What GDPR lawful basis (Article 6) and transfer mechanism do I use to move personal data from the EU to the US for litigation review?

Moving personal data of EU residents to the United States for litigation review raises two distinct GDPR questions that must both be satisfied: (1) what lawful basis under Article 6 permits the processing, and (2) what transfer mechanism under Chapter V legitimizes sending the data outside the EEA. These are separate requirements — having one does not satisfy the other. This is general guidance, not legal advice; rules differ by jurisdiction and the analysis is fact-specific.

Choosing an Article 6 lawful basis

For e-discovery, organizations most often rely on legitimate interests (Article 6(1)(f)) — the controller’s interest in establishing, exercising, or defending legal claims — provided that interest is not overridden by the data subjects’ rights. This requires a documented balancing test (a legitimate interests assessment).

A legal obligation (Article 6(1)(c)) generally refers to obligations under EU or member-state law, so a US court order alone usually does not qualify. Consent is rarely workable in litigation because it must be freely given and revocable, which is impractical for opposing parties or employees under pressure.

Choosing a transfer mechanism

Because the US is not covered by a blanket adequacy decision, you need a Chapter V mechanism:

• EU-US Data Privacy Framework — viable only if the US recipient is certified under the current framework.
• Standard Contractual Clauses (SCCs) — the most common route, paired with a transfer impact assessment and supplementary measures where needed.
• Article 49 derogations — for occasional transfers, the “necessary for the establishment, exercise or defence of legal claims” derogation may apply, but regulators treat it narrowly and not as a default for bulk transfers.

Practical safeguards

• Apply data minimization: filter, de-duplicate, and limit to data relevant to the matter before transfer.
• Use pseudonymization, redaction, and protective orders to reduce exposure.
• Document your analysis and tensions between EU privacy law and US discovery obligations — courts and regulators expect a defensible, proportionate approach. The Sedona Conference offers widely cited frameworks for reconciling these conflicts, and the NIST Privacy Framework helps structure your risk controls.

For broader context on discovery obligations and defensible process, see /topics/ediscovery/. Because requirements vary across EU member states, US federal and state courts, and other countries, confirm specifics with qualified counsel and your data protection officer.