Art.48 Transfers or disclosures not authorised by Union law
A judgment of a court or tribunal, or a decision of an administrative authority, of a third country requiring a controller or processor to transfer or disclose personal data may be recognised or enforceable only if it is based on an international agreement in force between the requesting third country and the Union or a Member State, such as a mutual legal assistance treaty, without prejudice to the other grounds for transfer in Chapter V. In practice the controller or processor must not treat a foreign order as being by itself a lawful ground to hand over personal data, and must route such demands through the applicable mutual legal assistance route or another Chapter V ground before disclosing.
Source: GDPR, Art.48. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open GDPR in the compliance library.
Many articles apply only where their condition is met (a data protection officer under Article 37, an impact assessment under Article 35, a representative under Article 27); the condition is in each statement.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Evidence that each disclosure was traced to an international agreement in force or to another Chapter V ground, and not to the foreign order alone · Vendor register / contract repository
- Processor contract terms requiring notification to the controller of any third country demand and requiring the processor to challenge or defer it where lawful · Regulator portal / correspondence
- A transparency report or equivalent record of demands received and responses given, where publication is permitted · Document repository
governing documentDocuments that govern the control
- A documented procedure for receiving and handling third country law enforcement, regulatory and court demands for personal data, requiring legal review before any disclosure · Policy repository / GRC workspace
- The register of such demands received, showing the requesting authority, what was sought, the legal basis assessed, and what was disclosed or refused · Policy repository / GRC workspace
First move
Common gaps auditors find
- Group companies or processors outside the Union complying with local subpoenas directly, with the controller in the Union never told that its data left
- A foreign order treated as a legal obligation under Article 6(1)(c), which the Regulation does not accept as a ground for a third country disclosure
- No procedure at all, so a demand is answered by whoever receives it, under time pressure and without legal review
- Processor terms silent on foreign demands, so notification depends on goodwill and the controller learns of the disclosure only if it is later reported
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetArt.47 Binding corporate rules · Art.49 Derogations for specific situations