1.
In the absence of an adequacy decision pursuant to Article 36, or of appropriate safeguards pursuant to Article 37, Member States shall provide that a transfer or a category of transfers of personal data to a third country or an international organisation may take place only on the condition that the transfer is necessary: in order to protect the vital interests of the data subject or another person; to safeguard legitimate interests of the data subject, where the law of the Member State transferring the personal data so provides; for the prevention of an immediate and serious threat to public security of a Member State or a third country; in individual cases for the purposes set out in Article 1(1); or in an individual case for the establishment, exercise or defence of legal claims relating to the purposes set out in Article 1(1).
← Article 38 · All articles · art_38__para_1__text_1 →
Source: EUR-Lex (Cellar) · retrieved 2026-09-25 · Text as adopted (Official Journal); later amendments are not incorporated in this text.