Article 48 GDPR: foreign court orders and transfers

Why a foreign court order does not make a transfer lawful under Article 48 GDPR

A foreign court order or authority request does not, on its own, make it lawful to send personal data out of the EU. Under Article 48, a third-country judgment or administrative decision that requires a controller or processor to transfer or disclose personal data can be recognized or enforced only where it rests on an international agreement in force between the requesting country and the Union or a Member State, such as a mutual legal assistance treaty. Even then, that route sits alongside the other Chapter V grounds rather than replacing them. For a controller or an EU-based processor that receives a demand from a US or other non-EU authority, the first decision is whether an agreement like that applies at all. If none does, the order is not a lawful basis for the disclosure, and the organization still has to find a separate Chapter V ground before any transfer happens.

The practical difficulty is that the recipient often receives the request with a short deadline, a confidentiality instruction and no reference to any treaty. Before any engagement with a processor established in the EU but subject to a third country's laws, the controller should have already assessed this exposure, as the EDPB's Guidelines 05/2021 expect. In practice that means checking the processor's contract for a clause requiring the processor to notify the controller of such requests where the law allows, to review their legality and to challenge them where there are reasonable grounds. Under Clause 15 of the 2021 standard contractual clauses, the importer agrees to review the legality of public authority disclosure requests and challenge them where there are reasonable grounds, so the same questions apply when the clauses are used.

If a processor complies with such a request against the controller's documented instructions, the processor risks becoming a controller under Article 28(10), and the disclosure itself becomes a transfer that must be justified. Controllers should confirm with each processor who would review incoming requests, how quickly the controller would be told, which team decides on disclosure, and what log of requests and responses is kept. These are questions to answer in the contract and in the processor's written procedures, not in the middle of a request. Whether a specific provider or legal regime creates this exposure is a question for counsel and the provider's own legal analysis, and it should be confirmed in writing before a contract is signed.

Which systems, providers and contracts fall under Article 48 exposure

Article 48 exposure comes from the places where a third-country authority can reach personal data held or accessed by an EU-based organization or its providers. The cards below cover the scoping decisions that connect those points, from the provider's corporate ownership to the contract clauses that govern how a government request is handled.

EU-based providers with foreign parents

An EU-incorporated cloud or SaaS provider may still be controlled by a parent or affiliate subject to third-country laws with extraterritorial reach. Using that provider is not itself a transfer, but the exposure is real: a foreign order could be directed at the affiliate and compel access to data the EU entity holds. Ask the provider to describe its ownership chain, the legal basis on which its parent could be compelled, and how it has responded to past requests.

Support access from outside the EEA

Remote administration, troubleshooting and follow-the-sun support often means staff in a third country can view or export personal data. Each such access is a transfer in its own right, so the exporter must map who connects, from where, and under which safeguard. Confirm which support tiers can reach production data, whether access is logged and approved per ticket, and whether the provider can refuse a disclosure request routed through that support team.

Sub-processors holding copies

Data often reaches a third-country authority through a sub-processor, backup vendor or managed monitoring service rather than the primary processor. Each sub-processor adds its own jurisdiction and its own exposure. Request the current sub-processor list with hosting locations and parent companies, check that each one is bound by the same processing terms, and confirm that backups and logs held by these parties are included in the assessment.

Processor contracts silent on government access

A processing agreement that says nothing about public authority requests leaves the controller without a basis to direct the processor's response. Article 28(3)(a) requires processing only on documented instructions, including for transfers, unless Union or Member State law requires otherwise. Check whether the contract requires the processor to notify the controller of a request where legally permitted, to challenge unlawful requests, and to disclose only the minimum data necessary.

Standard contractual clauses addressing requests

Where the provider relies on the 2021 standard contractual clauses, Clause 15 obliges the importer to review the legality of public authority disclosure requests and to challenge them where there are reasonable grounds. Confirm that the clauses used are the version in force, that the Clause 14 assessment of local laws is documented, and that the provider can show how it has handled prior requests. Contracts that copy the clauses without completing the annexes give little practical protection.

