GDPR Controller and Processor Obligations, Breach Notification, and Transfers — Articles 24 to 49

GDPR Chapter IV (Articles 24 to 43) gives the obligations of controllers and processors. Articles 44 to 49 of Chapter V give the rules for transfers of personal data to third countries or international organizations. Chapter IV contains the general obligations and the security of personal data. It also contains the data protection impact assessment and prior consultation, the data protection officer, and the codes of conduct and certification. For Article 27, the representative of a controller or processor that is not established in the Union, see GDPR Scope and Applicability.

The Digital Omnibus proposal (European Commission, COM(2025) 837, 19 November 2025), not law as of October 2026, contains changes to GDPR Articles 33 and 35, and to other Articles.

Article 24 — responsibility of the controller

In GDPR Article 24(1), the controller has the general obligation to “implement” measures for compliance and to be able to demonstrate compliance:

Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. Those measures shall be reviewed and updated where necessary.

“Where proportionate in relation to processing activities”, these measures must include “appropriate” data protection policies of the controller (Article 24(2)). The controller can use “adherence” to an approved code of conduct (Article 40) or an approved certification mechanism (Article 42) as “an element by which to demonstrate compliance” (Article 24(3)).

Article 25 — data protection by design and by default

GDPR Article 25 sets obligations for the controller. By design (Article 25(1)), the controller must “implement appropriate technical and organisational measures” at two times:

• “at the time of the determination of the means for processing”
• “at the time of the processing itself”.

These measures, “such as pseudonymisation”, must “implement” the data protection principles, “such as data minimisation”, “in an effective manner”. They must also add the necessary safeguards to the processing, “in order to meet the requirements of this Regulation and protect the rights of data subjects”. To select the measures, the controller examines the state of the art and “the cost of implementation”. It also examines “the nature, scope, context and purposes of processing”, and the “risks of varying likelihood and severity” for the rights and freedoms of natural persons.

By default (Article 25(2)), the measures must make sure that the controller processes only the personal data that are necessary “for each specific purpose of the processing”. This obligation applies to the quantity of personal data collected, “the extent of their processing, the period of their storage and their accessibility”. “In particular”, by default, the measures must make sure that personal data are not made “accessible without the individual's intervention to an indefinite number of natural persons”.

An approved certification mechanism (Article 42) can be “an element” to demonstrate compliance with Article 25(1) and (2) (Article 25(3)). The European Data Protection Board (EDPB) gives guidelines on Article 25 in “Guidelines 4/2019 on Article 25 Data Protection by Design and by Default”, “Version 2.0”. These guidelines are not binding law.

Article 26 — joint controllers

GDPR Article 26(1) applies when two or more controllers “jointly determine the purposes and means of processing”. These controllers are joint controllers. They must “in a transparent manner determine their respective responsibilities for compliance with the obligations under this Regulation”. They do this by an arrangement between them, “unless, and in so far as, the respective responsibilities of the controllers are determined by Union or Member State law to which the controllers are subject”. The arrangement applies “in particular” to the rights of the data subject and to the obligations to give the information of Articles 13 and 14. The arrangement can designate a contact point for data subjects.

The arrangement “shall duly reflect the respective roles and relationships of the joint controllers vis-à-vis the data subjects”. The joint controllers must make “the essence of the arrangement” available to the data subject (Article 26(2)). “Irrespective of the terms of the arrangement”, the data subject can use the rights of the GDPR against each of the controllers (Article 26(3)).

Article 28 — processor

For GDPR controller and processor roles and the Article 28(10) rule, see Controllers and processors.

The controller must use only processors that give “sufficient guarantees” to “implement appropriate technical and organisational measures”. With these measures, the processing must agree with the requirements of the GDPR and “ensure the protection of the rights of the data subject” (Article 28(1)). A processor can use “adherence” to an approved code of conduct or an approved certification mechanism as “an element” to demonstrate “sufficient guarantees” (Article 28(5)).

