Article 96 GDPR — Relationship with previously concluded Agreements

Article 96 GDPR is a transitional and grandfathering provision dealing with international agreements involving transfers of personal data to third countries or international organisations that were concluded by EU Member States before 24 May 2016.

The provision ensures legal continuity by protecting certain pre-existing international agreements from automatically becoming invalid merely because the GDPR later entered into force and became applicable.

Article 96 must be read together with:

Recital 102 GDPR;
Articles 44, 50 GDPR (international transfers);
Article 16 TFEU;
Articles 7, 8 and 47 of the Charter of Fundamental Rights of the European Union (CFR);
Directive 95/46/EC (the predecessor Data Protection Directive).

1. Text and Purpose of Article 96

Article 96 provides:

International agreements involving the transfer of personal data to third countries or international organisations which were concluded by Member States prior to 24 May 2016, and which comply with Union law as applicable prior to that date, shall remain in force until amended, replaced or revoked.

The central purpose of this provision is to avoid legal disruption.

When the GDPR was adopted in 2016 and later became applicable in 2018, numerous Member States were already parties to international agreements involving personal-data transfers.

Without Article 96, there would have been uncertainty regarding whether such agreements remained valid after the GDPR came into effect.

Article 96 therefore acts as a transitional safeguard.

2. Scope of Article 96

The provision applies only if all of the following conditions are met:

1. There is an international agreement

The instrument must be an international agreement concluded by a Member State.

This may include:

bilateral treaties;
multilateral treaties;
cooperation agreements;
law-enforcement cooperation arrangements;
administrative cooperation treaties.

3. The agreement involves transfers of personal data

The agreement must involve the transfer of personal data to:

a third country; or
an international organisation.

If no personal-data transfer is involved, Article 96 is irrelevant.

4. The agreement was concluded before 24 May 2016

The relevant cut-off date is:

24 May 2016

This is the date on which the GDPR entered into force.

Agreements concluded after that date do not benefit from Article 96.

Any later agreement must comply directly with the GDPR framework and other applicable Union law.

5. The agreement complied with EU law applicable before 24 May 2016

This is the most important requirement.

Article 96 does not automatically preserve every historical agreement.

Only agreements that were lawful under EU law as it existed before the GDPR may continue to benefit from the provision.

6. What Law Must the Agreement Comply With?

The test is not GDPR compliance.

Instead, the agreement must comply with the legal framework applicable before 24 May 2016.

That framework includes:

Primary EU Law

Including:

Article 16 TFEU;
Article 7 CFR (respect for private life);
Article 8 CFR (protection of personal data);
Article 47 CFR (effective judicial remedy).

7. Secondary EU Law

Most importantly:

Directive 95/46/EC (Data Protection Directive).

Accordingly, an agreement inconsistent with pre-GDPR EU data protection law would not qualify for the protection of Article 96.

8. Grandfathering Effect

Article 96 effectively "grandfathers" qualifying agreements.

This means that they continue to remain legally effective even if they might not fully align with all GDPR requirements.

The rationale is legal certainty.

International agreements are often complex diplomatic instruments that cannot always be renegotiated immediately upon legislative change within the EU.

Article 96 therefore prevents automatic invalidation.

9. Example

Assume that:

A Member State concluded a data-sharing treaty with a third country in 2012.
The treaty complied with EU law and Directive 95/46/EC at that time.
The GDPR later introduced stricter transfer requirements.

Article 96 may allow the treaty to continue operating even if certain GDPR provisions would otherwise raise compatibility questions.

Chapter V GDPR regulates transfers of personal data outside the EU.

Normally, transfers require:

an adequacy decision;
appropriate safeguards;
or a derogation.

Article 96 serves as a specific exception for protected historical agreements.

Thus, the legitimacy of the agreement does not depend primarily on whether it fits neatly within current Chapter V mechanisms.

Instead, the key question is whether it satisfied applicable EU law before 24 May 2016.

11. Article 96 Is Temporary Protection, Not Permanent Immunity

A crucial feature of Article 96 is the wording:

"until amended, replaced or revoked"

This means protection is not indefinite.

The grandfathering effect continues only while the original agreement remains in force in substantially its original form.

12. Amendment

If an agreement is amended, the question arises whether the amended provisions continue to benefit from Article 96.

In practice, significant amendments may trigger reassessment under current EU law.

The further an amendment departs from the original protected agreement, the harder it becomes to rely on Article 96.

13. Replacement

If a treaty is replaced with a new treaty, Article 96 protection generally ends.

The replacement agreement would normally need to comply with the contemporary GDPR and broader EU framework.

14. Example

A Member State concludes:

Treaty A in 2014.

Treaty A benefits from Article 96.

In 2027 the treaty is terminated and replaced by Treaty B.

Treaty B would not automatically enjoy Article 96 protection because it was not concluded before 24 May 2016.

15. Revocation

If an agreement is revoked or terminated, the protection naturally disappears.

Once revoked, there is no agreement left to protect.

Any future transfer mechanism would need an independent legal basis under applicable EU law.

16. Recital 102

Recital 102 explains the broader context of international agreements involving personal-data transfers.

It states that the GDPR is:

"without prejudice to international agreements concluded between the Union and third countries regulating the transfer of personal data including appropriate safeguards for the data subjects."

The Recital distinguishes between:

Agreements concluded by the European Union

and

Agreements concluded by Member States

In both cases, personal-data transfers should involve appropriate safeguards protecting the rights and freedoms of data subjects.

17. Relationship with EU Competence

Article 96 should also be understood against the constitutional background of EU external relations.

Data protection has increasingly become an area of EU competence.

Consequently, Member States cannot freely conclude new international agreements affecting areas governed by EU law without respecting Union rules.

Article 96 therefore serves primarily as a transitional mechanism protecting historical arrangements rather than encouraging the creation of new standalone Member State data-transfer treaties.

18. Practical Significance

Article 96 is not frequently litigated, but it remains important for several reasons.

Existing Bilateral Agreements

Some Member States entered into long-standing cooperation agreements with non-EU countries before 2016.

Article 96 helps preserve their legal validity.

Legal Certainty

The provision avoids sudden disruption of international administrative and governmental cooperation.

Transitional Function

It facilitated the transition from:

Directive 95/46/EC

GDPR.

Without Article 96, legal uncertainty could have arisen regarding many pre-existing transfer arrangements.

19. Relationship with Schrems Jurisprudence

Although Article 96 protects certain historical agreements, it does not override:

the Treaties;
the Charter;
fundamental rights requirements.

Thus, if an agreement were fundamentally incompatible with EU constitutional standards, Article 96 should not be read as immunising it from judicial scrutiny.

The requirement that the agreement must have complied with prior EU law already reflects this limitation.

20. Key Takeaways

Article 96 is a grandfathering provision for pre-existing international agreements involving personal-data transfers.
It applies only to agreements concluded by Member States before 24 May 2016.
The agreement must have complied with EU law applicable before the GDPR, including Directive 95/46/EC and the EU Charter.
The legality test is based on pre-GDPR law, not on current GDPR requirements.
Protected agreements remain in force even if tensions with certain GDPR provisions may exist.
The protection lasts only until the agreement is amended, replaced, or revoked.
New agreements or replacement agreements do not automatically benefit from Article 96.
Article 96 is primarily a legal continuity and transition mechanism, ensuring that historical international transfer agreements were not automatically invalidated when the GDPR replaced the former data protection framework.