Controller decisions before engaging a provider

The controller should assess this exposure before engaging an EU processor subject to third-country law, so that it uses only processors providing sufficient guarantees under Article 28. Record the assessment, the provider's answers, and the decision to proceed or to choose another provider. Illustrative example: a controller reviewing a managed hosting offer documents the parent company's jurisdiction, the support locations and the contract clauses before signing, then repeats the review at each renewal or sub-processor change.

How an assessor tests transfers driven by foreign authority requests

This table sets out what an assessor checks for each test area under Article 48, the evidence they ask to see, and the findings that most often lead to a gap. Read it as a checklist for preparing the processor contracts, exposure assessments, challenge procedures and request records that show how the organization handles third-country authority demands.

Test area	What the assessor checks	Evidence requested	Common finding
Processor contracts	Processing, including any transfer, happens only on documented instructions unless Union or Member State law requires otherwise (Article 28(3)(a))	Signed processor agreements, instruction annexes, and the list of permitted transfer destinations	Contract silent on third-country disclosure, or instructions that do not name the transfers actually occurring
Exposure assessment before engagement	The controller assessed whether an EU processor subject to third-country law could be compelled to disclose data, before engaging it	Dated written assessment covering the processor's legal exposure, the laws involved and the safeguards considered	No assessment on file, or assessment written after the processor was already onboarded
Sufficient guarantees	The processor's technical and organizational measures and contractual commitments were checked against the controller's risk	Due diligence records, security attestations supplied by the processor, and sign-off by the controller	Reliance on the processor's EU location alone, without reviewing its disclosure obligations
Handling of public authority requests	The importer reviews the legality of each disclosure request and challenges it where there are reasonable grounds, as Clause 15 of the 2021 standard contractual clauses requires	Written request-handling procedure, named owners, legal review records and any challenge filings	No documented procedure, or requests passed directly to the authority without review
Notification and instructions conflict	Staff know to refer foreign requests to the controller and to refuse compliance that conflicts with the controller's instructions, where the law allows	Escalation runbook, notification templates and examples of escalations to the controller	Processor complied with a third-country request without informing the controller
Records of past requests	The organization can show what requests it received, how each was assessed and what data was disclosed	Request register with dates, requesting authority, legal basis cited, data categories and outcome	No register exists, or the register cannot show whether a disclosure was made
Recognition of foreign orders	The organization does not treat a third-country order as a lawful basis for transfer unless an international agreement in force supports it (Article 48)	Legal analysis of the order's basis, mutual legal assistance treaty references where relevant, and decision record	Foreign order accepted as sufficient authority without any check of the underlying agreement
Staff training and governance	Teams that receive requests, including support and legal, know the escalation path and the decision owner	Training records, role assignments and periodic test of the escalation path	Escalation path known only to one individual, or never exercised

How to implement Article 48 controls step by step

The sequence below moves from identifying which providers could receive third-country orders to a tested escalation path, so that any request for EU personal data is checked against Article 48 before anything is disclosed. Each step produces a record the organization can show an auditor, customer or supervisory authority.

