Article 50 GDPR - International cooperation for the protection of personal data

In relation to third countries and international organisations, the Commission and supervisory authorities shall take appropriate steps to:
(a) develop international cooperation mechanisms to facilitate the effective enforcement of legislation for the protection of personal data;
(b) provide international mutual assistance in the enforcement of legislation for the protection of personal data, including through notification, complaint referral, investigative assistance and information exchange, subject to appropriate safeguards for the protection of personal data and other fundamental rights and freedoms;
(c) engage relevant stakeholders in discussion and activities aimed at furthering international cooperation in the enforcement of legislation for the protection of personal data;
(d) promote the exchange and documentation of personal data protection legislation and practice, including on jurisdictional conflicts with third countries.

Frequently Asked Questions

Short answers to common questions about this provision. They are general information and not legal advice.

It obliges the Commission and the supervisory authorities to take appropriate steps to develop international cooperation mechanisms, provide mutual assistance in enforcement, engage relevant stakeholders and promote the exchange and documentation of data protection legislation and practice. It is an institutional mandate directed at public bodies, not a rule addressed to controllers or processors.

Notification, complaint referral, investigative assistance and information exchange. All of these are expressly made subject to appropriate safeguards for the protection of personal data and other fundamental rights and freedoms, so the cooperation itself must not undermine the level of protection it serves.

No. Transfers by controllers and processors remain governed by Articles 44 to 49; Article 50 only frames how the Commission and supervisory authorities cooperate internationally on enforcement. Where an authority exchanges personal data in the course of mutual assistance, the safeguards required by point (b) apply to that exchange.

Point (c) requires the Commission and supervisory authorities to engage relevant stakeholders in discussion and activities aimed at furthering international enforcement cooperation. The provision does not define the stakeholders, which leaves room for industry, civil society and academic participants, but the engagement remains directed at enforcement cooperation rather than at policy generally.

Point (d) directs the Commission and supervisory authorities to promote the exchange and documentation of data protection legislation and practice, including on jurisdictional conflicts with third countries. It complements Article 48, which denies effect to third-country judgments and administrative decisions ordering disclosure unless based on an international agreement, by fostering the dialogue in which such conflicts can be managed.