DATA PROTECTION | EDPB issues Guidelines on article 48 of GDPR and releases reports on AI compliance

With a press release dated 5 June 2025 the European Data Protection Board (EDPB) announced the outcomes from its latest plenary session, including (a) the adoption of Guidelines 02/2024 on Article 48 of GDPR (Guidelines) and (b) the presentation of two new reports form the Support Pool of Experts (SPE) focusing on data protection and artificial intelligence (AI) security.

Under Article 48 of GDPR transfers of personal data in response to a third-country authority’s request must be based on an international agreement in force between the EU and the requesting country. The newly adopted Guidelines clarify how controllers and processors should assess such requests and under what conditions they may lawfully disclose personal data.

In parallel, the EDPB presented two SPE reports: “Law & Compliance in Artificial Intelligence (AI) Security and Data Protection” and “Fundamentals of Secure AI Systems with Personal Data”. Both documents aim to provide instructions on the development and training of AI systems in line with data protection principles. The first report is primarily intended for privacy professionals, while the second targets cybersecurity specialists, developers, and providers of high-risk AI systems.

Newsletter n. 108 – June 2025