Map providers exposed to third-country orders
Start with an inventory of every processor, sub-processor and support channel that touches personal data, and record the country where each entity is incorporated and where staff or systems can access the data. Flag any provider that is subject to third-country law with extraterritorial reach, including EU-based providers owned or controlled by a non-EU group. The output is a register that lists each provider, its legal jurisdiction, the data it handles and the access paths that could be used to compel disclosure. Confirm the register with the provider's own transparency documentation and contract terms, not only with the sales team.
Assess exposure before engaging each provider
Before signing or renewing a processor contract, assess whether the provider could be ordered to disclose data in a way that conflicts with EU law, and whether it has the guarantees Article 28 requires. Document the third-country laws that apply, the likelihood of a request given the data and sector, and the provider's practices for challenging requests. Involve legal counsel in this assessment, since the outcome depends on the specific laws and facts. The output is a signed-off exposure assessment for each provider, with a decision to proceed, add measures or decline.
Set contract terms on instructions and transfers
Write the processing agreement so the processor acts only on documented instructions, including for any transfer, unless Union or Member State law requires otherwise. Add a clause requiring the processor to notify the controller of any third-country order or request for personal data, to the extent the law permits, and to refuse disclosures outside a valid international agreement. Require the processor to review the legality of each request and to challenge it where there are reasonable grounds. The output is an executed agreement with these terms, which legal and procurement teams can check against the exposure assessment.
Define the legal review and challenge procedure
Set out who receives a foreign request, how it is logged, and who decides whether it is valid under Article 48. The procedure should check whether the request is a court judgment or administrative decision, whether a mutual legal assistance treaty or other international agreement in force with the Union or a Member State applies, and whether another Chapter V ground exists. It should also state when the team may disclose, when it must seek a narrower scope, and when it must refuse and inform the controller. The output is a written procedure with named roles, reviewed by counsel and approved by the accountable executive.
Configure logging of requests and disclosures
Set up a register that records each request, its origin, the data requested, the legal review outcome, any challenge, and what was disclosed. Restrict access to this register and protect it with the same controls applied to the personal data it describes, since the entries can reveal sensitive investigations. Confirm that the systems and support channels can produce these records on demand. The output is a tested register with sample entries, which the team can present to an assessor or supervisory authority without reconstructing events from memory.
Set escalation paths to controllers and the DPO
Define when a request must be escalated to the controller, the data protection officer where one is designated, and senior management. Include triggers such as a request from an authority outside the EU, a request covering special categories of data, or a request that the processor believes conflicts with the controller's instructions. Set out who informs affected customers and how quickly the processor must act within the terms of its contract. The output is an escalation matrix that the contract, the legal procedure and the logging register all reference.
Test the procedure and review it periodically
Run a tabletop exercise with a hypothetical request, shown as illustrative, that goes through mapping, legal review, challenge, logging and escalation. Record gaps, such as unclear roles or a missing contract clause, and fix them before the next provider review. Repeat the review when a provider changes its jurisdiction, its ownership, its sub-processors or the third-country laws that apply, and confirm the cycle with counsel. The output is a dated test record and an updated register, which together show the controls operate as designed.

Evidence that shows a foreign request is handled lawfully

Article 48 does not ask for a certificate. It asks the organization to show, record by record, that a third-country order was assessed against a recognized international agreement before any data left the EU. The cards below are the artifacts that carry that proof, and each one has to stay current between reviews, not just exist on the day someone asks.

Exposure assessment per processor

Before engaging an EU processor that is subject to third-country law with extraterritorial reach, record what that law could compel, which data it could reach and what guarantees the processor offers under Article 28. The EDPB treats this exposure check as a step the controller takes before engagement. Review it when the processor changes its corporate ownership, hosting footprint or sub-processor chain, and check that the assessment names the specific laws reviewed rather than a general statement of risk.

Processor contract clauses on instructions

The contract should require the processor to process personal data only on documented instructions, including for transfers, unless Union or Member State law requires otherwise. Add a clause that obliges the processor to notify the controller of a third-country request where legally permitted and to refuse to act on it without that instruction. Verify that the clause matches what the processor's operations actually do, since a clause that cannot be enforced in practice is weak evidence.

Government access clauses

Where the contractual chain uses the 2021 standard contractual clauses, Clause 15 commits the importer to review the legality of public authority disclosure requests and to challenge them where there are reasonable grounds. Keep the signed clauses, the importer's commitments on notification and challenge, and any annex describing the government access safeguards. Confirm that the importer can actually perform these steps under its own local law.

Request register

Maintain a log of every foreign court order, authority request or informal approach that touches EU personal data. Record the requesting authority, the legal basis claimed, whether an international agreement such as a mutual legal assistance treaty was invoked, the data categories, the decision taken and the date. Auditors and supervisory authorities test this register against the processor's own statements, so gaps between the log and processor reports are the first thing they look for.

