Law note · Lithuania
GDPR Chapter V and VDAI Article 46(3) Authorization, Cross-Border Transfer from Lithuania
Transferring personal data of a person in Lithuania outside the European Economic Area requires a European Commission adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the Article 83(5) top fine tier.
Two independent secondary trackers (DLA Piper, Linklaters) agree that Lithuania adds a national procedural layer: VDAI itself issues the authorization for a transfer based on Article 46(3) ad hoc contractual clauses or administrative arrangements, reported as taking up to 20 working days and, in certain cases, up to 30; not independently confirmed against the Act's own text this pass.
What it asks of an app
- Rely on a European Commission adequacy decision, Standard Contractual Clauses with a transfer impact assessment, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Lithuania outside the European Economic Area.
- Allow for a VDAI authorization step, reported by secondary sources at up to 20 to 30 working days, where a transfer instead relies on Article 46(3) ad hoc contractual clauses or administrative arrangements.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot
Primary source: Official Journal text, EUR-Lex, Regulation (EU) 2016/679
DLA Piper and Linklaters secondary legal trackers for the VDAI authorization procedure, not independently confirmed against primary text