On 5 June 2025 the EDPB adopted the final version of its guidelines on data transfers to third country authorities. These guidelines aim to help organisations to assess when they can “lawfully respond to requests for a transfer of personal data from third country authorities.”
The guidelines clarify that judgments/decisions from third country authorities cannot automatically and directly be recognised or enforced in an EU member state. Generally recognition and enforceability is based on international agreements.
In the executive summary the EDPB makes it clear that, notwithstanding any international agreements, “if a controller or processor in the EU receives and answers a request from a third country authority for personal data, such data flow is a transfer under the GDPR and must comply with Article 6 and the provisions of Chapter 5.” It is worth noting, however, that an international enforcement agreement may provide for a legal basis and a ground of transfer.
The guidelines can be found here.