A processor must not engage another processor without the “prior specific or general written authorisation of the controller”. With a general written authorization, the processor must tell the controller of “any intended changes concerning the addition or replacement of other processors”. The controller can then object to these changes (Article 28(2)).

Article 28(3) tells the controller and the processor to use “a contract or other legal act under Union or Member State law” that is “binding on the processor with regard to the controller”. This contract or other legal act gives the “subject-matter and duration of the processing”. It also gives “the nature and purpose of the processing”, “the type of personal data” and “categories of data subjects”. It also gives the obligations and rights of the controller. It must “stipulate, in particular,” that the processor does these tasks:

• (a) It processes the personal data only on documented instructions from the controller, also for transfers to a third country or an international organization. This does not apply when Union or Member State law that applies to the processor tells it to process the data. Then the processor must “inform the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest”.
• (b) It makes sure that the “persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality”.
• (c) It “takes all measures required pursuant to Article 32”.
• (d) It obeys the conditions of Article 28(2) and (4) when it engages another processor.
• (e) It helps the controller with “appropriate” technical and organizational measures, “insofar as this is possible”, “for the fulfilment of the controller's obligation to respond to requests for exercising the data subject's rights laid down in Chapter III”. It examines “the nature of the processing”.
• (f) It helps the controller to obey Articles 32 to 36. It examines “the nature of processing” and the information that the processor has.
• (g) “At the choice of the controller”, it “deletes or returns all the personal data to the controller after the end of the provision of services relating to processing, and deletes existing copies unless Union or Member State law requires storage of the personal data”.
• (h) It gives the controller all the information necessary to demonstrate compliance with the obligations of Article 28. It must “allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller”.

“With regard to point (h)”, the processor must immediately tell the controller if, “in its opinion, an instruction infringes this Regulation or other Union or Member State data protection provisions”.

Article 28(4) applies when a processor engages another processor “for carrying out specific processing activities on behalf of the controller”. Then the same data protection obligations as in the contract or other legal act of Article 28(3) “shall be imposed on that other processor”. This occurs “by way of a contract or other legal act under Union or Member State law”. This contract or other legal act must “in particular” give “sufficient guarantees” to “implement appropriate technical and organisational measures”. If the other processor “fails to fulfil its data protection obligations”, the initial processor “shall remain fully liable to the controller for the performance of that other processor's obligations” (Article 28(4)).

The contract or other legal act must be “in writing, including in electronic form” (Article 28(9)). It can use standard contractual clauses, “in whole or in part” (Article 28(6)). “The Commission may lay down standard contractual clauses” (Article 28(7)), and “a supervisory authority may adopt standard contractual clauses” (Article 28(8)).

The Commission gave the Article 28(7) clauses in Commission Implementing Decision (EU) 2021/915 of 4 June 2021. “These standard contractual clauses cannot be used as standard contractual clauses for the purpose of Chapter V” (Decision 2021/915, recital 10). Where Implementing Decision (EU) 2021/914 applies, its clauses also give the rights and obligations of Article 28(3) and (4). See Articles 44 to 49.

Article 29 — Processing under the authority of the controller or processor

GDPR Article 29 applies to the processor and to “any person acting under the authority of the controller or of the processor, who has access to personal data”. These persons “shall not process those data except on instructions from the controller, unless required to do so by Union or Member State law”.

Article 30 — records of processing activities

GDPR Article 30(1) tells each controller and, where applicable, its representative to keep a record of the processing activities for which it has responsibility. The record must contain all of this information:

• (a) the “name and contact details” of the controller and, where applicable, of the joint controller, its representative, and the data protection officer
• (b) the purposes of the processing
• (c) “a description of the categories of data subjects and of the categories of personal data”
• (d) the categories of recipients that received or will receive the personal data, also recipients in third countries or international organizations
• (e) where applicable, transfers of personal data to a third country or an international organization, with the identification of that third country or international organization. For a transfer in the “second subparagraph” of Article 49(1), the record also contains “the documentation of suitable safeguards”.
• (f) where possible, the time limits for erasure of the “different categories of data”
• (g) where possible, “a general description of the technical and organisational security measures referred to in Article 32(1)”.

