---
title: "Art. 48 GDPR: Transfers or disclosures not authorised by Union law"
canonical: "https://dposchool.com/gdpr/article/48"
source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_48"
source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en"
publisher: "DPO School"
---

Art. 48 GDPR · Chapter V: Transfers of personal data to third countries or international organisations

# Article 48 GDPR: Transfers or disclosures not authorised by Union law

Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review)

## Summary (not the official text)

A judgment or decision of a third-country court, tribunal or administrative authority requiring a controller or processor to transfer or disclose personal data may only be recognised or enforced if based on an international agreement, such as a mutual legal assistance treaty, without prejudice to other grounds for transfer under Chapter V.

## Official text

Any judgment of a court or tribunal and any decision of an administrative authority of a third country requiring a controller or processor to transfer or disclose personal data may only be recognised or enforceable in any manner if based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the Union or a Member State, without prejudice to other grounds for transfer pursuant to this Chapter.

## Source

Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu

[Article 48 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_48)

Text as of 28 October 2026.

This is reference material, not legal advice.

## Related recitals

This list is under review.

- [Recital 115](https://dposchool.com/gdpr/recital/115)

## EDPB guidance

### [Guidelines 02/2024 on Article 48 GDPR](https://dposchool.com/gdpr/guidance/edpb-02-2024)

EDPB 02/2024 · Final · First published 3 December 2024 · Final version 5 June 2025

Version 2 is final.

[Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-022024-on-article-48-gdpr_en)

## Navigation

[GDPR Navigator](https://dposchool.com/gdpr) / [Chapter V](https://dposchool.com/gdpr/chapter/5) / Article 48

Previous: [Art. 47 GDPR: Binding corporate rules](https://dposchool.com/gdpr/article/47)

Next: [Art. 49 GDPR: Derogations for specific situations](https://dposchool.com/gdpr/article/49)

Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/gdpr/llms.txt
- JSON API: https://dposchool.com/gdpr/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents