation – Retrieval ¶42 Judgment of the Court (Grand Chamber) of 5 March 2024.#Marián Kočner v European Union Agency for Law Enforcement Cooperation (Europol).#Appeal – Law enforcement cooperation – Regulation (EU) 2016/794 – Article 49(3) and Article 50 – Protection of personal data – Unlawful data processing – Criminal proceedings brought in Slovakia against the appellant – Expert’s report drawn up by the European Union Agency for Law Enforcement Cooperation (Europol) for the purposes of the investigation – Retrieval +3 more
49(4) 2 Guidance .md
Guidance 2
Opinion 22/2024 on certain obligations following from the reliance on processor(s) and sub-processor(s) Statement 2/2024 on the financial data access and payments package