Regulation (EU) 2016/679 of the European Parliament and of the CouncilShow full title

CHAPTER V U.K. Transfers of personal data to third countries or international organisations

F1 Article 44 U.K. General principle for transfers

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Textual Amendments

F1 Art. 44 omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 7 para. 2(1); S.I. 2026/82, reg. 2(z9)

[F2 Article 44A U.K. General principles for transfers

1. A controller or processor may transfer personal data to a third country or an international organisation only if—

(a) the condition in paragraph 2 is met, and

(b) the transfer is carried out in compliance with the other provisions of this Regulation.

2. The condition is met if the transfer—

(a) is approved by regulations under Article 45A that are in force at the time of the transfer,

(b) is made subject to appropriate safeguards (see Article 46), or

(c) is made in reliance on a derogation for specific situations (see Article 49).

3. A transfer may not be made in reliance on paragraph 2(b) or (c) if, or to the extent that, it would breach a restriction in regulations under Article 49A.]

Textual Amendments

F2 Art. 44A inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 7 para. 2(2); S.I. 2026/82, reg. 2(z9)

F3 Article 45 U.K. Transfers on the basis of an adequacy decision

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Textual Amendments

F3 Art. 45 omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 7 para. 3; S.I. 2026/82, reg. 2(z9)

[F4 Article 45A U.K. Transfers approved by regulations

1. For the purposes of Article 44A, the Secretary of State may by regulations approve transfers of personal data to—

(a) a third country, or

(b) an international organisation.

2. The Secretary of State may only make regulations under this Article approving transfers to a third country or international organisation if the Secretary of State considers that the data protection test is met in relation to the transfers (see Article 45B).

3. In making regulations under this Article, the Secretary of State may have regard to any matter which the Secretary of State considers relevant, including the desirability of facilitating transfers of personal data to and from the United Kingdom.

4. Regulations under this Article may, among other things—

(a) make provision in relation to a third country or international organisation specified in the regulations or a description of country or organisation;

(b) approve all transfers of personal data to a third country or international organisation or only transfers specified or described in the regulations;

(c) identify a transfer of personal data by any means, including by reference to—

(i) a sector or geographic area within a third country,

(ii) the controller or processor,

(iii) the recipient of the personal data,

(iv) the personal data transferred,

(v) the means by which the transfer is made, or

(vi) relevant legislation, schemes, lists or other arrangements or documents, as they have effect from time to time;

(d) confer a discretion on a person.

5. Regulations under this Article are subject to the negative resolution procedure.

Textual Amendments

F4 Arts. 45A, 45B inserted (19.6.2025 for specified purposes, 5.2.2026 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), s. 142(1)(2)(h), Sch. 7 para. 4; S.I. 2026/82, reg. 2(z9)

Article 45B U.K. The data protection test

1. For the purposes of Article 45A, the data protection test is met in relation to transfers of personal data to a third country or international organisation if the standard of the protection provided for data subjects with regard to general processing of personal data in the country or by the organisation is not materially lower than the standard of the protection provided for data subjects by or under—

(a) this Regulation,

(b) Part 2 of the 2018 Act, and

(c) Parts 5 to 7 of that Act, so far as relevant to general processing.

2. In considering whether the data protection test is met in relation to transfers of personal data to a third country or international organisation, the Secretary of State must consider, among other things—

(a) respect for the rule of law and for human rights in the country or by the organisation,

(b) the existence, and powers, of an authority responsible for enforcing the protection of data subjects with regard to the processing of personal data in the country or by the organisation,

(c) arrangements for judicial or non-judicial redress for data subjects in connection with such processing,

(d) rules about the transfer of personal data from the country or by the organisation to other countries or international organisations,

(e) relevant international obligations of the country or organisation, and

(f) the constitution, traditions and culture of the country or organisation.

3. In paragraphs 1 and 2—

(a) the references to the protection provided for data subjects are to that protection taken as a whole,

(b) the references to general processing are to processing to which this Regulation applies or equivalent types of processing in the third country or by the international organisation (as appropriate), and

(c) the references to processing of personal data in the third country or by the international organisation are references only to the processing of personal data transferred to the country or organisation by means of processing to which this Regulation applies as described in Article 3.

4. When the data protection test is applied only to certain transfers to a third country or international organisation that are specified or described, or to be specified or described, in regulations (in accordance with Article 45A(4)(b))—

(a) the references in paragraphs 1 to 3 to personal data are to be read as references only to personal data likely to be the subject of such transfers, and

(b) the reference in paragraph 2(d) to transfer to other countries or international organisations is to be read as including transfer within the third country or international organisation.]

Textual Amendments

F4 Arts. 45A, 45B inserted (19.6.2025 for specified purposes, 5.2.2026 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), s. 142(1)(2)(h), Sch. 7 para. 4; S.I. 2026/82, reg. 2(z9)

[F5 Article 45C U.K. Transfers approved by regulations: monitoring

1. The Secretary of State must, on an ongoing basis, monitor developments in third countries and international organisations that could affect decisions to make regulations under Article 45A or to amend or revoke such regulations.

2. Where the Secretary of State becomes aware that the data protection test is no longer met in relation to transfers approved, or of a description approved, in regulations under Article 45A, the Secretary of State must, to the extent necessary, amend or revoke the regulations.

3. Where regulations under Article 45A are amended or revoked in accordance with paragraph 2, the Secretary of State must enter into consultations with the third country or international organisation concerned with a view to improving the protection provided to data subjects with regard to the processing of personal data in the country or by the organisation.

4. The Secretary of State must publish—

(a) a list of the third countries and international organisations, and the descriptions of such countries and organisations, which are for the time being approved by regulations under Article 45A as places or persons to which personal data may be transferred, and

(b) a list of the third countries and international organisations, and the descriptions of such countries and organisations, which have been but are no longer approved by such regulations.

5. In the case of regulations under Article 45A which approve only certain transfers to a third country or international organisation specified or described in the regulations (in accordance with Article 45A(4)(b)), the lists published under paragraph 4 must specify or describe the relevant transfers.]

Textual Amendments

F5 Art. 45C inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 7 para. 5; S.I. 2026/82, reg. 2(z9)

Article 46 U.K. Transfers subject to appropriate safeguards

F6 1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

[F7 1A. A transfer of personal data to a third country or an international organisation by a controller or processor is made subject to appropriate safeguards only—

(a) in a case in which—

(i) safeguards are provided in connection with the transfer as described in paragraph 2 or 3 or regulations made under Article 47A(4), and

(ii) the controller or processor, acting reasonably and proportionately, considers that the data protection test is met in relation to the transfer or that type of transfer (see paragraph 6), or

(b) in a case in which—

(i) safeguards are provided in accordance with paragraph 2(a) by an instrument that is intended to be relied on in connection with the transfer or that type of transfer, and

(ii) each public body that is a party to the instrument, acting reasonably and proportionately, considers that the data protection test is met in relation to the transfers, or types of transfer, intended to be made in reliance on the instrument (see paragraph 6).]

2. The F8 ... safeguards referred to in [F9 paragraph 1A(a)] may be provided for, without requiring any specific authorisation from [F10 the Commissioner], by:

(a) a legally binding and enforceable instrument between [F11 a public body and another relevant person or persons];

(b) binding corporate rules [F12 approved] in accordance with Article 47;

[F13 (c) standard data protection clauses specified in regulations made by the Secretary of State under [F14 Article 47A(1)] and for the time being in force;]

[F15 (d) standard data protection clauses specified in a document issued (and not withdrawn) by the Commissioner [F16 for the purposes of this Article] under section 119A of the 2018 Act and for the time being in force;]

(e) an approved code of conduct pursuant to Article 40 together with binding and enforceable commitments of the controller or processor in the third country to apply the [F17 safeguards provided by the code], including as regards data subjects' rights; or

(f) an approved certification mechanism pursuant to Article 42 together with binding and enforceable commitments of the controller or processor in the third country to apply the [F18 safeguards provided by the mechanism], including as regards data subjects' rights.

3. [F19 With authorisation from the Commissioner], the F20 ... safeguards referred to in [F21 paragraph 1A(a)] may also be provided for F22 ... by:

(a) contractual clauses between the controller or processor and the controller, processor or the recipient of the personal data in the third country or international organisation; or

(b) provisions to be inserted into administrative arrangements between [F23 a public body and another relevant person or persons] which include enforceable and effective data subject rights.

F24 4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F24 5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

[F25 6. For the purposes of this Article, the data protection test is met in relation to a transfer, or a type of transfer, of personal data if, after the transfer, the standard of the protection provided for the data subject with regard to that personal data by the safeguards required under paragraph 1A, and (where relevant) by other means, would not be materially lower than the standard of the protection provided for the data subject with regard to the personal data by or under—

(a) this Regulation,

(b) Part 2 of the 2018 Act, and

(c) Parts 5 to 7 of that Act, so far as relevant to processing to which this Regulation applies.

7. For the purposes of paragraph 1A(a)(ii) and (b)(ii), what is reasonable and proportionate is to be determined by reference to all the circumstances, or likely circumstances, of the transfer or type of transfer, including the nature and volume of the personal data transferred.

8. In this Article—

(a) references to the protection provided for the data subject are to that protection taken as a whole;

(b) “relevant person” means a public body or another person exercising functions of a public nature.]

Textual Amendments

F6 Art. 46(1) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 7 para. 6(2); S.I. 2026/82, reg. 2(z9)

F7 Art. 46(1A) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 7 para. 6(3); S.I. 2026/82, reg. 2(z9)

F8 Word in Art. 46(2) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 7 para. 6(4)(a)(i); S.I. 2026/82, reg. 2(z9)

F9 Words in Art. 46(2) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 7 para. 6(4)(a)(ii); S.I. 2026/82, reg. 2(z9)

F10 Words in Art. 46(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 39(3)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F11 Words in Art. 46(2)(a) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 7 para. 6(4)(b); S.I. 2026/82, reg. 2(z9)

F12 Word in Art. 46(2)(b) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 7 para. 6(4)(c); S.I. 2026/82, reg. 2(z9)

F13 Art. 46(2)(c) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 39(3)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F14 Words in Art. 46(2)(c) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 7 para. 6(4)(d); S.I. 2026/82, reg. 2(z9)

F15 Art. 46(2)(d) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 39(3)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F16 Words in Art. 46(2)(d) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 7 (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

F17 Words in Art. 46(2)(e) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 7 para. 6(4)(e); S.I. 2026/82, reg. 2(z9)

F18 Words in Art. 46(2)(f) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 7 para. 6(4)(f); S.I. 2026/82, reg. 2(z9)

F19 Words in Art. 46(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 39(4) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F20 Word in Art. 46(3) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 7 para. 6(5)(a); S.I. 2026/82, reg. 2(z9)

F21 Words in Art. 46(3) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 7 para. 6(5)(b); S.I. 2026/82, reg. 2(z9)

F22 Words in Art. 46(3) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 7 para. 6(5)(c); S.I. 2026/82, reg. 2(z9)

F23 Words in Art. 46(3)(b) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 7 para. 6(5)(d); S.I. 2026/82, reg. 2(z9)

F24 Art. 46(4)(5) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 39(5) (with reg. 5, Sch. 1 para. 80); 2020 c. 1, Sch. 5 para. 1(1)

F25 Art. 46(6)-(8) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 7 para. 6(6); S.I. 2026/82, reg. 2(z9)

Article 47 U.K. [F26 Transfers subject to appropriate safeguards:] Binding corporate rules

1. [F27 The Commissioner] shall approve binding corporate rules F28 ... , provided that they:

(a) are legally binding and apply to and are enforced by every member concerned of the group of undertakings, or group of enterprises engaged in a joint economic activity, including their employees;

(b) expressly confer enforceable rights on data subjects with regard to the processing of their personal data; and

(c) fulfil the requirements laid down in paragraph 2.

2. The binding corporate rules referred to in paragraph 1 shall specify at least:

(a) the structure and contact details of the group of undertakings, or group of enterprises engaged in a joint economic activity and of each of its members;

(b) the data transfers or set of transfers, including the categories of personal data, the type of processing and its purposes, the type of data subjects affected and the identification of the third country or countries in question;

(c) their legally binding nature, both internally and externally;

(d) the application of the general data protection principles, in particular purpose limitation, data minimisation, limited storage periods, data quality, data protection by design and by default, legal basis for processing, processing of special categories of personal data, measures to ensure data security, and the requirements in respect of onward transfers to bodies not bound by the binding corporate rules;

(e) the rights of data subjects in regard to processing and the means to exercise those rights, including [F29 the right to protection in accordance with, and with regulations made under, Articles 22A to 22D in connection with decisions based solely on automated processing (including decisions reached by means of profiling)], the right to lodge a complaint with [F30 the Commissioner and before a court in accordance with Article 79 (see section 180 of the 2018 Act], and to obtain redress and, where appropriate, compensation for a breach of the binding corporate rules;

(f) the acceptance by the controller or processor [F31 established in the United Kingdom] of liability for any breaches of the binding corporate rules by any member concerned [F32 not established in the United Kingdom]; the controller or the processor shall be exempt from that liability, in whole or in part, only if it proves that that member is not responsible for the event giving rise to the damage;

(g) how the information on the binding corporate rules, in particular on the provisions referred to in points (d), (e) and (f) of this paragraph is provided to the data subjects in addition to Articles 13 and 14;

(h) the tasks of any data protection officer designated in accordance with Article 37 or any other person or entity in charge of the monitoring compliance with the binding corporate rules within the group of undertakings, or group of enterprises engaged in a joint economic activity, as well as monitoring training and complaint-handling;

(i) the complaint procedures;

