In short. GDPR Article 49 offers exceptions for specific transfers, with conditions that prevent it from serving as a general route for routine website data transfers.
Definition: Article 49 of the General Data Protection Regulation (GDPR) provides derogations, meaning exceptions, for specific international transfers of personal data where an adequacy decision or appropriate safeguards are absent. It provides no general authorisation for routine website transfers: each transfer or set of transfers must meet the conditions of a particular exception.
Key facts
- As of 17 October 2026, GDPR Article 49(1) requires a specific derogation where an adequacy decision or appropriate safeguards are absent.
- The European Data Protection Board (EDPB), in its Guidelines 2/2018, limits the contract and legal-claims derogations to occasional transfers.
- The EDPB's small-business guide states that transfer conditions apply alongside other GDPR duties, including a legal basis for processing and a contract where the recipient acts as a processor.
Which transfer route comes first?
An adequacy decision is a European Commission decision recognising an adequate level of protection in a destination. GDPR Article 45(1) permits transfers within its scope. Where that route is unavailable, Article 46(1) provides for appropriate safeguards together with enforceable rights and effective legal remedies. Article 46(2)(c) includes standard data protection clauses adopted by the Commission among those safeguards.
The EDPB's derogations guidance says organisations should first consider the mechanisms in Articles 45 and 46. Article 49 exceptions require restrictive interpretation so that exceptional transfers remain confined to specific situations.
What makes a website transfer routine?
The EDPB's Guidelines 2/2018 describe regular transfers within a stable relationship between the organisation sending data and its recipient as systematic and repeated. General access to a database through an application interface is another example of a repetitive transfer. An ongoing website integration that gives an overseas recipient that access therefore fits the guidance's example.
Under Article 49(1)(b), contractual necessity requires a close and substantial connection between the transfer and the contract's purpose. The guidance gives travel agents sending individual clients' data to hotels abroad as an example of that connection. Each transfer must also satisfy the occasional-transfer condition; additional information unnecessary for the contract falls outside this exception.
Does visitor consent cover a transfer?
GDPR Article 49(1)(a) requires explicit consent to the proposed transfer after information about the risks caused by the absence of an adequacy decision and appropriate safeguards.
The EDPB's consent analysis requires freely given consent specifically for the particular transfer or set of transfers, obtained before it happens. Information must identify the destination countries and recipients or recipient categories, explain the transfer risks, and include the right to withdraw consent. For a website, consent to processing alone therefore leaves these additional transfer conditions to be satisfied.
The same guidance distinguishes consent from the contract derogations: the express occasional-transfer limitation is absent from the consent derogation. Its exceptional nature still applies, and the EDPB identifies withdrawal at any time as a practical obstacle to using consent as a long-term transfer solution.
Can compelling legitimate interests support regular transfers?
The second subparagraph of GDPR Article 49(1) supplies a residual exception when Articles 45 and 46 and the other Article 49 derogations are unavailable. It requires a non-repetitive transfer involving a limited number of people, necessity for compelling legitimate interests, an assessment of all circumstances, suitable safeguards, and interests that withstand balancing against individuals' interests or rights and freedoms.
The organisation must inform both the supervisory authority and the affected people, including the compelling interests pursued. Article 49(6) requires the assessment and safeguards to be documented in the Article 30 records. The EDPB's guidance says the threshold for compelling interests exceeds ordinary legitimate interests under Article 6(1)(f).
Related terms
- GDPR lawful basis for web data
- What safeguards can support analytics data transfers outside the EEA?
FAQ
Can my website rely on a supplier contract alone?
The EDPB's small-business guide says a processor contract remains required alongside transfer conditions. For the contract-based derogations under Article 49(1)(b) and (c), the EDPB guidelines require both necessity and occasional transfers.
Must an occasional transfer happen only once?
The EDPB's guidance allows transfers to happen more than once while remaining occasional. They must occur outside the regular course of actions, rather than regularly within a stable relationship.
Can my business invoke public interest for routine transfers?
GDPR Article 49(4) requires the public interest to be recognised in EU law or the law of the Member State governing the organisation. The EDPB guidance permits private entities to use this exception, while requiring strict necessity and restricting it to specific situations.
Sources
- European Union, "General Data Protection Regulation", 27 April 2016
- European Data Protection Board, "Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679", 25 May 2018
- European Data Protection Board, "International data transfers", undated, accessed 17 October 2026
Check how a page reads to answer engines. Open the GEO score analyzer