GDPR Article 30(2) tells each processor and, where applicable, its representative to keep a record. This record is about all “categories of processing activities” that the processor does “on behalf of a controller”. It contains:

• (a) “the name and contact details of the processor or processors and of each controller on behalf of which the processor is acting, and, where applicable, of the controller's or the processor's representative, and the data protection officer”
• (b) the “categories of processing” that the processor does “on behalf of each controller”
• (c) where applicable, the transfers to a third country or an international organization, with the same contents as in Article 30(1)(e)
• (d) where possible, “a general description of the technical and organisational security measures referred to in Article 32(1)”.

The records must be “in writing, including in electronic form” (Article 30(3)). The controller or the processor, and its representative where applicable, must make the record available to the supervisory authority “on request” (Article 30(4)).

Article 30(1) and (2) do not apply to “an enterprise or an organisation employing fewer than 250 persons” (Article 30(5)). But Article 30(1) and (2) apply to such an enterprise or organization if one of these conditions applies:

• The processing is likely to result in a risk to the rights and freedoms of data subjects.
• The processing is “not occasional”.
• The processing includes special categories of data (Article 9(1)).
• The processing includes personal data about criminal convictions and criminal offenses (Article 10).

Article 31 — Cooperation with the supervisory authority

GDPR Article 31 tells the controller and the processor and, where applicable, their representatives to cooperate with the supervisory authority “in the performance of its tasks”. They must cooperate “on request”. After a decision of the lead supervisory authority for cross-border processing, Article 60(10) sets one more obligation for the controller or the processor. See Supervisory authorities.

Article 32 — security of processing

GDPR Article 32(1) sets the security obligation for the controller and for the processor:

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate:

(a) the pseudonymisation and encryption of personal data;

(b) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;

(c) the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;

(d) a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.

The measures must give a level of security that is “appropriate to the risk”. The measures include points (a) to (d) “as appropriate”. Thus each point is necessary only where it is “appropriate”. For the security level, the controller and the processor examine “in particular” the risks of the processing. Examples are “accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data” (Article 32(2)). Article 32(3) makes “adherence” to an approved code of conduct or an approved certification mechanism “an element” to demonstrate compliance with Article 32(1).

The controller and the processor “shall take steps to ensure that any natural person acting under the authority of the controller or the processor who has access to personal data does not process them except on instructions from the controller”. This rule does not apply when Union or Member State law tells that person to process the data (Article 32(4)).

Article 33 — controller breach notification

In GDPR Article 33(1), the controller has the obligation to notify a personal data breach to the supervisory authority:

In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.

The primary rule is “without undue delay”. The 72 hours apply “where feasible”, and the period starts when the controller becomes aware of the breach. In its Guidelines 9/2022 (paragraph 31), the EDPB tells controllers that a controller is aware of a breach when it has “a reasonable degree of certainty that a security incident has occurred that has led to personal data being compromised”. This is the view of the Board in its guidelines, not a rule of the GDPR.

GDPR Article 33(2) sets an obligation for the processor:

The processor shall notify the controller without undue delay after becoming aware of a personal data breach.

GDPR Article 33(3) gives the minimum contents of the notification:

The notification referred to in paragraph 1 shall at least:

(a) describe the nature of the personal data breach including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;

(b) communicate the name and contact details of the data protection officer or other contact point where more information can be obtained;

(c) describe the likely consequences of the personal data breach;

(d) describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

If the controller cannot give all the information at the same time, it can give the information “in phases without undue further delay” (Article 33(4)).

