# Regulatory Standards — Managing Consent for Transfers

## Primary Regulations

### GDPR — Regulation (EU) 2016/679

- **Article 44**: "Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if the conditions laid down in this Chapter are complied with."
- **Article 49(1)(a)**: Transfer may take place if "the data subject has explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards."
- **Article 49(1) second paragraph**: "In the absence of an adequacy decision... a transfer... may take place only if the transfer is not repetitive, concerns only a limited number of data subjects, is necessary for the purposes of compelling legitimate interests... and the controller has assessed all the circumstances surrounding the data transfer and has on the basis of that assessment provided suitable safeguards."

### Indian Digital Personal Data Protection Act 2023 (DPDP Act)

India's comprehensive data protection law:
- **Section 16**: Government may restrict transfer to specified countries by notification
- **Section 17**: Obligations on significant data fiduciaries (mirroring some GDPR controller obligations)
- As of 2026, implementing rules are still being finalized, creating uncertainty about the adequacy of protection

## Case Law

### CJEU C-311/18 — Schrems II (July 16, 2020)

The Court invalidated the EU-US Privacy Shield and established that:
- Transfer mechanisms must be assessed in light of the third country's legal framework
- Government surveillance laws in the destination country are relevant to the risk assessment
- Data subjects must be informed of these risks when consent is the transfer basis

## Supervisory Authority Guidance

### EDPB Guidelines 2/2018 on Derogations under Article 49

- **Paragraph 3**: Derogations must be interpreted restrictively so that the exception does not become the rule.
- **Paragraph 5**: Explicit consent for transfers requires that the data subject is specifically informed about the risks of the specific transfer.
- **Paragraph 6**: The information must cover: destination country, recipient identity, purpose, data categories, absence of adequacy decision, absence of appropriate safeguards, and specific risks.
- **Paragraph 7**: Consent for transfers should not be relied upon for systematic or repetitive transfers.

### EDPB Recommendations 01/2020 on Supplementary Measures

Post-Schrems II recommendations that affect consent-based transfers:
- Even where consent is the basis, controllers should consider whether supplementary measures (encryption, pseudonymization) can reduce risks
- The risk assessment methodology applies equally to consent-based transfers