Guidelines on data transfers to third country authorities
On 5th June 2025, and following completion of a public consultation, the European Data Protection Board (“EDPB”) adopted the final version of the guidelines on data transfers to third country authorities, Guidelines 02/2024 on Article 48 GDPR | European Data Protection Board (“the Guidelines”).
The purpose of the Guidelines is to clarify the interaction between Article 48 of the GDPR and the remaining provisions of Chapter V of the GDPR on international transfers and Article 6 of the GDPR, which relates to legal bases.
Article 48 – transfer or disclosure of personal data
Article 48 of the GDPR makes provision for the transfer or disclosure of personal data to authorities in third countries. The type of situation covered by Article 48 would be where a judgment of a court or tribunal or a decision of an administrative authority in a third country requires an organisation in the EU to disclose personal data.
The Guidelines highlight that such foreign judgments and decisions are not automatically or directly enforceable in the EU, although if there is an applicable international agreement in place, such as a mutual legal assistance treaty, this will ensure enforceability e.g. the agreement between the European Union and the United States on the transfer of financial messaging data.
Who are the data transfer guidelines for?
The Guidelines focus on scenarios where requests for personal data are made by a third country authority to a private entity in the EU. For example, a law enforcement agency in India is requesting banking transaction information for a customer from an EU bank. They do not cover scenarios where personal data is requested from public authorities in the EU by authorities in third countries, such as is covered under a mutual legal assistance treaty.
Data processors & controllers
Before explaining the content of the Guidelines, it’s important to highlight that, whilst they are applicable to all organisations in the EU that receive requests for personal data from authorities in third countries, as always, a processor must notify their controller and follow their instructions, unless applicable law prohibits them from doing so.
Two-step process
The Guidelines explain that if a private entity receives a request for personal data under Article 48 of the GDPR, it shall follow a two-step process before releasing the data. In particular, the organisation must ensure that it has:
- A legal basis for the processing, in accordance with Article 6 of the GDPR
- Implemented safeguards for the international transfer, in accordance with Chapter V of the GDPR
International agreement – Steps 1 & 2
If there is an international agreement in place which is applicable to the given situation, this may provide for both a legal basis and safeguards for the transfer. For example, the agreement may set out a legal basis, such as a legal obligation under Article 6(1)(c) of the GDPR or public task under Article 6(1)(e) of the GDPR.
It may also set out grounds for the transfer, such as having a legally binding and enforceable instrument between public authorities or bodies under Article 46(2)(a) of the GDPR, bearing in mind that such instruments can also provide for direct co-operation between private entities and public authorities.
No international agreement – Step 1 – Legal Basis
If there is no international agreement in place, the organisation would need to identify a legal basis for sharing the data.
The Guidelines highlight that consent (Article 6(1)(a) of the GDPR) is unlikely to be appropriate, especially if authorities are exercising their enforcement powers, and contract (Article 6(1)(b) of the GDPR) cannot be relied upon by a private entity to release the data as the wording of this section does not lend itself to this type of processing.
In terms of legal obligation as a legal basis (Article 6(1)(c) of the GDPR), this could be relied upon if an international agreement were in place, as mentioned above.
In terms of relying on vital interests (Article 6(1)(d) of the GDPR) as a legal basis, the Guidelines indicate that this could be achieved but highlight that this “should in principle take place only where the processing cannot be manifestly based on another legal basis”, in accordance with Recital 46 of the GDPR.
With regards to legitimate interests as a suitable legal basis to rely on (Article 6(1) (f) of the GDPR), the Guidelines indicate that this may be appropriate, providing a legitimate interests assessment is carried out and confirm that, “In principle, any processing based on legitimate interest is in any case limited to what is demonstrably necessary to pursue this specific interest of the controller or the third party.”
No international agreement – Step 2 – Appropriate safeguards for the transfer
Once a legal basis has been identified and documented, it needs to be established what safeguards will be relied upon to ensure that the personal data will be appropriately protected when transferred. This is because Article 48 of the GDPR is not a ground for the transfer and if the third country does not have adequacy status (Article 45 of the GDPR), the organisation will need to implement appropriate safeguards such as those listed within Article 46 of the GDPR (e.g. binding corporate rules or EU standard contractual clauses) or, failing this, they may be able to rely on a derogation under Article 49 of the GDPR (e.g. the transfer is necessary for the performance of a contract between the data subject and the controller).
However, the Guidelines specify that the “derogations in Article 49 GDPR must be interpreted restrictively and mainly relate to processing activities that are occasional and non-repetitive.” Therefore, Article 49 derogations should not be routinely relied upon.
Summary
The Guidelines indicate that, where there is an international agreement in place, this is likely to set out the legal basis for the processing and the safeguards to be implemented for the transfer. However, in scenarios that are not covered by international agreements, it is important that the two-step process referred to above is adhered to.
If either of those steps is not followed, the transfer cannot lawfully take place. Therefore, if a legal basis cannot be identified and/or appropriate safeguards have not been implemented, such a transfer would be in breach of the GDPR and should not proceed.
Do you need help with data transfers?
If you’ve received a request for personal data from a third-party authority and need support in processing this or wish to be clear on what to do if you do receive such a request, we would be happy to assist.
