GDPR22 Aug 2026GDPR Art. 48
Guidelines 02/2024 (final version 2.1) explain that under Article 48 GDPR judgments or decisions of third-country authorities cannot automatically be recognised or enforced in the EU, and are generally recognised through international agreements such as mutual legal assistance treaties. The EDPB states that answering a third-country authority's request for personal data is a transfer that must comply with Article 6 and Chapter V GDPR, with other legal bases or the Article 49 derogations considered where no international agreement provides them.
What to do: If you may receive disclosure requests from non-EU courts or authorities, set up a procedure that checks a legal basis under Article 6 and a transfer ground under Chapter V GDPR before responding.
Legal status: EU guidance · Jurisdiction: EU
Official source: EDPB ↗