Article 49 GDPR
Exceptions in specific situations

1. In the absence of a decision establishing an adequate level of protection as referred to in Article 45(3) or of appropriate safeguards as referred to in Article 46, including binding corporate rules, a one-time or repeated transfer of personal data to a third country or an international organization may take place only if:

(a) the data subject has been informed of the potential risk to which the proposed transfer may be subject, in the absence of a decision establishing an adequate level of protection and in the absence of adequate safeguards has expressly consented;

(b) the transmission is necessary for the performance of the contract between the data subject and the controller or for the implementation of pre-contractual measures taken at the request of the data subject;

(c) the transmission is necessary for the conclusion or performance of a contract concluded in the interest of the data subjects between the controller and another natural or legal person;

(d) the transmission is necessary for important reasons of public interest;

(e) the transfer is necessary for the establishment, investigation or protection of claims;

(f) the transmission is necessary to protect the vital interests of the data subject or of other persons where the data subject is physically or legally incapable of giving consent; or

(g) the transmission follows from a register which, in accordance with Union or Member State law, is intended to serve as a source of information for the general public and which is accessible to the general public or to any person who can demonstrate a legitimate interest but only to the extent that the conditions for such access laid down in Union or Member State law are met in the case in question.

If the transfer cannot be based on Articles 45 or 46, including the provisions on binding corporate rules, and none of the exceptions applicable in specific situations under the first subparagraph of this paragraph apply, a transfer to a third country or an international organization may take place only if the transfer is not routine, concerns only a limited number of data subjects, is necessary for the purposes of the legitimate interests pursued by the controller, which are not overridden by the interests or rights and freedoms of the data subject, and the controller has assessed all the circumstances of the transfer and, on the basis of that assessment, has provided appropriate safeguards for the protection of personal data. The controller shall notify the supervisory authority of the transfer. In addition to the information referred to in Articles 13 and 14, the controller shall also provide the data subject with information regarding the transfer and the legitimate interests pursued by the controller.

2. A transfer under paragraph (1), first subparagraph, point (g) shall not include the entirety of personal data or entire categories of personal data contained in the registry. If the registry is available to persons with a legitimate interest, the transfer shall only take place at the request of such persons or if they are to be recipients.

3. Subparagraphs (a), (b), (c) of the first subparagraph of paragraph 1 and the second subparagraph of paragraph 1 thereof shall not apply to activities carried out by public bodies in the exercise of their public powers.

4. The public interest referred to in point (d) of the first subparagraph of paragraph 1 must be recognized in Union law or in the law of the Member State to which the administrator is subject.

5. In the absence of a decision establishing an adequate level of protection, Union law or Member State law may, for compelling reasons of public interest, expressly impose restrictions on the transfer of specific categories of personal data to a third country or international organization. Member States shall notify the Commission of such provisions.

6. The controller or processor shall document the assessment and the appropriate safeguards referred to in the second subparagraph of paragraph 1 of this Article in the records referred to in Article 30.