EDPB Finalizes Guidelines on Data Transfers to Third Country Authorities and Training Materials on AI and Data Protection

Data Transfers to Third Country Authorities

On June 4, 2025, the European Data Protection Board (“EDPB”) published the final version of Guidelines 02/2024 on Article 48 of the GDPR (the “Guidelines”) regarding data transfers to third country authorities.

The predominant focus of the Guidelines is to clarify that judgements or decisions from third country authorities cannot be automatically or directly recognized or enforced in an EU Member State, reaffirming that a request from a foreign authority does not inherently constitute a legal basis for the processing or a ground for the transfer.

The Guidelines highlight that international agreements may provide for both a legal basis and a ground for transfer, although the Guidelines also recognize that other legal bases or grounds for transf