Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679

What it covers

These guidelines interpret each of the derogations for specific situations set out in Article 49 GDPR that allow transfers of personal data to third countries in the absence of an adequacy decision or appropriate safeguards. It explains the conditions for explicit consent, contractual necessity, public interest, legal claims, vital interests and the public register derogation, and clarifies the meaning of occasional and not-repetitive transfers and the necessity test.

Why it matters

It is the primary EDPB reference for when an organisation may rely on an Article 49 derogation rather than Article 45 or 46 mechanisms, and stresses that derogations must be construed narrowly.

Refer to it when

• assessing whether a one-off international transfer can rely on Article 49
• determining whether consent for a transfer meets the additional Article 49(1)(a) requirements
• distinguishing occasional from repetitive transfers
• understanding the interaction between Article 48 and third-country authority requests

Questions this document addresses

• What conditions must explicit consent meet to justify a transfer under Article 49(1)(a)?
• When is a transfer 'necessary for performance of a contract' under Article 49(1)(b) or (c)?
• What does 'occasional' and 'not repetitive' mean for the contract and legal-claims derogations?
• How does Article 48 interact with the derogations under Article 49?
• When can compelling legitimate interests justify a transfer?

Topics

• International transfers
• Consent
• Lawful basis