Any judgment of a court or tribunal and any decision of an administrative authority of a third country requiring a controller or processor to transfer or disclose personal data may only be recognised or enforceable in any manner if based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the Union or a Member State, without prejudice to other grounds for transfer pursuant to this Chapter.
Article 48 GDPR - Transfers or disclosures not authorised by Union law
Relevant Recitals
Frequently Asked Questions
Short answers to common questions about this provision. They are general information and not legal advice.
Article 48 provides that any judgment of a court or tribunal and any decision of an administrative authority of a third country requiring a controller or processor to transfer or disclose personal data may only be recognised or enforceable in any manner if based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the Union or a Member State. A foreign order therefore has no legal effect within the Union of its own force.
No. The order is recognisable or enforceable only if based on an international agreement in force, so absent such an agreement it provides neither recognition nor a transfer ground. Recital 115 reinforces this by addressing the extraterritorial application of third-country laws that would require disclosure without such a basis.
The text names a mutual legal assistance treaty as an example, using "such as", so the category is not closed. What matters is that an international agreement between the requesting third country and the Union or a Member State is in force and that the judgment or decision is based on it.
No. The closing words "without prejudice to other grounds for transfer pursuant to this Chapter" preserve the availability of Articles 45 to 49, so a disclosure responding to a third-country request might still be examined, for instance, under the derogations of Article 49. The Article governs the recognition and enforceability of the foreign order; it does not itself exhaust the lawfulness analysis, which also requires a legal basis under Article 6.
Yes. The Article refers to orders requiring "a controller or processor" to transfer or disclose personal data, so a processor served directly with a third-country demand is equally covered. This matters in practice for service providers holding data on behalf of Union controllers, since the processor cannot treat the foreign order as enforceable absent the requisite international agreement.