The controller must document all personal data breaches. The “documentation” contains “the facts relating to the personal data breach, its effects and the remedial action taken”. This “documentation” “shall enable the supervisory authority to verify compliance with this Article” (Article 33(5)). This obligation also applies to a breach that the controller does not notify because the breach is unlikely to result in a risk.

For the same incident, EU AI Act Article 73 can also set obligations for “providers” to report a “serious incident”.

Article 34 — communication to the data subject

In GDPR Article 34(1), the controller has the obligation to communicate a personal data breach to the data subject:

When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay.

The communication must “describe in clear and plain language the nature of the personal data breach”. It must also “contain at least the information and measures referred to in points (b), (c) and (d) of Article 33(3)” (Article 34(2)).

The communication “shall not be required” if one of these conditions applies (Article 34(3)):

• (a) The controller “implemented appropriate technical and organisational protection measures”, and the controller applied these measures to “the personal data affected by the personal data breach”. These are “in particular” measures that make the personal data “unintelligible to any person who is not authorised to access it, such as encryption”.
• (b) Subsequent measures of the controller make sure that the high risk to the rights and freedoms of data subjects is “no longer likely to materialise”.
• (c) The communication “would involve disproportionate effort”. Then “there shall instead be a public communication or similar measure whereby the data subjects are informed in an equally effective manner”.

If the controller did not communicate the breach to the data subject, the supervisory authority examines “the likelihood of the personal data breach resulting in a high risk”. Then the supervisory authority can tell the controller to communicate the breach. Or the supervisory authority “may decide that any of the conditions referred to in paragraph 3 are met” (Article 34(4)).

Article 35 — data protection impact assessment

GDPR Article 35(1) gives the test for when the controller must do a data protection impact assessment (DPIA):

Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data. A single assessment may address a set of similar processing operations that present similar high risks.

The DPIA is for a type of processing, or for “a set of similar processing operations that present similar high risks”. “High-risk AI system” in the EU AI Act is not the test of Article 35(1). When the controller does a DPIA, it must “seek the advice” of the data protection officer, “where designated” (Article 35(2)).

GDPR Article 35(3) gives three types of processing for which a DPIA is “in particular” necessary. A DPIA can also be necessary for other types of processing (Article 35(1)):

A data protection impact assessment referred to in paragraph 1 shall in particular be required in the case of:

(a) a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person;

(b) processing on a large scale of special categories of data referred to in Article 9(1), or of personal data relating to criminal convictions and offences referred to in Article 10; or

(c) a systematic monitoring of a publicly accessible area on a large scale.

Each supervisory authority “shall establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment”. It “shall communicate those lists to the Board” (Article 35(4)). A supervisory authority “may also establish and make public a list of the kind of processing operations for which no data protection impact assessment is required” (Article 35(5)).

GDPR Article 35(7) gives the minimum contents of the DPIA:

The assessment shall contain at least:

(a) a systematic description of the envisaged processing operations and the purposes of the processing, including, where applicable, the legitimate interest pursued by the controller;

(b) an assessment of the necessity and proportionality of the processing operations in relation to the purposes;

(c) an assessment of the risks to the rights and freedoms of data subjects referred to in paragraph 1; and

(d) the measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this Regulation taking into account the rights and legitimate interests of data subjects and other persons concerned.

“Where appropriate”, the controller must “seek the views” of data subjects or their representatives on “the intended processing”. This obligation is “without prejudice to the protection of commercial or public interests or the security of processing operations” (Article 35(9)).

Article 35(1) to (7) do not apply when all of these conditions apply, unless Member States “deem it to be necessary” to do a DPIA before the processing (Article 35(10)):

• The processing is in point (c) or (e) of Article 6(1).
• The processing has a legal basis in Union law or in the law of the Member State that applies to the controller.
• That law “regulates the specific processing operation or set of operations in question”.
• A DPIA was part of a general impact assessment “in the context of the adoption of that legal basis”.