Legal review memos

For each request, keep a dated memo from counsel that answers three questions: whether the request is recognized or enforceable under an international agreement in force with the Union or a Member State, whether a Chapter V ground applies to any resulting transfer, and what data minimization or narrowing was negotiated. Store the memo with the register entry it supports. A memo that only concludes the request is valid, without citing the agreement, does not show that Article 48 was applied.

Records of challenges and refusals

Keep the correspondence showing that the processor or controller challenged an unlawful request, narrowed its scope, asked for the agreement it relies on or refused to comply. These records prove that the organization acted on its obligations rather than complying by default. Include the outcome, any court filings and whether the supervisory authority was informed. Where no challenge was made, record the reasons, so that the absence is explained rather than unexplained.

Currency between reviews

Set a review trigger for each artifact rather than a fixed calendar alone. Reassess an exposure assessment when a processor changes hosting, ownership or sub-processors, when a third-country law is amended, or when the EU-US Data Privacy Framework or another adequacy basis changes. Assign an owner to the register, require that every new request is logged within a set internal deadline, and confirm annually that the processor's clauses still reflect how requests are handled.

What meeting Article 48 obligations costs in money and effort

This table breaks down the cost components of handling foreign authority requests under Article 48, who is paid for each one, whether it is one-time or recurring, and what drives it up. Use it to scope internal effort against outside advice and to know what to request in a written quote. No fees or durations are stated because none were supplied for this topic.

Cost component	Who is paid	One-time or recurring	What drives the cost
Legal review of exposure before engaging a processor subject to third-country law	Internal counsel or outside EU data protection counsel	One-time per processor, repeated on material change	Number of processors with extraterritorial exposure, and how many laws each one must be checked against
Renegotiating processor contracts for request handling, challenge duties and notice	Internal legal, procurement and outside counsel where the provider pushes back	One-time per contract, with periodic review	Provider size and leverage, and whether the contract already follows the 2021 standard contractual clauses
Engineering request logging, access controls and routing of requests to the controller	Internal platform and security engineers, or an implementation partner on a fixed scope	One-time build, then recurring operation and log retention	Number of systems holding personal data, existing logging maturity, and how requests are reviewed before disclosure
External advice on third-country law and mutual legal assistance treaty routes	Foreign-law counsel, billed per matter or per opinion	Recurring when laws or requests change; otherwise per matter	Number of jurisdictions involved and whether opinions are needed in writing for each provider
Staff training and documented request procedure	Internal staff time, sometimes external trainers	Initial rollout, then annual refresh	Number of staff who can receive a request and the speed of turnover in those roles
Audit and evidence collection by an independent assessor	Independent auditor or assessor, not the implementation partner	Recurring with each assessment cycle	Scope of processors and transfers examined and the quality of the request log
Ongoing monitoring of third-country law changes	Internal counsel or a subscribed legal service	Recurring	Number of third countries where providers are established or subject to access laws

Who owns the controls and who prepares the evidence

The controller remains accountable for whether personal data leaves the EU or EEA and for the conditions under which a provider may respond to a foreign request. Its legal and privacy team therefore owns the decision to engage a provider exposed to third-country law, the assessment of that exposure before signing, and the instructions the processor must follow under Article 28(3)(a). Those instructions should say what the processor must do when a foreign authority asks for data, including who is notified, how fast, and whether the processor may comply without a valid international agreement.

Pre-engagement exposure assessment: Document which third-country laws could reach the provider and whether an EU processor is still subject to them.
Written instructions: Specify that disclosure requests are escalated to the controller before any response.
Contract terms: Negotiate notice periods, challenge obligations and the right to terminate if a provider complies unlawfully.
Records: Keep the assessment, the decision and the reasons in the record of processing and the transfer register.
Review triggers: Reassess when the provider changes ownership, sub-processors or hosting location.

Check that the legal team, not an engineering owner, signs off the exposure assessment and that the file can be produced to a supervisory authority on request.

