Skip to main content
Privacy Track
Category: Data Transfers

Explicit Consent to Transfer

Also known as: Explicit consent for international data transfers, Consent-based transfer derogation
Simply put

Explicit consent to transfer is when an individual clearly and expressly agrees, in words, to have their personal data sent to a recipient outside the protected area (such as a country without an adequacy decision). It is one of several possible grounds that may permit such a transfer, rather than a routine or default mechanism. Because it requires a clear affirmative statement and carries particular risks, it is generally treated as a last-resort option subject to careful assessment.

Formal definition

Explicit consent to transfer refers to a transfer derogation under which a transfer, or set of transfers, of personal data to a third country or international organisation may be made where the data subject has given explicit consent to the proposed transfer. Explicit consent must be expressly confirmed in words (the organisation may draft the consent statement, but the individual must actively confirm it) and must otherwise meet the general standard for valid consent, namely that it be freely given, specific, informed and unambiguous. Practitioners should note the following limitations: the 'explicit' qualifier is applied by GDPR in contexts where heightened data protection risks may arise, and, per the evidence, the precise contours of the 'explicit' nature are not exhaustively defined in the Regulation text and have been interpreted by comparison with other provisions and guidance. This derogation is one of several possible bases for transfer (for example, a transfer may alternatively be necessary for the performance of a contract) and is generally regarded by regulators as an exception to be relied upon where transfer tools such as adequacy decisions or appropriate safeguards are not in place; its availability and conditions are subject to regulator guidance that may evolve, and readers should verify the specific derogation conditions and any applicable article references against the current official GDPR and UK GDPR text and supervisory authority guidance.

Why it matters

Explicit consent to transfer occupies a narrow but important space in the framework governing international data transfers. Where a transfer tool such as an adequacy decision or appropriate safeguards is not in place, organisations may look for an alternative ground on which to move personal data to a third country or international organisation. Explicit consent is one such ground, but it is generally regarded by regulators as a derogation, an exception relied upon in the absence of the primary transfer mechanisms, rather than a routine or default basis. Treating it as a fallback rather than a first choice matters because misclassifying a transfer as consent-based can leave an organisation exposed if the consent later proves invalid.

The stakes are heightened by the fact that the GDPR requires consent to be 'explicit' precisely in situations where particular data protection risks may emerge. This raises the bar above ordinary consent: the individual must expressly confirm agreement in words, and the consent must also meet the general standard of being freely given, specific, informed and unambiguous. If any of these elements is absent, for example, if the individual was not adequately informed of the risks of transfer to a country lacking an adequacy decision, or if consent was bundled or not genuinely voluntary, the ground may fall away, and with it the lawfulness of the transfer.

It is also important to recognise the limits of what can be stated with certainty. The precise contours of the 'explicit' qualifier are not exhaustively defined in the Regulation text and have been interpreted by comparison with other provisions and with supervisory guidance. Because adequacy decisions, transfer tools, and regulator guidance evolve, and because member state and UK GDPR positions can diverge, practitioners should verify the specific derogation conditions and any applicable article references against the current official GDPR and UK GDPR text and supervisory authority guidance before relying on this ground.

Who it's relevant to

Data Protection Officers and privacy leads
DPOs and privacy teams need to determine whether a proposed international transfer can and should rely on explicit consent, or whether a primary transfer tool such as an adequacy decision or appropriate safeguards is more appropriate. Because consent is generally treated as a last-resort derogation, they should document why other mechanisms were unavailable and assess whether the heightened 'explicit' standard can realistically be met and maintained.
Legal and compliance counsel
Counsel advising on cross-border data flows must distinguish this derogation from other transfer grounds and from other legal bases for processing, and should verify the specific conditions and any article references against the current GDPR and UK GDPR text and supervisory guidance. They should also flag the recognised uncertainty in how the 'explicit' qualifier is interpreted, since its contours are not exhaustively defined in the Regulation.
Engineers and product teams building consent flows
Teams implementing consent mechanisms must ensure the individual actively and expressly confirms the transfer in words, avoiding pre-ticked boxes, bundling, or inferred agreement. They should build flows that present the transfer-specific information needed for consent to be informed and specific, and that allow the design to adapt as regulator guidance and transfer mechanisms evolve.
Organisations transferring data to third countries
Controllers and processors moving personal data to a country without an adequacy decision should understand that consent-based transfer is an exception rather than a default, carries particular risks, and depends on continually valid consent. They should assess whether reliance on this ground is sustainable for the transfer or set of transfers in question, and confirm conditions against current official sources.

Inside Explicit Consent to Transfer

Derogation for specific situations
Explicit consent to transfer is one of the derogations that may permit a transfer of personal data to a third country in the absence of an adequacy decision or appropriate safeguards. It is set out among the derogations in Article 49 GDPR and is generally treated by regulators as an exception to be relied upon narrowly rather than as a routine transfer tool.
Explicit standard of consent
The consent must meet the general conditions for valid consent (freely given, specific, informed, and unambiguous) and additionally be explicit, which typically means expressed through a clear affirmative statement rather than inferred from conduct or pre-ticked boxes. The precise form of an explicit statement can vary and should be assessed against current regulatory guidance.
Information about specific risks
Before consenting, the data subject should be informed of the possible risks of the transfer arising from the absence of an adequacy decision and appropriate safeguards. This information requirement is a distinguishing feature of consent used as a transfer derogation, separate from the general transparency obligations around consent.
Withdrawability
As with other consent, the data subject should generally be able to withdraw consent, and withdrawal should be as easy as giving it. Practitioners should consider what happens to data already transferred, as withdrawal does not automatically undo a completed transfer.
Relationship to legal bases and additional conditions
Consent as a transfer derogation is a distinct question from the Article 6 legal basis for the underlying processing and, where special category data is involved, from any additional Article 9 condition required. Consent to transfer does not by itself supply a processing legal basis.

