Assessing Article 49 Derogations

Overview

Article 49 GDPR provides a limited set of derogations permitting international data transfers in the absence of an adequacy decision (Art. 45) or appropriate safeguards (Art. 46). The EDPB has consistently emphasised in Guidelines 2/2018 on derogations under Article 49 (adopted 25 May 2018, last updated 6 February 2018) that these derogations must be interpreted restrictively and are intended as exceptions rather than the rule. They cannot serve as a basis for systematic, large-scale, or regular transfers.

Derogation Conditions

Art. 49(1)(a) — Explicit Consent

Condition: The data subject has explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards.

Requirements:

1. Specific: Consent must specifically cover the transfer to the identified third country, not merely the processing activity itself.
2. Informed: The data subject must be told:
   • The specific third country or countries to which data will be transferred
   • The absence of an adequacy decision for that country
   • The absence of appropriate safeguards (SCCs, BCRs)
   • The specific risks arising from this (e.g., government access without EU-equivalent protections)