Art. 48 GDPR – Transfers or disclosures not authorised by Union law
Any judgment of a court or tribunal and any decision of an administrative authority of a third country requiring a controller or processor to transfer or disclose personal data may only be recognised or enforceable in any manner if based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the Union or a Member State, without prejudice to other grounds for transfer pursuant to this Chapter.
Related Recitals
Frequently Asked Questions about Article 48
+ What does Article 48 GDPR say about foreign court orders?
Article 48 provides that a judgment or decision from a third country authority requiring data transfer is only recognised if based on an international agreement such as a mutual legal assistance treaty.
+Can a company hand over EU data to foreign authorities?
Not solely on the basis of a foreign court order. Disclosure must be grounded in an international agreement, otherwise the request must be assessed under the GDPR’s transfer rules.
+ Why does Article 48 matter for global businesses?
It limits how organisations respond to foreign government and court demands for EU personal data, helping prevent conflicts between local law and GDPR obligations.