Managing Consent for Transfers

Overview

GDPR Article 49(1)(a) provides that in the absence of an adequacy decision (Article 45) or appropriate safeguards (Article 46), a transfer of personal data to a third country may take place if "the data subject has explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards."

This is a derogation — a last resort — not a primary transfer mechanism. The EDPB Guidelines 2/2018 on derogations under Article 49 emphasize that derogations must be interpreted restrictively and should not become the rule.

Explicit Consent Requirements for Transfers

What Makes Transfer Consent "Explicit"

Explicit consent under Article 49(1)(a) requires a higher standard than standard consent under Article 6(1)(a):

1. Express statement: The data subject must make an express statement of consent specifically for the transfer. An unticked checkbox is sufficient for standard consent but may not be sufficient for explicit consent — a written or typed declaration is preferred.
2. Specific to the transfer: Consent must specifically mention the international transfer, not be buried in general terms.
3. Informed of risks: The data subject must be told about the specific risks of the transfer, not just generic warnings.
4. Specific destination: The third country or countries must be named.
5. Absence disclosed: The data subject must be told that there is no adequacy decision and no appropriate safeguards in place for the destination.