GDPR Article 49: Obligations, Deadlines & Penalties

The controller must ensure that a transfer to a third country based on compelling legitimate interests is not repetitive, concerns only a limited number of data subjects, and is necessary for purposes not overridden by the data subject's rights. Regulation (EU) 2016/679, Article 49, Article 49

The controller must assess all the circumstances surrounding the data transfer and provide suitable safeguards with regard to the protection of personal data when relying on compelling legitimate interests. Regulation (EU) 2016/679, Article 49, Article 49

The controller shall inform the supervisory authority of the transfer when relying on compelling legitimate interests under the second subparagraph of paragraph 1. Regulation (EU) 2016/679, Article 49, Article 49

The controller shall inform the data subject of the transfer and on the compelling legitimate interests pursued, in addition to providing the information referred to in Articles 13 and 14. Regulation (EU) 2016/679, Article 49, Article 49

Member States shall notify provisions that expressly set limits to the transfer of specific categories of personal data to a third country or an international organisation for important reasons of public interest to the Commission. Regulation (EU) 2016/679, Article 49, Article 49

The controller or processor shall document the assessment as well as the suitable safeguards referred to in the second subparagraph of paragraph 1 in the records referred to in Article 30. Regulation (EU) 2016/679, Article 49, Article 49