When EU data protection law and a foreign government's records request conflict, which law wins for cross-border records?

When EU data protection law (the GDPR) and another government’s records request collide, there is no single “winning” law. Each jurisdiction asserts authority over the same records, and an organization can face penalties for obeying either one. The practical answer is conflict-of-laws analysis, not a hierarchy.

Why There Is No Automatic Winner

The GDPR generally restricts transferring personal data outside the EU and limits disclosure to non-EU authorities unless a recognized legal basis or international agreement applies. At the same time, a foreign government may compel production under its own statutes. Because each sovereign claims jurisdiction, neither law inherently overrides the other. Where data physically resides, where the controller operates, and whose residents are affected all matter.

How These Conflicts Are Resolved in Practice

• Mutual legal assistance treaties (MLATs) and data-sharing agreements. Governments often build channels so a request flows through proper diplomatic and legal pathways rather than a direct, unilateral demand. Routing a request this way frequently resolves the conflict before it becomes one.
• GDPR derogations and legal bases. Disclosure may be permissible where it rests on a valid basis, an international agreement, or a narrow exception. A foreign court order alone is typically not sufficient.
• Challenging or narrowing the request. Producing parties can seek to limit scope, redact, anonymize, or contest a demand in the requesting forum.
• Comity. Courts weigh each nation’s interests, the hardship of compliance, and good-faith efforts, which can shape what must be produced.

What Records Professionals Should Do

• Map where records and personal data are stored and which jurisdictions apply before a request arrives.
• Apply data minimization and retention discipline so you hold less cross-border personal data to begin with.
• Route conflicting demands through legal counsel and privacy officers immediately; do not respond unilaterally.
• Document the legal basis and decision rationale for any disclosure as part of the record.

Treat these situations as governance problems requiring legal, privacy, and records expertise together. For broader context on handling personal data responsibly, see the privacy and PII topic hub.

Sound recordkeeping and a documented privacy program make these conflicts far easier to navigate when they arise.