Derogations are for the occasional case
Article 49 derogations — explicit consent, contractual necessity, important public interest — exist for transfers that are occasional and non-repetitive. They are not a standing basis for routine data flows.
Why it is like this
They are the escape hatch for the one-off, so that a missing adequacy decision does not block a hotel booking or a legal claim. Regularity is exactly what the hatch is not for.
Not to be confused with
A simpler alternative to SCCs. The EDPB reads the derogations strictly: a daily transfer of customer records to a parent company is systematic, and needs an Article 46 tool.
In practice
Emailing an itinerary to a hotel abroad: contractual necessity, fine. Replicating your CRM to an overseas datacentre nightly: not a derogation, whatever the consent screen says.
Source: Regulation (EU) 2016/679 (GDPR) — Article 49(1), second subparagraph, and Recital 111. Read on .
Odd one out Check yourself
Three of these describe when an Article 49 derogation can carry a transfer. Which one does not?
Show the answer
The volume of data transferred is small
Volume is not the test — regularity is. A small nightly transfer is systematic; a large one-off transfer for a legal claim may not be.