Where organizations fall short on foreign authority requests

Most gaps in this area come from treating a foreign order as if it settled the transfer question on its own. The cards below cover the gaps that show up most often in processor contracts, request handling and vendor reviews, and the step that closes each one. Each gap is a place where the controller or processor has no written decision, owner or record when a third-country demand arrives.

No pre-engagement exposure assessment

Controllers often select an EU processor without asking whether that provider is subject to third-country laws with extraterritorial reach. EDPB Guidelines 05/2021 say the controller should assess this exposure before engagement and use only processors that give sufficient guarantees under Article 28. To close the gap, record the provider's corporate ownership, the foreign laws that could reach its staff or systems, and the decision taken on that basis before signing.

Contracts silent on third-country orders

Processor agreements that only say processing happens on documented instructions leave open what the provider does when a foreign authority asks for data. Article 28(3)(a) requires processing on documented instructions, including for transfers, unless Union or Member State law requires otherwise. Add terms that require the provider to notify the controller of foreign requests where legally permitted, to refuse disclosure outside a valid international agreement, and to state which instructions it will follow.

No challenge procedure for requests

Without a defined route for challenge, staff decide case by case whether a request is valid, often under time pressure. Clause 15 of the 2021 standard contractual clauses expects the importer to review the legality of public authority disclosure requests and to challenge them where there are reasonable grounds to consider them unlawful. Write a procedure that names the legal reviewer, the criteria for challenge, the escalation path to the controller and the point at which a supervisory authority is informed.

No register of authority requests

Organizations that cannot show how many foreign requests they received, what data they covered and what they disclosed cannot assess their exposure or answer a regulator's questions. A request register should log the date, requesting authority, legal basis cited, data categories, the decision taken and the minimum data released. Review the register at least as often as the transfer impact assessment, and confirm that the register itself contains no more personal data than it needs.

Treating a court order as sufficient

A judgment from a third-country court or an administrative decision does not by itself authorize a transfer or disclosure of personal data under the GDPR. Article 48 allows recognition or enforcement only where it rests on an international agreement, such as a mutual legal assistance treaty, in force between the Union or a Member State and the requesting country, and without prejudice to other Chapter V grounds. Route every order to legal review before any data leaves the EU.

Unclear roles when a request lands

When a processor complies with a foreign request against the controller's instructions, it risks being treated as a controller under Article 28(10), with the responsibility that follows. Many contracts never say who decides, who informs whom and who bears the consequences. Assign named roles on both sides for receiving, reviewing and answering requests, and test the handoff with a tabletop exercise so the first real request does not reveal the gap.

Questions buyers ask about Article 48 GDPR

Can a foreign court order ever make a transfer lawful under GDPR?

On its own, no. Under Article 48, a third-country court judgment or administrative decision requiring a controller or processor to transfer or disclose personal data can be recognized or enforced only if it rests on an international agreement in force between the EU or a Member State and the requesting country, such as a mutual legal assistance treaty. The order still has to fit one of the other Chapter V grounds, such as an adequacy decision, appropriate safeguards or a narrow derogation. A demand letter from a foreign authority does not create a lawful basis for the disclosure by itself, so the exporter needs a documented route before it responds.

How do mutual legal assistance treaties fit into a cross-border data request?

A mutual legal assistance treaty (MLAT) is one type of international agreement that can provide the recognized route Article 48 describes. It sets up a government-to-government channel, so the request usually passes through the competent authorities rather than arriving directly at a company. Whether a specific treaty covers your data, your jurisdiction and the type of request is a legal question. Ask counsel to confirm which agreement, if any, applies, whether it is in force for the relevant Member State, and how the exporter should respond while the request is pending.

Does using an EU provider that is subject to US or other third-country law create a transfer?

Using an EU-based processor that is subject to third-country law with extraterritorial effect is not, by itself, a transfer, according to EDPB Guidelines 05/2021. Complying with a third-country authority request would be a transfer, though. If the processor does so against the controller's instructions, it becomes a controller under Article 28(10). The controller should assess this exposure before engaging the processor, so that it only uses processors that give sufficient guarantees. Your legal team should document that assessment as part of the processor selection file.

