GDPR Article 49(1), second subparagraph: the last-resort transfer ground (Regulation (EU) 2016/679, Art 49(1) second subparagraph)
A licence of a large dataset to an AI buyer is a bulk, planned transfer, so this one-off ground does not fit. A holder should not plan around it.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“a transfer to a third country or an international organisation may take place only if the transfer is not repetitive, concerns only a limited number of data subjects, is necessary for the purposes of compelling legitimate interests pursued by the controller which are not overridden by the interests or rights and freedoms of the data subject, and the controller has assessed all the circumstances surrounding the data transfer and has on the basis of that assessment provided suitable safeguards”
Where it was read
Also read from the same source
- GDPR Article 5(1)(b): purpose limitation (Regulation (EU) 2016/679, Art 5(1)(b))
- GDPR Article 6(1)(f): legitimate interests as a lawful basis (Regulation (EU) 2016/679, Art 6(1)(f))
- GDPR Article 6(4): compatibility test for a new purpose (Regulation (EU) 2016/679, Art 6(4))
- GDPR Recital 50: further processing and the legal basis (Regulation (EU) 2016/679, recital 50)
- GDPR Article 9(1): special categories of personal data (Regulation (EU) 2016/679, Art 9(1))
- GDPR Article 13(3): telling people before a new purpose (Regulation (EU) 2016/679, Art 13(3))
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide