# Article 49 Derogation Assessment Workflow

## Pre-Assessment Workflow

1. **Confirm Art. 45/46 are unavailable**: Document why no adequacy decision exists for the destination country and why Art. 46 safeguards (SCCs, BCRs) cannot be established for this specific transfer.
2. **Confirm occasional nature**: Verify the transfer is not systematic, repetitive, or large-scale. If it is, Art. 49 derogations are generally unavailable.
3. **Identify the transfer**: Document the specific transfer (parties, data, purpose, destination).
4. **Determine the applicable derogation**: Apply the decision tree to identify which Art. 49 sub-paragraph may apply.

## Derogation-Specific Assessment Workflows

### Art. 49(1)(a) — Explicit Consent Workflow

1. **Draft the consent information notice**:
   - Identify the destination country and confirm no adequacy decision exists
   - Describe the absence of appropriate safeguards for this transfer
   - Explain the specific risks (e.g., government access without EU-level protections)
   - Use clear, plain language accessible to the data subject
2. **Design the consent mechanism**:
   - Separate consent form or clearly distinguished section within a broader form
   - Affirmative action required (signature, checkbox, electronic confirmation)
   - No pre-ticked boxes or default consent
   - Record consent with timestamp, version of information provided, and method
3. **Obtain consent**:
   - Present the information notice to the data subject
   - Allow reasonable time for consideration
   - Provide an alternative that does not require the transfer (if applicable)
   - Record the consent
4. **Verify voluntariness**:
   - Confirm no detriment to the data subject for refusing consent
   - Confirm no power imbalance that vitiates free choice (especially in employment contexts)
5. **Document**:
   - Information provided to the data subject
   - Consent record (timestamp, method, version)
   - Assessment of voluntariness
   - Withdrawal mechanism in place

### Art. 49(1)(b) — Contract Necessity Workflow

1. **Identify the contract**: Document the contract between the data subject and the controller (not a contract with a third party or an employer contract transferring employee data).
2. **Identify the contractual obligation**: Specify which contractual obligation requires the transfer.
3. **Assess necessity**: Document why the transfer is objectively necessary to perform the contract:
   - Would the contract be impossible to perform without the transfer?
   - Are there alternative means of performing the contract without transferring data to the third country?
   - Is the connection between the transfer and the contractual obligation close and substantial?
4. **Assess occasional nature**: Confirm the transfers are occasional (linked to specific contract performance events, not continuous operational data flows).
5. **Data minimisation**: Confirm only the data necessary for the specific contractual obligation is transferred.
6. **Document**: Contract reference, specific obligation, necessity analysis, data minimisation assessment.

### Art. 49(1)(c) — Contract in Interest of Data Subject Workflow

1. **Identify the contract**: Document the contract between the controller and the third party.
2. **Demonstrate the data subject's interest**: Document how the contract serves the data subject's interests (not merely the controller's commercial interests).
3. **Assess necessity**: Same analysis as Art. 49(1)(b) applied to this contract.
4. **Document**: Contract reference, demonstration of data subject interest, necessity analysis.

### Art. 49(1)(d) — Public Interest Workflow

1. **Identify the public interest**: Specify the public interest relied upon.
2. **Legal basis**: Identify the EU or Member State law that recognises this public interest.
3. **Assess importance**: Document why this public interest is "important" (significant, not trivial).
4. **Assess necessity**: Document why the transfer is necessary to serve this public interest.
5. **Confirm public nature**: Verify this is a genuine public interest, not a private commercial interest being dressed up as public.
6. **Document**: Public interest, legal basis, importance assessment, necessity analysis.

### Art. 49(1)(e) — Legal Claims Workflow

1. **Identify the proceedings**: Document the actual or contemplated legal proceedings.
2. **Specificity**: Confirm the proceedings are concrete and identifiable (not theoretical or speculative).
3. **Assess necessity**: Document why the specific data transfer is necessary for the establishment, exercise, or defence of the claim.
4. **Data minimisation**: Confirm only data relevant to the legal claim is transferred.
5. **Occasional nature**: Confirm the transfer is linked to specific proceedings, not routine.
6. **Document**: Proceedings reference, necessity analysis, data scope, data minimisation.

### Art. 49(1) Second Subparagraph — Compelling Legitimate Interests Workflow

1. **Confirm last resort**: Document that no other Art. 49 derogation applies and no Art. 45/46 mechanism is available.
2. **Not repetitive**: Confirm the transfer is one-time or very occasional.
3. **Limited data subjects**: Document the number of data subjects affected (must be small).
4. **Identify compelling legitimate interest**: Articulate the interest and why it is "compelling" (higher bar than ordinary legitimate interest).
5. **Conduct balancing test**: Weigh the controller's compelling interest against the data subjects' rights and freedoms, considering:
   - Nature and sensitivity of the data
   - Impact of the transfer on the data subjects
   - Safeguards applied
   - Reasonable expectations of the data subjects
6. **Provide suitable safeguards**: Identify and implement suitable safeguards.
7. **Notify the SA**: Inform the competent supervisory authority of the transfer before it takes place.
8. **Inform the data subject**: Provide the data subject with information about the transfer and the compelling legitimate interests.
9. **Record in Art. 30 register**: Include the assessment in the records of processing activities.
10. **Document**: All of the above with full justification.

## Post-Transfer Documentation and Review

1. Record the transfer in the Art. 49 derogation register with: derogation relied upon, date, parties, data transferred, justification, and any safeguards applied.
2. If the transfer needs to be repeated, reassess whether it remains occasional or has become systematic (in which case, Art. 46 safeguards must be established).
3. For consent-based transfers, monitor for consent withdrawal and cease transfers if consent is withdrawn.
4. Retain documentation for the duration of data retention plus the limitation period for enforcement actions (typically 5 years).