“Where necessary”, the controller must examine if the processing agrees with the DPIA, “at least when there is a change of the risk represented by processing operations” (Article 35(11)).

EU AI Act Articles 26(9) and 27 apply on the dates that the EU AI Act gives for high-risk AI systems, with its conditions. The EU AI Act page Digital Omnibus on AI gives the dates of the high-risk rules.

Article 26(9) tells “deployers of high-risk AI systems” to use the information of its Article 13 for the DPIA of GDPR Article 35, “where applicable”. Article 27(1) tells some “deployers” of high-risk AI systems to do a fundamental rights impact assessment. If an Article 27 obligation “is already met through the data protection impact assessment”, Article 27(4) gives two alternatives for the fundamental rights impact assessment:

• The “deployer” can “include cross-references to the relevant sections of that data protection impact assessment”.
• The “deployer” can include “relevant parts” of the DPIA in the fundamental rights impact assessment.

The EDPB endorsed the WP29 guidelines on DPIA (WP248 rev.01) on 25 May 2018 (Endorsement 1/2018). These guidelines are not binding law.

Article 36 — prior consultation

GDPR Article 36(1) tells the controller to consult the supervisory authority before the processing when a DPIA in Article 35 shows that the processing “would result in a high risk in the absence of measures taken by the controller to mitigate the risk”.

The supervisory authority can be “of the opinion that the intended processing referred to in paragraph 1 would infringe this Regulation”. Then it must give “written advice” to the controller and, where applicable, to the processor. This applies “in particular where the controller has insufficiently identified or mitigated the risk”. The supervisory authority gives the “written advice” in a “period of up to eight weeks of receipt of the request for consultation”. It “may use any of its powers referred to in Article 58” (Article 36(2)). For these periods, Article 36(2) also gives these rules:

• The supervisory authority can extend the period by “six weeks”, “taking into account the complexity of the intended processing”.
• The supervisory authority must tell the controller and, where applicable, the processor about the extension, “together with the reasons for the delay”. It does this “within one month of receipt of the request for consultation”.
• The periods can stop until the supervisory authority “has obtained information it has requested for the purposes of the consultation”.

GDPR Article 36(3) gives the information that the controller must give to the supervisory authority:

(a) where applicable, the respective responsibilities of the controller, joint controllers and processors involved in the processing, in particular for processing within a group of undertakings;

(b) the purposes and means of the intended processing;

(c) the measures and safeguards provided to protect the rights and freedoms of data subjects pursuant to this Regulation;

(d) where applicable, the contact details of the data protection officer;

(e) the data protection impact assessment provided for in Article 35; and

(f) any other information requested by the supervisory authority.

Member State law can make it necessary for controllers to consult the supervisory authority and to get its prior authorization for processing “for the performance of a task carried out by the controller in the public interest, including processing in relation to social protection and public health” (Article 36(5)).

Articles 37–39 — data protection officer

GDPR Article 37(1) tells the controller and the processor to designate a data protection officer (DPO) if one of these conditions applies:

• (a) A public authority or body does the processing. This does not apply to “courts acting in their judicial capacity”.
• (b) The core activities of the controller or the processor are processing operations that, “by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale”.
• (c) The core activities are processing on a large scale of special categories of data (Article 9) or of personal data about criminal convictions and criminal offenses (Article 10).

GDPR Article 37(2) to (7) give these rules:

• A group of undertakings “may appoint a single data protection officer provided that a data protection officer is easily accessible from each establishment” (Article 37(2)).
• Where the controller or the processor is a public authority or body, “a single data protection officer may be designated for several such authorities or bodies, taking account of their organisational structure and size” (Article 37(3)).
• In other conditions, the controller, the processor, or “associations and other bodies representing categories of controllers or processors” are permitted to designate a DPO. They must designate a DPO where Union or Member State law tells them to designate one (Article 37(4)).
• The DPO must have “professional qualities and, in particular, expert knowledge of data protection law and practices and the ability to fulfil the tasks referred to in Article 39” (Article 37(5)).
• The DPO can be “a staff member of the controller or processor, or fulfil the tasks on the basis of a service contract” (Article 37(6)).
• The controller or the processor must “publish the contact details” of the DPO and communicate them to the supervisory authority (Article 37(7)).

GDPR Article 38 gives the position of the DPO:

• The controller and the processor must make sure that the DPO is “involved, properly and in a timely manner, in all issues which relate to the protection of personal data” (Article 38(1)).
• The controller and the processor must help the DPO in the tasks of Article 39 “by providing resources necessary to carry out those tasks and access to personal data and processing operations, and to maintain his or her expert knowledge” (Article 38(2)).
• The controller and the processor must make sure that the DPO “does not receive any instructions regarding the exercise of those tasks” (Article 38(3)).
• The DPO “shall not be dismissed or penalised by the controller or the processor for performing his tasks”. The DPO must report directly to “the highest management level of the controller or the processor” (Article 38(3)).
• Data subjects can contact the DPO “with regard to all issues related to processing of their personal data and to the exercise of their rights under this Regulation” (Article 38(4)).
• The DPO must keep “secrecy or confidentiality concerning the performance of his or her tasks”, “in accordance with Union or Member State law” (Article 38(5)).
• The DPO can do other tasks. The controller or the processor must make sure that these tasks do not cause “a conflict of interests” (Article 38(6)).

GDPR Article 39(1) gives the minimum tasks of the DPO:

(a) to inform and advise the controller or the processor and the employees who carry out processing of their obligations pursuant to this Regulation and to other Union or Member State data protection provisions;

(b) to monitor compliance with this Regulation, with other Union or Member State data protection provisions and with the policies of the controller or processor in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits;

(c) to provide advice where requested as regards the data protection impact assessment and monitor its performance pursuant to Article 35;

(d) to cooperate with the supervisory authority;

(e) to act as the contact point for the supervisory authority on issues relating to processing, including the prior consultation referred to in Article 36, and to consult, where appropriate, with regard to any other matter.

Articles 40 to 43 — codes of conduct and certification

GDPR Articles 40 and 41 give the rules for codes of conduct and for the monitoring of these codes. Articles 42 and 43 give the rules for certification. “The certification shall be voluntary” (Article 42(3)). A certification “does not reduce the responsibility of the controller or the processor for compliance with this Regulation” (Article 42(4)). For the use of codes and certification as “an element” to demonstrate compliance, see Article 24, Article 25, and Article 32.

Articles 44 to 49 — transfers to third countries or international organizations

GDPR Article 44 gives the general principle for transfers. A transfer to a third country or an international organization can occur only if the controller and the processor obey the conditions of Chapter V. This also applies to “onward transfers of personal data from the third country or an international organisation to another third country or to another international organisation”. Chapter V gives three alternatives, and each alternative applies only if the alternative before it does not:

• Adequacy decision — a transfer can occur “where the Commission has decided that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection”. “Such a transfer shall not require any specific authorisation” (Article 45(1)). The decision gives “a mechanism for a periodic review, at least every four years” (Article 45(3)).
• Appropriate safeguards — if there is no adequacy decision of Article 45(3), the controller or the processor can transfer personal data only with appropriate safeguards. The data subjects must also have “enforceable data subject rights and effective legal remedies” (Article 46(1)).
• Derogations — if there is no adequacy decision and there are no appropriate safeguards, a transfer can occur only with a derogation of Article 49.

As of October 2026, the Commission shows adequacy decisions for Andorra, Argentina, Brazil, Canada (“commercial organisations”), the Faroe Islands, and Guernsey. It also shows adequacy decisions for Israel, the Isle of Man, Japan, Jersey, New Zealand, and the Republic of Korea. And it shows adequacy decisions for Switzerland, the United Kingdom, the United States, Uruguay, and the European Patent Organisation. For the United States, the decision applies to “commercial organisations participating in the EU-US Data Privacy Framework”.

GDPR Article 46(2) gives the appropriate safeguards that are possible “without requiring any specific authorisation from a supervisory authority”:

• (a) “a legally binding and enforceable instrument between public authorities or bodies”
• (b) binding corporate rules (Article 47)
• (c) “standard data protection clauses adopted by the Commission”
• (d) “standard data protection clauses adopted by a supervisory authority and approved by the Commission”
• (e) an approved code of conduct (Article 40), with “binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards”
• (f) an approved certification mechanism (Article 42), with the same “binding and enforceable commitments”.

With the authorization of the competent supervisory authority, “contractual clauses” or “provisions to be inserted into administrative arrangements between public authorities or bodies” can also give appropriate safeguards (Article 46(3)). The competent supervisory authority “shall approve binding corporate rules in accordance with the consistency mechanism set out in Article 63”, if these rules agree with the conditions of Article 47(1).

Commission Implementing Decision (EU) 2021/914 of 4 June 2021 gives standard contractual clauses for the transfer of personal data to third countries. These clauses give appropriate safeguards in GDPR Article 46(1) and (2)(c) for transfers with these conditions (Article 1(1) of the Decision):

• The “data exporter” is a controller or processor that transfers “personal data processed subject to that Regulation”.
• The “data importer” is a controller or processor “whose processing of the data is not subject to that Regulation”.

For such transfers, the clauses also give the rights and obligations of Article 28(3) and (4) for two types of transfer (Article 1(2)). These are a transfer from a controller to a processor and a transfer from a processor to another processor.

In Schrems II (C-311/18, judgment of 16 July 2020), the Court of Justice found that the EU-US Privacy Shield decision (Implementing Decision (EU) 2016/1250) “is invalid” (operative part, point 5). For transfers with standard data protection clauses, the Court gave these rules:

• The data subjects must get a level of protection “essentially equivalent” to the protection in the Union (operative part, point 2).
• The controller or the processor must “verify, on a case-by-case basis”, “whether the law of the third country of destination ensures adequate protection”. Where necessary, it adds safeguards to the clauses (paragraphs 133 and 134).
• The controller or the processor can be “not able to take adequate additional measures to guarantee such protection”. Then it must “suspend or end the transfer”. If it does not, the competent supervisory authority must do this (paragraph 135).

GDPR Article 49(1) gives the derogations. They apply only if there is no adequacy decision and there are no appropriate safeguards, also no binding corporate rules. Then a transfer or a set of transfers can occur only if one of these conditions applies:

• (a) The data subject “has explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards”.
• (b) The transfer is necessary for the performance of a contract between the data subject and the controller, or for “pre-contractual measures taken at the data subject's request”.
• (c) The transfer is necessary for “the conclusion or performance of a contract concluded in the interest of the data subject between the controller and another natural or legal person”.
• (d) The transfer is necessary for “important reasons of public interest”. This public interest “shall be recognised in Union law or in the law of the Member State to which the controller is subject” (Article 49(4)).
• (e) The transfer is necessary for “the establishment, exercise or defence of legal claims”.
• (f) The transfer is necessary “in order to protect the vital interests of the data subject or of other persons, where the data subject is physically or legally incapable of giving consent”.
• (g) “The transfer is made from a register which according to Union or Member State law is intended to provide information to the public”. That register must be “open to consultation either by the public in general or by any person who can demonstrate a legitimate interest”. The transfer is permitted only “to the extent that the conditions laid down by Union or Member State law for consultation are fulfilled in the particular case”. Article 49(2) gives more limits for these transfers.

