HumenhukCIPP/E Study Guide
IAPP Training, Module 7 - BoK III.D

Module 7, Derogations & restrictions (Article 49)

Reviewed by Victor Humenhuk. Published . Reviewed .

Derogations under Article 49 are last-resort exemptions, narrowly interpreted, that allow a transfer in specific situations only when neither adequacy nor safeguards apply. They include explicit consent, necessity for a contract, public interest, legal claims, vital interests, transfer from a public register, and compelling legitimate interests (non-repetitive, limited number of people). Two restrictions bite: Article 48 (foreign court/authority orders only recognised via an international agreement or EU/Member State law) and Article 49(5) (Member States may limit transfers of specific data categories for important public-interest reasons).

Derogations are the last resort - used only when neither adequacy decisions nor appropriate safeguards are available. Their criteria are strict and must be narrowly interpreted.

  • Explicit consent to the proposed transfer (informed of the risks).
  • Necessary for the performance of a contract (with the data subject, or in their interest).
  • Necessary for important reasons of public interest.
  • Establishment, exercise or defence of legal claims.
  • Protection of vital interests of the data subject or others.
  • Transfer from a public register.
  • Compelling legitimate interests that are non-repetitive and for a limited number of data subjects.
Restrictions

Article 48: a foreign court/authority order for data is only recognised via an international agreement (e.g. a mutual legal assistance treaty) or EU/Member State law - you cannot just hand data over. Article 49(5): Member States may, for important public-interest reasons, limit transfers of specific data categories.

Key terms - quick answers

What is “Article 49”?
The GDPR article listing derogations - narrow, last-resort grounds for a transfer when no adequacy decision or appropriate safeguard is available.
What is “Derogations”?
Last-resort exemptions, narrowly interpreted, permitting a transfer in specific situations (consent, contract, public interest, legal claims, vital interests, public register, compelling legitimate interests).
What is “Compelling legitimate interests”?
A narrow derogation for transfers that are non-repetitive and concern only a limited number of data subjects.
What is “Article 48”?
A restriction: a third-country court or authority order for data is only recognised via an international agreement (e.g. a mutual legal assistance treaty) or EU/Member State law.

Sources and study method

This independent lesson uses active recall, spaced retrieval and scenario practice. Read the full study method.