Assessing Article 49 Derogations

Overview

Article 49 GDPR provides a limited set of derogations permitting international data transfers in the absence of an adequacy decision (Art. 45) or appropriate safeguards (Art. 46). The EDPB has consistently emphasised in Guidelines 2/2018 on derogations under Article 49 (adopted 25 May 2018, last updated 6 February 2018) that these derogations must be interpreted restrictively and are intended as exceptions rather than the rule. They cannot serve as a basis for systematic, large-scale, or regular transfers.

Derogation Conditions

Art. 49(1)(a) — Explicit Consent

Condition: The data subject has explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards.