Home > Services > Challenge Europol Third-Country Data Transfers

Challenge Europol Third-Country Data Transfers

Legal help with Europol transfers of personal data to third countries. We assess Article 25 safeguards, access rights and possible EDPS complaints.

Get Free Consultation

By Dr. Anatoliy Yarovyi — Senior Partner

Updated: 23 Sep 2026

Europol can transfer personal data to competent authorities in third countries and to international organisations, but only under the conditions established by the Europol Regulation. The legal framework is primarily set out in Article 25 of Regulation (EU) 2016/794.

Our lawyers assist individuals who are concerned that personal data processed by Europol has been transferred outside the EU without an appropriate legal basis, adequate safeguards or proper respect for their fundamental rights.

A Europol third-country transfer should not be analysed in the same way as an ordinary commercial data transfer under the GDPR. Europol operates under its own law-enforcement data-processing framework, with specific rules governing international exchanges of personal data.

When Can Europol Transfer Personal Data to a Third Country?

Article 25 allows Europol to transfer personal data to a competent authority of a third country or to an international organisation where the transfer is necessary for Europol to perform its tasks and one of the recognised legal bases applies.

These bases include:

• an adequacy decision concerning the third country, territory, sector or international organisation;
• an international agreement between the European Union and the third country or international organisation providing appropriate safeguards for privacy and fundamental rights; or
• certain cooperation agreements concluded by Europol before 1 May 2017 that permit the exchange of personal data.

The existence of a foreign law-enforcement request alone therefore does not explain the legal basis for every transfer.

The applicable mechanism needs to be identified from the circumstances of the individual case.

Does Europol Always Need an Adequacy Decision?

No.

An adequacy decision is one possible basis for a transfer, but Article 25 provides additional mechanisms.

Where there is no adequacy decision, Europol’s Management Board may authorise transfers where appropriate data-protection safeguards are contained in a legally binding instrument or where Europol has assessed the circumstances and concluded that appropriate safeguards exist.

This means that a transfer should not be described as unlawful simply because the destination country lacks an adequacy decision.

The real question is which Article 25 basis was relied upon and whether its conditions were satisfied.

Are Exceptional Transfers Also Possible?

Yes.

Article 25 also permits specific derogations in duly justified cases.

The Executive Director may authorise a transfer, or a category of transfers, on a case-by-case basis where the statutory conditions are met. These include circumstances involving:

• protection of the vital interests of the data subject or another person;
• safeguarding legitimate interests of the data subject;
• prevention of an immediate and serious threat to public security;
• prevention, investigation, detection or prosecution of criminal offences; or
• establishment, exercise or defence of legal claims connected with a specific criminal matter.

For some of these grounds, the Regulation also requires consideration of whether the fundamental rights and freedoms of the person concerned outweigh the public interest in the transfer. The derogations are not intended to justify systematic, massive or structural transfers.

What General Safeguards Apply to Europol Transfers?

The Europol Regulation contains safeguards that apply beyond the identification of a formal Article 25 legal basis.

Personal data may only be transferred where this is necessary for preventing and combating crime within Europol’s objectives. The recipient must undertake to process the data only for the purpose for which it was transferred.

The Regulation also provides that:

• restrictions attached to information by the provider must be respected;
• onward transfer is prohibited unless Europol gives prior explicit authorisation;
• detailed records of transfers and their grounds must be kept; and
• information clearly obtained through an obvious violation of human rights must not be processed.

These safeguards can be relevant when assessing whether the processing of an individual’s data remains lawful.

How Can You Find Out Whether Your Data Was Transferred?

An individual cannot directly search Europol’s internal systems.

However, Article 36 provides a right to ask whether Europol processes personal data concerning you and, subject to lawful restrictions, to obtain information about that processing.

The information available can include the purposes of processing, categories of data and the recipients or categories of recipients to whom the data has been disclosed.

This can be an important first step where there is reason to believe that Europol information may have been shared with authorities outside the EU.

Our Europol data access request lawyers can assist with the Article 36 procedure.

Can Europol Refuse to Disclose Details of a Transfer?

