Guidelines 02/2024 on Article 48 GDPR

What it covers

These guidelines clarify the scope and objective of Article 48 GDPR, which governs recognition or enforcement of third country judgments and decisions requiring disclosure of personal data, and set out the conditions under which controllers and processors in the EU may respond to such requests, including compliance with Article 6 and Chapter V of the GDPR.

Why it matters

It is the key reference for organisations facing direct requests from foreign courts or authorities for personal data, clarifying that such disclosures are transfers requiring both a legal basis and a transfer ground.

Refer to it when

• receiving a request from a third country court or regulator for personal data
• assessing whether an international agreement provides a valid basis for disclosure
• determining which transfer ground applies to a disclosure request
• distinguishing Article 48 situations from other cross-border data flows

Questions this document addresses

• When does Article 48 apply to a request from a third country authority?
• What legal basis and transfer ground are needed to respond to such a request?
• How does Article 48 interact with Chapter V of the GDPR?
• What role do international agreements play in authorising disclosure?

Topics

• International transfers
• Lawful basis
• Enforcement