What does a provider's contract need to say about government access requests?

The contract should require the processor to process personal data only on documented instructions, including instructions about transfers, unless Union or Member State law requires otherwise, as Article 28(3)(a) sets out. It should also set how the processor handles public authority requests: notifying the controller where legally permitted, reviewing the request's legality and challenging it where there are reasonable grounds. Where standard contractual clauses apply, Clause 15 of the 2021 clauses contains similar commitments. Ask counsel to check these terms against your own processor and sub-processor chain, not only the provider's template.

How much effort does an Article 48 review take, and who does the work?

The work splits across three roles. Your legal team decides the lawful basis for each transfer route and interprets any treaty or order. Your engineering and security teams map where data is stored, who can access it and which sub-processors touch it. An implementation partner such as DeployOpen can prepare systems, access logs, encryption configuration and evidence for the review, but it cannot make the legal determination or issue an opinion. Effort depends on how many processors and regions are involved, how well the data flows are already documented, and whether a live request is pending. Ask any provider for a written scope that separates these responsibilities.

What drives the cost of this work, and what should a quote include?

Cost depends on the size of your processor chain, the number of data flows that cross borders, the state of existing documentation and the amount of legal review needed. Recurring costs include monitoring new sub-processors and changes in third-country law, while one-time costs cover the initial mapping and assessment. DeployOpen does not publish a price list and quotes follow from a written scope. Ask for a quote that lists the systems in scope, the deliverables, the roles of legal and technical staff, which items are one-time and which recur, and what is excluded, such as external legal opinions.

Can our team handle Article 48 assessments in-house?

Many organizations can run the assessment internally if they have a privacy lead with GDPR transfer experience and counsel who knows the relevant third-country laws. The engineering work is well suited to in-house teams that already hold the data flow inventory and access controls. Outside help is most useful when you need a technical implementation of safeguards, evidence collected from self-hosted platforms, or a review of your architecture before a live request arrives. Confirm internally who owns the decision, who responds to authorities and how quickly legal and engineering can work together under pressure.

What should our engineers check before a foreign request arrives?

Engineers should confirm where each dataset is stored, which administrative accounts and support channels can reach it from outside the EEA, and whether the provider holds the encryption keys. They should also check that access and disclosure events are logged in a form that legal teams can use, and that a named person can receive and route a request within the organization. DeployOpen can help prepare these controls in self-hosted platforms inside your own infrastructure. Confirm with your legal team which steps are required before any disclosure, because technical readiness does not decide whether a disclosure is lawful.

How DeployOpen prepares Article 48 evidence for self-hosted platforms

DeployOpen plans, implements and documents self-hosted open-source platforms inside the client's own infrastructure, so the client controls where personal data sits and who can reach it. For Article 48, we help prepare the technical and contractual evidence that shows how foreign requests are identified, reviewed and handled, while the controller remains responsible for the legal assessment.

How we scope

The written scope lists which platforms, hosting locations and third-party administrators fall under the review of foreign access exposure.
We map which vendors, support staff and sub-processors could receive a foreign authority request and record the contractual route for each.
Scope also states which decisions stay with the client's legal counsel, such as whether a request is lawful under Article 48.

How we build

We configure hosting, key management and access controls so that data stays in client-chosen locations and encryption keys remain under client control.
We set up logging of administrative and vendor access so any disclosure attempt or remote access event can be traced and reported.
We prepare the request-handling workflow so staff know how to route, record and escalate a foreign court order or authority demand.

How we hand over

Deliverables include a written register of foreign-law exposure, system diagrams and the configuration evidence supporting each claim.
We document the procedure for challenging requests, notifying the controller and recording instructions, aligned with the processor contract terms.
Handover includes runbooks and a test record, so the client's team can show an assessor how the process works in practice.

How we support

Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
Ongoing support, upgrades and continuous testing are available as a retainer, so evidence stays current as vendors and laws change.
Confirm with your legal counsel and any independent auditor which evidence they require, since DeployOpen prepares evidence but does not issue reports or certificates.