Article 49 of the GDPR allows transfers to third countries without an adequacy decision or appropriate safeguards in specific situations, such as explicit consent or a contract with the person. They are exceptions. The text of the fallback for compelling legitimate interests requires transfers that are not repetitive and concern only a limited number of people.
The list
Under Article 49(1), the transfer may go ahead if one of these applies:
- The person gave explicit consent after being informed of the risks of a transfer without adequacy or safeguards.
- The transfer is necessary to perform a contract with the person, or pre contract steps they requested.
- It is necessary for a contract concluded in the person's interest between the controller and another party.
- It is necessary for important reasons of public interest recognised in EU or Member State law.
- It is necessary to establish, exercise or defend legal claims.
- It is necessary to protect vital interests when the person cannot consent.
- The data comes from a public register, within the limits in Article 49(2).
The last resort
If no safeguard or listed derogation applies, there is a narrow fallback. The transfer must be not repetitive, concern only a limited number of data subjects, be necessary for compelling legitimate interests not overridden by the person's rights, and follow an assessment of all the circumstances with suitable safeguards. You must also tell the supervisory authority and the data subject, and document the assessment in your records.
Why this is not for products
A product that sends data to a vendor in a third country every day is repetitive by nature. The consent route is also fragile. Consent must be explicit and informed about the risks, and it must be possible to say no. If a core feature stops working when someone declines, that is a poor basis. Check with counsel before building a design on consent for routine transfers.
For how regulators read these exceptions, check the EDPB's guidelines on Article 49 derogations. I did not retrieve that text for this post.
Where they do fit
- A one off transfer to answer a legal claim in a foreign court.
- A booking that requires sending a traveller's details to a hotel abroad, where the contract with the person needs it.
- An emergency affecting someone's life.
A practical rule
If your engineers can describe the transfer as "a job that runs every day", look at Article 46 tools instead. See Article 46 tools compared.
Quick check
Can we use consent in our terms of service for all transfers?
That is risky. Consent must be explicit, informed and freely given. A blanket clause in terms is unlikely to meet that bar. Ask counsel.
Does the compelling interests route need notification?
Per the text of Article 49, yes: the supervisory authority and the data subject must be informed, and the assessment documented.
Sources
This is educational content, not legal advice.
Last reviewed: 19 October 2026.
