The European Data Protection Board (EDPB) has issued guidelines on the transfer of personal data to authorities in third countries pursuant to Article 48 of the GDPR. The guidelines provide companies with clear information on how to evaluate requests for data transfers and under what circumstances such requests can be legal. The goal is to ensure the protection of personal data in a global context and that companies comply with the strict requirements of the GDPR.

Without an international agreement that guarantees legal basis, companies will have to weigh each request separately and only share data in exceptional cases. This applies to cases such as investigations of crime or supervision of financial transactions. The guidelines are currently being reviewed until 27 January 2025.

The EDPB also adopted a new standard for European Data Protection Seal. The certification enables companies to demonstrate compliance with data protection laws and increase trust in their products or services.

See the EDPB press release for more details here (in English).