meta_id 3410027

On June 5, 2025, the European Data Protection Board (EDPB) published the final version of Guidelines 02/2024 on Article 48 of the General Data Protection Regulation (GDPR). The guidelines provide clarification on the requirements and procedures outlined in Article 48 GDPR, which addresses transfers of personal data to third countries and the mechanisms available to organisations seeking to legitimise such transfers. Article 48 GDPR establishes the legal framework for international data transfers, permitting transfers only where specific conditions are met. The EDPB's guidelines clarify the application of these conditions and the tools available to controllers and processors to ensure compliance when transferring personal data outside the European Union. The guidelines address binding corporate rules (BCRs), adequacy decisions, and standard contractual clauses as mechanisms for facilitating lawful transfers. The EDPB developed these guidelines following public consultation on an earlier draft version, incorporating feedback from stakeholders to ensure comprehensive coverage of practical implementation issues. The guidelines are available in multiple languages, including English, German, French, Spanish, and others, reflecting the EDPB's commitment to accessibility across EU member states. Organisations handling personal data of EU residents must review these guidelines to ensure their data transfer mechanisms comply with GDPR requirements. The guidelines are particularly relevant for multinational enterprises, international service providers, and any organisation transferring personal data across borders. Controllers and processors should assess their current transfer mechanisms against the clarifications provided and implement any necessary adjustments to maintain compliance. The EDPB continues to issue related opinions on binding corporate rules applications, as evidenced by concurrent opinions on Flutter Group and Fluor Group BCRs published in June and July 2026. REFERENCES: European Data Protection Board. Guidelines 02/2024 on Article 48 GDPR. Available at: https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-022024-article-48-gdpr_en