Art.48 Transfers or disclosures not authorised by Union law
A judgment of a court or tribunal, or a decision of an administrative authority, of a third country requiring a controller or processor to transfer or disclose personal data may be recognised or enforceable only if it is
5
artefacts
0
held by a system
1
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- A transparency report or equivalent record of demands received and responses given, where publication is permitted · Document repository
governing documentDocuments that govern the control
- A documented procedure for receiving and handling third country law enforcement, regulatory and court demands for personal data, requiring legal review before any disclosure · Policy repository / GRC workspace
- The register of such demands received, showing the requesting authority, what was sought, the legal basis assessed, and what was disclosed or refused · Policy repository / GRC workspace
- Evidence that each disclosure was traced to an international agreement in force or to another Chapter V ground, and not to the foreign order alone · Vendor register / contract repository
- Processor contract terms requiring notification to the controller of any third country demand and requiring the processor to challenge or defer it where lawful · Vendor register / contract repository
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Group companies or processors outside the Union complying with local subpoenas directly, with the controller in the Union never told that its data left
- A foreign order treated as a legal obligation under Article 6(1)(c), which the Regulation does not accept as a ground for a third country disclosure
- No procedure at all, so a demand is answered by whoever receives it, under time pressure and without legal review
- Processor terms silent on foreign demands, so notification depends on goodwill and the controller learns of the disclosure only if it is later reported
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetArt.47 Binding corporate rules · Art.49 Derogations for specific situations