Article 49 — Derogations for specific situations

GDPR, Regulation (EU) 2016/679

What does GDPR Article 49 say?

Short answer, straight from the official text

1. In the absence of an adequacy decision pursuant to Article 45(3), or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only on one of the following conditions: (a) the data …

Source: GDPR, Regulation (EU) 2016/679, read 2026-08-14.

Official text

Read from the EU Publications Office for this CELEX number. The wording stands as published; nothing here is rewritten or summarised.

Jump to a point: Point 1 · Point 2 · Point 3 · Point 4 · Point 5 · Point 6 · Point 7

1. In the absence of an adequacy decision pursuant to Article 45(3), or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only on one of the following conditions:

(a) the data subject has explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards;

(b) the transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of pre-contractual measures taken at the data subject's request;

(c) the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and another natural or legal person;

(d) the transfer is necessary for important reasons of public interest;

(e) the transfer is necessary for the establishment, exercise or defence of legal claims;

(f) the transfer is necessary in order to protect the vital interests of the data subject or of other persons, where the data subject is physically or legally incapable of giving consent;

The article continues in the official text.

Open the article on EUR-Lex

• Previous article
• Next article

Other articles in this chapter

• Article 44
• Article 45
• Article 46
• Article 47
• Article 48
• Article 50

The same rule in other acts

These articles carry the same official heading. The wording is not identical; read each text at its own source.

• EUDPR Article 50 — Derogations for specific situations

Who does this apply to

The register names five roles. Open a role to see the duties this act places on it, each row with its article and its source.

• Cloud service provider

Does this apply to us?

• Do ai governance rules apply to a cloud provider?
• Do personal data rules apply to a cloud provider?
• Do cross-border data rules apply to a cloud provider?
• Do cybersecurity rules apply to a cloud provider?
• Do health data rules apply to a cloud provider?
• Do online platforms rules apply to a cloud provider?

All roles in the register · All questions by role

The text is quoted from the official source and is not legal advice. A national court reads the language version that binds in its jurisdiction.

Back to the act · EU acts, read down to the national law

ExploreWorldAI is operated by Valkiv Ventures AB (Reg. no. 556995-1311), Kungsgatan 8, 111 43 Stockholm, Sweden. EU-hosted, with data processing assessed against the GDPR. Contact: hello@exploreworldai.com.

Machine-readable summaries for AI agents: /llms.txt and /llms-full.txt.