# GDPR Article 49 — Derogations for specific situations - Source: https://support.icompaas.com/compliance/gdpr/article-49-derogations-for-specific-situations - Section: [Compliance](https://support.icompaas.com/compliance) › [GDPR (Regulation (EU) 2016/679)](https://support.icompaas.com/compliance/gdpr) › Articles 41–50 - Last updated: 2026-06-05 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **GDPR**·Article `Article 49`·medium·Component: **Chapter V: Transfers of Personal Data to Third Countries** ## What this control requires > Ensure compliance with GDPR Article 49 for data transfers to third countries without adequacy decisions or safeguards, using derogations like explicit consent, contract necessity, public interest, legal claims, vital interests, or limited non-repetitive transfers with suitable safeguards. Document assessments and inform supervisory authorities and data subjects. This control addresses International Data Transfers. > > — GDPR, Article Article 49 ### In plain English Ensure compliance with GDPR Article 49 for data transfers to third countries without adequacy decisions or safeguards, using derogations like explicit consent, contract necessity, public interest, legal claims, vital interests, or limited non-repetitive transfers with suitable safeguards. In practice, this means you can prove you data consent-level controls on a defined cadence. ## Why it matters GDPR administrative fines reach the greater of €20 million or 4% of global annual turnover. The European Data Protection Board (EDPB) coordinates supervisory-authority enforcement across the EU/EEA, and DPAs publish enforcement decisions citing specific Articles. ## What an auditor looks for A DPA or privacy auditor expects: a Records of Processing Activities (RoPA) entry, a documented lawful basis, evidence the Article's data-subject right is operationalised end-to-end, a named DPO contact (where required), and Article 30 records that match what the front-end actually does. Within **Chapter V: Transfers of Personal Data to Third Countries**, the assessor will trace your implementation back to the catalogue reference (Article Article 49) and look for objective evidence on the latest two assessment cycles. ## How to implement #### Incident Response **Runbook.** Maintain a runbook keyed by incident type with named roles (IC, comms, scribe), an out-of-band comms channel, and a 72-hour timeline for external notification. **Tabletop.** Run a quarterly tabletop exercise (ransomware, insider, supply-chain) and feed gaps back into the runbook. ### Operational checklist - **Data.** Document the trigger, the owner and the cadence. - **Transfers.** Document the trigger, the owner and the cadence. - **Derogations.** Document the trigger, the owner and the cadence. - **International.** Document the trigger, the owner and the cadence. - **Supervisory.** Document the trigger, the owner and the cadence. - **Scope:** consent, transfers, situations, article, data subjects. ## Evidence to collect - **Ticketing Workflow.** `ticketing_workflow` evidence Workflow metrics (ServiceNow, Jira) show approvals and remediation. Focus: Derogations for specific situations. ## Common pitfalls - Runbooks that name a role but no person, or list a paging channel that no longer exists. ## How it maps to other frameworks Computed from shared tags, control component and key-operation subjects — handy when you are reconciling controls across an audit. - [**CIS Controls v8 11.2** — Perform Automated Backups](https://support.icompaas.com/compliance/cis-controls-v8/11-2-perform-automated-backups) - [**BSI C5:2020 AM-04** — Decommissioning of Hardware](https://support.icompaas.com/compliance/bsi-c5-2020/am-04-decommissioning-of-hardware) ## Related controls in GDPR - [**Article Article 44** — General principle for transfers](https://support.icompaas.com/compliance/gdpr/article-44-general-principle-for-transfers) - [**Article Article 16** — Right to rectification](https://support.icompaas.com/compliance/gdpr/article-16-right-to-rectification) - [**Article Article 27** — Representatives of controllers or processors not established in the Union](https://support.icompaas.com/compliance/gdpr/article-27-representatives-of-controllers-or-processors-not-established-in-the-union) - [**Article Article 80** — Representation of data subjects](https://support.icompaas.com/compliance/gdpr/article-80-representation-of-data-subjects) - [**Article Article 82** — Right to compensation and liability](https://support.icompaas.com/compliance/gdpr/article-82-right-to-compensation-and-liability) - [**Article Article 20** — Right to data portability](https://support.icompaas.com/compliance/gdpr/article-20-right-to-data-portability) ## References - [European Union — GDPR](https://eur-lex.europa.eu/eli/reg/2016/679/oj) - Catalogue identifier: `Article Article 49` Topics: governance riskchange managementincident response ## Related compliance guidance - [GDPR compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/gdpr): Start with the full GDPR implementation guide — scope, roadmap, evidence and how the assessment runs. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): The security management system most EU procurement teams ask for alongside a DPA; its controls supply much of the Article 32 evidence. - [India's DPDP Act 2023: a practical compliance guide for cloud teams](https://support.icompaas.com/compliance/india-dpdp-act-2023): If engineering or support teams sit in India, the same data flows are also subject to India’s Digital Personal Data Protection Act.