When Article 49 Derogations Apply
The GDPR lets personal data leave the EEA without an adequacy decision and without appropriate safeguards. Article 49 derogations are the route that makes this lawful, and they run far narrower than their reputation. Anyone preparing for the CIPP/E exam needs to know exactly where the boundaries sit. The questions live there.
Where the Article 49 derogations sit
Chapter V of the GDPR builds a clear hierarchy for international transfers. An adequacy decision under Article 45 comes first. Appropriate safeguards under Article 46, including Standard Contractual Clauses and Binding Corporate Rules, come second. The derogations come last, available only in the absence of both. The European Data Protection Board confirmed this order in its Guidelines 2/2018. It reads the derogations restrictively, so the exception never becomes the rule.
That hierarchy has a practical consequence. A transfer programme built on derogations is a design fault. Supervisory authorities treat these grounds as occasional instruments for specific situations. The title of Article 49 literally says so.
Transfer rules only bite once the GDPR applies at all. Where that line runs is a separate question, worked through in GDPR Territorial Scope Beyond Europe.
The listed grounds
Article 49(1) names seven specific situations. Each carries its own conditions, and several carry a necessity test that examiners like to probe.
Consent, but explicit
The first ground is consent, and it demands more than consent does elsewhere in the GDPR. The data subject must explicitly agree to the proposed transfer. First they must learn what risks arise without an adequacy decision and without safeguards. Ordinary consent will not do. The Finnish data protection ombudsman lists the conditions in plain terms. The informed element does the real work: the person must understand what protection they are giving up.
Contracts and legal claims
Two grounds cover contracts. A transfer may be necessary to perform a contract with the data subject. It may also serve a contract concluded in that person’s interest. A further ground covers the establishment, exercise or defence of legal claims. Necessity is the test in each case. A transfer that is merely convenient for the exporter fails it.
Public interest, vital interests and public registers
The remaining grounds cover three situations: important reasons of public interest recognised in EU or member state law, protection of vital interests where the person cannot consent, and transfers from registers the law intends to be public. None of these hands an organisation a general licence. The public interest must be a recognised one, and an exporter’s own operational interest never qualifies.
The last derogation of all
Article 49(1) closes with a residual route in its second subparagraph. Where no adequacy decision, no safeguard and no listed ground applies, a transfer may still take place under strict cumulative conditions. The transfer must not be repetitive. It may concern only a limited number of data subjects. Compelling legitimate interests of the controller must require it, and those interests must not be overridden by the interests or rights of the data subject. The controller must also assess all the circumstances, apply suitable safeguards and document the assessment. Finally, the controller informs the supervisory authority and tells the people involved.
Every condition matters, and they operate as a set. Drop one, and the route closes.
How the CIPP/E exam tests Article 49 derogations
The Body of Knowledge is the IAPP’s published outline of what each exam covers. For CIPP/E, the domain on European data processing includes international transfers, with derogations named explicitly. Scenario questions tend to hand you a sympathetic transfer and ask which route carries it. The trap is usually a derogation stretched past its conditions: consent that was never explicit, a contract ground used for routine payroll, a compelling interest that repeats monthly.
Read the frequency language first. Occasional and non-repetitive wording points at the derogations. Systematic and ongoing wording points back up the ladder at Article 46. That reading habit settles the question before the answer options start arguing.
Cross-border fact patterns repay drilling, and 3 Hidden Cross-Border Exam Scenarios works through three of them. For the mechanisms one level up the ladder, the free International Data Transfer Mechanisms sheet puts adequacy, safeguards and derogations on one page. If question technique rather than knowledge is the gap, the CIPP/E Exam Question Masterclass at 195 euros teaches the method for passing first time.
