Notification to the HDPA of data transfers to a country outside the EU based on derogations

To notify the HDPA of data transfers to a country outside the EU based on derogations under the last subparagraph of Article 49(1) GDPR, the entity intending to transfer data outside the EU (data exporter) must fill in a special form and submit it electronically through the HDPA online portal.

The above electronic submission of the notification to the HDPA consists, in short, of the following steps:

  1. The exporter must log in to the HDPA online portal under the option “Body”, using the credentials he/she has for taxisnet.
  2. Fill in the required fields of the electronic form “Request (for other uses)”.
  3. Fill in the category of request in the above electronic form by selecting the option “6. Notification to the HDPA of data transfers to a country outside the EU based on derogations (Art. 49(1)(last subparagraph).
  4. Attach one or more separate files to the above electronic form (preferably in word format) in connection with the following:
    1. a description of the subject of the notification to the HDPA of a transfer based on derogations;
    2. a description of the means and content of the information to the data subjects about the transfer and the compelling legitimate interests pursued; and
    3. any other documents directly related to this issue.

    Please note that in accordance with Article 49(6) GDPR, the assessment of all the circumstances related to the transfer under the first subparagraph of Article 49(1), as well as the appropriate guarantees referred to in the second subparagraph of Article 49(1), shall be recorded in the activity records referred to in Article 30 and made available to the HDPA upon request.

  5. Submit the electronic form with all required attachments.

 

Exceptionally notify the HDPA by e-mail of data transfers to a country outside the EU based on derogations

In case that, for any substantiated reason, you cannot log in to the HDPA online portal, you can notify the HDPA of the above issue by e-mail. Please note, however, that you can only use this way as an exception, i.e. an alternative to notifying the HDPA.

In this case, follow the steps outlined below:

  1. Fill in all required fields in the following controller/processor/body request form.

Controller/processor/body application form (docx / pdf).

 

  1. Fill in the category of request in the above electronic form by selecting the option “6. Notification to the HDPA of data transfers to a country outside the EU based on derogations (Art. 49(1)(last subparagraph).”
  2. Send an e-mail to contact@dpa.gr with subject “Notification to the HDPA of data transfers to a country outside the EU based on derogations”, attaching the following:
    1. The above form filled in.
    2. One or more separate files (preferably in word format) in connection with the following:
      1. a description of the subject of the notification to the HDPA of a transfer based on derogations;
      2. a description of the means and content of the information to the data subjects about the transfer and the compelling legitimate interests pursued; and
      3. any other documents directly related to this issue.

      Please note that in accordance with Article 49(6) GDPR, the assessment of all the circumstances related to the transfer under the first subparagraph of Article 49(1), as well as the appropriate guarantees referred to in the second subparagraph of Article 49(1), shall be recorded in the activity records referred to in Article 30 and made available to the HDPA upon request.

    3. An outline of the reasons that have led you to submit the above notification in this way rather than through the HDPA online portal.