Art. 48 GDPR · Chapter V: Transfers of personal data to third countries or international organisations
Article 48 GDPR: Transfers or disclosures not authorised by Union law
Text as of 28 October 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the official text)
A judgment or decision of a third-country court, tribunal or administrative authority requiring a controller or processor to transfer or disclose personal data may only be recognised or enforced if based on an international agreement, such as a mutual legal assistance treaty, without prejudice to other grounds for transfer under Chapter V.
Official text
Any judgment of a court or tribunal and any decision of an administrative authority of a third country requiring a controller or processor to transfer or disclose personal data may only be recognised or enforceable in any manner if based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the Union or a Member State, without prejudice to other grounds for transfer pursuant to this Chapter.
Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu
Text as of 28 October 2026.
This is reference material, not legal advice.
Related recitals
This list is under review.
EDPB guidance
- Guidelines 02/2024 on Article 48 GDPR
EDPB 02/2024FinalFirst published 3 December 2024Final version 5 June 2025
Version 2 is final.