The “second subparagraph” of Article 49(1) gives one more alternative. It applies only if no transfer tool of Article 45 or 46 and no derogation of the first subparagraph applies. Then a transfer can occur only if all of these conditions apply:

• The transfer is “not repetitive”.
• The transfer “concerns only a limited number of data subjects”.
• The transfer is necessary for “compelling legitimate interests pursued by the controller which are not overridden by the interests or rights and freedoms of the data subject”.
• The controller “has assessed all the circumstances surrounding the data transfer” and, from that “assessment”, gave “suitable safeguards” for the protection of personal data.

For this transfer, the controller must tell the supervisory authority. The controller must also tell the data subject about the transfer and about the “compelling legitimate interests”, and give the information of Articles 13 and 14. The controller or the processor must document the “assessment” and the “suitable safeguards” in the records of Article 30 (Article 49(6)). Points (a), (b), and (c) and the “second subparagraph” do not apply to “activities carried out by public authorities in the exercise of their public powers” (Article 49(3)).

Two other Articles of Chapter V are not transfer tools of the controller or the processor. Article 48 applies to “any judgment of a court or tribunal and any decision of an administrative authority of a third country requiring a controller or processor to transfer or disclose personal data”. Such a judgment or decision “may only be recognised or enforceable in any manner if based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the Union or a Member State”. This rule is “without prejudice to other grounds for transfer pursuant to this Chapter”. Article 50 (“International cooperation for the protection of personal data”) gives tasks to the Commission and the supervisory authorities.

Controller and processor obligations in Modulos

Modulos has Requirements for Articles 24 to 47 and 49 in the GDPR Frameworks OFF-11 and MFF-12. For the Requirement of each Article, see Requirements of the GDPR Frameworks.

Where to go next

GDPR overview

The dates and structure of the GDPR, guidance, and case law

Supervisory authorities, remedies, and penalties

The supervisory authorities, the remedies of data subjects, liability, and administrative fines

Where the GDPR applies

When the GDPR applies, the Article 27 representative, and how to find the controller and the processor

Principles and rights of data subjects

The principles, the legal basis, consent, special categories, the rights of the data subject, and Article 22

GDPR Frameworks in Modulos

OFF-11 and MFF-12, the decisions before set-up, the steps, and the Requirements

The EU AI Act and the GDPR compared

When the GDPR and the EU AI Act apply to the same AI system

Sources of this page

• GDPR — Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1, corrigendum OJ L 127, 23.5.2018, p. 2: Articles 4(8), 24 to 50, 55, 58, and 60(10). EUR-Lex.
• Commission Implementing Decision (EU) 2021/915 of 4 June 2021 “on standard contractual clauses between controllers and processors under Article 28(7) of Regulation (EU) 2016/679”: recital 10. EUR-Lex.
• Commission Implementing Decision (EU) 2021/914 of 4 June 2021 “on standard contractual clauses for the transfer of personal data to third countries”: Article 1. EUR-Lex.
• Schrems II — judgment of the Court of Justice of 16 July 2020, Data Protection Commissioner v Facebook Ireland and Maximillian Schrems, C-311/18: paragraphs 133 to 135 and operative part, points 2 and 5. EUR-Lex.
• European Commission, adequacy decisions page, as of October 2026. European Commission.
• EDPB “Guidelines 9/2022 on personal data breach notification under GDPR”, “Version 2.0” of 28 March 2023: paragraph 31. EDPB.
• EDPB “Guidelines 4/2019 on Article 25 Data Protection by Design and by Default”, “Version 2.0” of 20 October 2020. EDPB.
• EDPB Endorsement 1/2018 of 25 May 2018 and the Endorsed WP29 Guidelines page: WP248 rev.01 on data protection impact assessment. EDPB.
• EU AI Act — Regulation (EU) 2024/1689, consolidated text of 27 July 2026: Articles 26(9), 27(1), 27(4), and 73. EUR-Lex.
• Digital Omnibus proposal — European Commission, COM(2025) 837 of 19 November 2025: Article 3, points 8 and 9. EUR-Lex.

Disclaimer

This page gives general information. It is not legal advice.