Common questions

Answers to the questions practitioners most commonly ask about Explicit Consent to Transfer.

Is explicit consent the standard or preferred way to transfer personal data outside the EEA?
Generally, no. Explicit consent to a transfer is treated as a derogation rather than a primary transfer tool. In most cases, transfers are expected to rely on an adequacy decision or an appropriate safeguard (such as Standard Contractual Clauses or Binding Corporate Rules). Guidance from the European Data Protection Board has typically indicated that derogations, including consent, should be interpreted restrictively and used for occasional and non-repetitive transfers rather than as a routine mechanism. You should verify the current position against the official text and prevailing regulatory guidance.
Does having explicit consent for a transfer mean the data subject has also provided a lawful basis under Article 6 for the underlying processing?
Not necessarily. Explicit consent relied upon to legitimise a cross-border transfer is a distinct question from the legal basis for the processing itself. The transfer derogation and the processing legal basis are separate requirements that both generally need to be satisfied. Relying on consent for the transfer does not automatically establish consent, or any other basis, as the ground for the processing operations, and special category data may require an additional condition. These points should be assessed separately.
What information should typically be given to a data subject before relying on explicit consent for a transfer?
In most cases, the data subject should be informed, before consenting, of the specific transfer and of the possible risks arising from the absence of an adequacy decision and appropriate safeguards. The consent should generally be specific to the particular transfer or set of transfers. Practitioners often document the recipient country context and the nature of the risks disclosed. The precise informational content should be assessed against the current regulatory guidance and the facts of the transfer.
How do you make explicit consent to a transfer valid and demonstrable?
Explicit consent generally needs to meet the qualities of valid consent, meaning it is freely given, specific, informed, and unambiguous, and expressed through a clear affirmative statement or action appropriate to an explicit standard. Organisations typically maintain records showing what was disclosed, how consent was captured, and when, to support accountability. Because consent can be withdrawn, implementation should account for what happens to the transfer if consent is later withdrawn. The adequacy of any particular consent mechanism is context dependent.
Is explicit consent appropriate for large-scale or ongoing transfers?
Typically it is not well suited to that scenario. Because transfer derogations are generally interpreted restrictively and consent is often associated with occasional and non-repetitive transfers, systematic or high-volume ongoing transfers are usually structured around an adequacy decision or an appropriate safeguard instead. Where transfers are repetitive or structural, you should assess whether a transfer tool such as Standard Contractual Clauses or Binding Corporate Rules, potentially with supplementary measures, is more appropriate, and verify the current requirements.
What happens if a data subject withdraws consent to a transfer that has already occurred?
Withdrawal of consent is generally intended to be as easy to exercise as giving it, and it typically stops further reliance on that consent going forward. Withdrawal does not, as a general matter, retroactively affect the lawfulness of a transfer already carried out while consent was in place, but it does mean the transfer can no longer continue to rely on that consent. Organisations should plan operationally for cessation of onward transfers and for how data already sent to the recipient will be handled. The specific consequences should be assessed case by case.

Common misconceptions

Explicit consent to transfer is the default or easiest way to send data outside the EEA.
It is generally treated as a derogation to be used narrowly, typically for occasional and non-repetitive transfers, and regulators have indicated it is not intended as a routine mechanism where adequacy decisions or appropriate safeguards such as Standard Contractual Clauses or Binding Corporate Rules could be used. Reliance on it should be assessed case by case.
Consent to transfer also satisfies the legal basis for processing the personal data.
Consent to a transfer under the Article 49 derogations is a separate question from the Article 6 legal basis for the processing itself, and for special category data from any additional Article 9 condition. These must be addressed independently.
Once consent is given, the transfer is permanently authorized and consent cannot be undone.
Consent must generally be withdrawable and should be as easy to withdraw as to give. However, withdrawal does not automatically reverse a transfer already made, so practitioners should plan for the practical consequences of withdrawal.

Best practices

First assess whether an adequacy decision or appropriate safeguards (such as Standard Contractual Clauses or Binding Corporate Rules) are available, and treat explicit consent as a fallback for occasional, non-repetitive transfers rather than a default mechanism.
Provide the data subject with clear information about the specific risks of the transfer arising from the absence of an adequacy decision and appropriate safeguards, and retain evidence that this information was given.
Ensure the consent is explicit through a clear affirmative statement, and keep records demonstrating that it was freely given, specific, informed, and unambiguous.
Separately identify and document the Article 6 legal basis for the underlying processing and any additional Article 9 condition for special category data, rather than relying on transfer consent to cover these.
Implement an accessible mechanism for withdrawing consent and document the process for handling withdrawal, including its effect on future transfers.
Verify the approach against the current official GDPR text and up-to-date regulatory guidance, as the interpretation of derogations and available transfer tools can evolve and may diverge between regulators.