Article 48 GDPR and the US Discovery Request: A Practical Minimisation Playbook

A US litigation hold lands on a European entity, and two reflexes follow. The first is to produce everything responsive, on the theory that a court order is a court order. The second is to refuse outright, on the theory that the GDPR forbids it. Both reflexes are wrong, and both are expensive.

The GDPR does not prohibit transferring personal data into a US proceeding. It conditions that transfer, and the conditions reward parties who narrow the population before it crosses the Atlantic rather than after.

This post covers what Article 48 actually does, which derogation a litigant will realistically rely on, why minimisation is the operative work rather than a formality, and how to document it in a form that a US court and a European supervisory authority will both accept. The short version is that the volume you transfer is the variable you control, and it is the one both audiences are looking at.

Article 48 limits recognition, it does not create a prohibition

Article 48 says that a judgment of a third country court, or a decision of a third country administrative authority, requiring a controller to transfer or disclose personal data may only be recognised or enforceable if it is based on an international agreement such as a mutual legal assistance treaty.

Read that carefully. It is a rule about the standing of the foreign order inside the Union legal order. It is not a rule that the data may never move. The provision operates without prejudice to the other grounds for transfer in Chapter V.

The European Data Protection Board made this explicit in its Guidelines 02/2024 on Article 48, finalised in June 2025. A foreign order is not itself a transfer tool. If you intend to transfer, you still need a lawful basis under Article 6 and a separate transfer mechanism under Chapter V. The order supplies neither. The Board also expects the request and your reasoning to be documented, whether you grant it or refuse it.

The practical consequence is that "a US court ordered us" is not an answer to a European regulator, and "the GDPR forbids it" is not an answer to a US magistrate judge. You need a positive case, built by you.

The derogation you will rely on is narrower than the request

Most litigants land on Article 49(1)(e): transfer necessary for the establishment, exercise or defence of legal claims. Recital 111 confirms this reaches pre-trial discovery in civil proceedings.

Two constraints come attached. The transfer must be occasional, and it must be necessary. The Board reads the Article 49 derogations narrowly, as exceptions rather than as a routine substitute for an adequacy decision or standard contractual clauses.

Necessity is where most productions fail. It requires a close and substantial connection between the specific data and the specific claim or defence. A request framed around custodians and date ranges does not establish that connection for every document inside it. Responsiveness to a US discovery request and necessity under Article 49(1)(e) are different tests, and the second is stricter.

That gap is not a problem to be argued away. It is a scoping instruction.

Minimisation is the work, and it happens before the transfer

If necessity is assessed document by document, then the defensible production is the one where somebody actually assessed the documents. Three operations do the work, in order.

Culling removes what is outside the matter. Not outside the search terms, outside the matter. A custodian mailbox contains payroll, medical absence, family correspondence and works council material that no responsiveness criterion should ever reach.

Pseudonymisation and redaction handle what remains. Names of uninvolved third parties, national identifiers, health data and other special category material under Article 9 can frequently be removed without touching the evidentiary value of the document. A contract negotiation thread does not become less probative because an unrelated employee home address is masked.

Review is what tells you which is which. This is the point where an AI-assisted first pass earns its place, because the alternative is a linear human read of a population you have not yet justified transferring. Running an issue-by-issue read across the full set, including a dedicated pass for personal and special category data, produces the responsiveness call and the minimisation record from the same operation. Claira runs this inside Nuix Discover, and the PII identification workflow is documented for exactly this purpose.

The framing matters. AI review here is the minimisation engine. It is what lets you transfer less, not what puts more at risk.

The Sedona principles ask you to show your work

The Sedona Conference International Principles on Discovery, Disclosure and Data Protection give US courts a vocabulary for this. Principle 1 asks courts and parties to give due respect to foreign data protection law. Principle 2 says that where compliance with both regimes conflicts, conduct should be judged under a standard of good faith and reasonableness. Principle 3 is the one to plan around: a controller facing preservation, disclosure or discovery obligations should be prepared to demonstrate that data protection obligations were addressed and that appropriate safeguards were instituted.

Be prepared to demonstrate is an evidentiary standard, not a sentiment. Courts running the comity analysis that Aérospatiale left them have generally been unimpressed by an unsupported assertion that European law makes production impossible. They have been considerably more receptive to a party that arrives with a narrowed population, a stated method, and a reason why the narrowing was principled.

Good faith is easier to prove with a log than with a letter.

Where the review happens changes what you have to justify

There is a step before the transfer question that is often skipped. Review is processing, and processing is not the same event as transfer. If the analysis, culling and redaction occur on infrastructure inside the Union, the only thing that leaves the Union is the minimised production.

That changes the size of what you must defend. We have written before about in-country deployment for German and European matters, and the reason it matters here is precisely this sequencing. Minimise in region, then transfer the remainder.

Doing the reverse, exporting the full collection to a US platform and filtering it there, means the transfer you have to justify under Chapter V is the entire population rather than the part you actually needed.

Where to start

Three things, in order.

Write a one-page transfer note before any data moves. State the claim, the categories of data involved, the derogation relied on, and the minimisation steps applied. If you cannot complete that page, you are not ready to produce.

Run the minimisation pass as a distinct step with its own record, rather than as a by-product of responsiveness review. The two tests are different, and the record should show both were applied.

Raise scope with opposing counsel early. A negotiated protocol that reflects European constraints is far cheaper than a motion to compel decided after you have already refused.

None of this makes the conflict disappear. It converts it into something you can document, which is the only form in which either regulator or court can give you credit for it. If you want to see how a minimisation pass runs across a European collection before anything crosses a border, book a short session with our team.