Guidelines on Article 48 GDPR

Guidelines 02/2024 on Article 48 GDPR

This guidance outlines the interpretation and practical application of Article 48 GDPR. It clarifies that third‑country court or administrative decisions demanding personal data from EU controllers/processors are not enforceable absent a valid international agreement (e.g., MLAT) and compliance with GDPR Chapter V. It provides a two‑step test: (1) establish a legal basis under Article 6, and (2) identify a valid transfer mechanism (adequacy decision, safeguards, or derogation). It also gives procedural advice for dealing with such requests.