Yes.

Article 36 access rights are subject to restrictions.

Europol may restrict information where this is necessary to allow it to perform its tasks, protect security or public order, prevent crime, protect an investigation or safeguard the rights and freedoms of other persons.

In some circumstances, Europol may confirm only that the required checks have been carried out without revealing whether particular personal data is processed.

For that reason, an access request does not guarantee disclosure of every recipient, operational detail or international exchange involving the individual.

When Could a Third-Country Transfer Raise Legal Concerns?

A transfer may require closer legal review where there is reason to question:

• whether Article 25 provided a valid legal basis;
• whether the transfer was necessary for Europol’s tasks;
• whether applicable restrictions imposed by the data provider were respected;
• whether adequate safeguards existed;
• whether the data itself was accurate and lawfully processed;
• whether the recipient used the data for the permitted purpose;
• whether an onward transfer occurred without appropriate authorisation; or
• whether fundamental-rights considerations were properly taken into account.

The appropriate argument depends on how the data entered Europol’s systems, who received it and the legal mechanism relied upon for the transfer.

A challenge should therefore be based on the actual processing history rather than a generic claim that all transfers outside the EU are unlawful.

Is This the Same as Challenging a GDPR International Transfer?

No.

This distinction is important.

Ordinary businesses may use mechanisms such as Standard Contractual Clauses or Binding Corporate Rules under the GDPR when transferring personal data internationally.

Europol, however, is an EU law-enforcement agency. Transfers by Europol to third-country competent authorities and international organisations are governed specifically by the Europol Regulation, including Article 25.

For this reason, a legal assessment based only on GDPR Chapter V or commercial SCC practice may identify the wrong legal framework.

The question is not simply whether a company has executed an appropriate transfer contract. It is whether Europol’s own statutory conditions for law-enforcement data transfers have been satisfied.

What Can You Do If You Believe a Transfer Was Unlawful?

The correct procedure depends on the information available.

A person may first need to exercise Article 36 access rights to understand what Europol is processing.

If the data itself is inaccurate, outdated or no longer lawfully processed, separate rights concerning rectification, erasure or restriction may become relevant under Article 37.

Where a person considers that Europol’s processing of their personal data does not comply with the applicable legal framework, Article 47 provides a right to lodge a complaint with the European Data Protection Supervisor.

The appropriate route therefore depends on whether the problem concerns:

• lack of information about the transfer;
• the legality of the processing;
• accuracy or continued retention of the data; or
• Europol’s response to an earlier request.

What Is the Role of the European Data Protection Supervisor?

The European Data Protection Supervisor supervises Europol’s compliance with applicable data-protection requirements.

Article 47 provides a data subject with the right to complain to the EDPS where they believe Europol’s processing of their personal data breaches the Europol Regulation or Regulation (EU) 2018/1725.

Where a complaint concerns decisions relating to access, rectification or erasure, the EDPS may also consult the relevant national supervisory authority.

Where an EDPS remedy becomes appropriate, our Europol EDPS complaint lawyers can assist with preparing and presenting the complaint.

How Can Our Lawyers Help With a Europol Third-Country Transfer?

A third-country transfer case often requires reconstructing how the personal data was collected, processed and shared.

Depending on the circumstances, our work may include:

• analysing whether Article 25 applies;
• identifying the possible legal basis for the transfer;
• preparing an Article 36 access request;
• examining disclosed recipient or transfer information;
• assessing restrictions attached to the original data;
• reviewing whether the processing remains necessary and lawful;
• identifying possible rectification or erasure issues; and
• preparing an EDPS complaint where there are grounds to challenge Europol’s processing.

The strategy depends on the facts and on what information can lawfully be obtained through the applicable data-protection procedures.

Legal Help With Europol Third-Country Data Transfers

If you believe Europol has transferred personal data concerning you to authorities outside the EU or to an international organisation, the first step is to identify what data is being processed and the legal basis for the transfer.

Our team can assess the applicable Article 25 framework, help obtain available information about the processing and determine whether further action should be taken through Europol or the EDPS.

Contact us for a confidential assessment of your case.