(j) the mechanisms within the group of undertakings, or group of enterprises engaged in a joint economic activity for ensuring the verification of compliance with the binding corporate rules. Such mechanisms shall include data protection audits and methods for ensuring corrective actions to protect the rights of the data subject. Results of such verification should be communicated to the person or entity referred to in point (h) and to the board of the controlling undertaking of a group of undertakings, or of the group of enterprises engaged in a joint economic activity, and should be available upon request to [F33 the Commissioner];

(k) the mechanisms for reporting and recording changes to the rules and reporting those changes to [F34 the Commissioner];

(l) the cooperation mechanism with [F35 the Commissioner] to ensure compliance by any member of the group of undertakings, or group of enterprises engaged in a joint economic activity, in particular by making available to [F35 the Commissioner] the results of verifications of the measures referred to in point (j);

(m) the mechanisms for reporting to [F36 the Commissioner] any legal requirements to which a member of the group of undertakings, or group of enterprises engaged in a joint economic activity is subject in a third country which are likely to have a substantial adverse effect on the guarantees provided by the binding corporate rules; and

(n) the appropriate data protection training to personnel having permanent or regular access to personal data.

F37 3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Textual Amendments

F26 Words in Art. 47 heading inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 7 para. 7; S.I. 2026/82, reg. 2(z9)

F27 Words in Art. 47(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 40(2)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F28 Words in Art. 47(1) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 40(2)(b) (with reg. 5, Sch. 1 para. 80); 2020 c. 1, Sch. 5 para. 1(1)

F29 Words in Art. 47(2)(e) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 6 para. 8; S.I. 2026/82, reg. 2(z8) (with reg. 5)

F30 Words in Art. 47(2)(e) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 40(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F31 Words in Art. 47(2)(f) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 40(4)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F32 Words in Art. 47(2)(f) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 40(4)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F33 Words in Art. 47(2)(j) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 40(5) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F34 Words in Art. 47(2)(k) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 40(6) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F35 Words in Art. 47(2)(l) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 40(7) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F36 Words in Art. 47(2)(m) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 40(8) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F37 Art. 47(3) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 40(9) (with reg. 5, Sch. 1 para. 80); 2020 c. 1, Sch. 5 para. 1(1)

[F38 Article 47A U.K. Transfers subject to appropriate safeguards: further provision

1. The Secretary of State may by regulations specify standard data protection clauses which the Secretary of State considers are capable of securing that the data protection test set out in Article 46 is met in relation to transfers of personal data generally or in relation to a type of transfer specified in the regulations.

2. The Secretary of State must keep under review the standard data protection clauses specified in regulations under paragraph 1 that are for the time being in force.

3. Regulations under paragraph 1 are subject to the negative resolution procedure.

4. The Secretary of State may by regulations make provision about further safeguards that may be relied on for the purposes of Article 46(1A)(a).

5. The Secretary of State may only make regulations under paragraph 4 if the Secretary of State considers that the further safeguards are capable of securing that the data protection test set out in Article 46 is met in relation to transfers of personal data generally or in relation to a type of transfer specified in the regulations.

6. Regulations under paragraph 4 may, among other things—

(a) make provision by adopting safeguards prepared or published by another person;

(b) make provision about ways of providing safeguards which require authorisation from the Commissioner.

7. Regulations under paragraph 4 which amend Article 46 may do so only in the following ways—

(a) by adding ways of providing safeguards, or

(b) by varying or omitting ways of providing safeguards which were added by regulations under this Article.

8. Regulations under paragraph 4 are subject to the affirmative resolution procedure.]

Textual Amendments

F38 Art. 47A inserted (19.6.2025 for specified purposes, 5.2.2026 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), s. 142(1)(2)(h), Sch. 7 para. 8; S.I. 2026/82, reg. 2(z9)

F39 Article 48 U.K. Transfers or disclosures not authorised by Union law

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Textual Amendments

F39 Art. 48 omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 41 (with reg. 5, Sch. 1 para. 80); 2020 c. 1, Sch. 5 para. 1(1)

Article 49 U.K. Derogations for specific situations

1. In the absence of [F40 approval by regulations under Article 45A and of compliance with Article 46 (appropriate safeguards)], a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only on one of the following conditions:

(a) the data subject has explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers for the data subject due to the absence of [F41 approval by regulations under Article 45A] and appropriate safeguards;

(b) the transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of pre-contractual measures taken at the data subject's request;

(c) the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and another natural or legal person;

(d) the transfer is necessary for important reasons of public interest;

(e) the transfer is necessary for the establishment, exercise or defence of legal claims;

(f) the transfer is necessary in order to protect the vital interests of the data subject or of other persons, where the data subject is physically or legally incapable of giving consent;

(g) the transfer is made from a register which according to [F42 domestic law] is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate a legitimate interest, but only to the extent that the conditions laid down by [F42 domestic law] for consultation are fulfilled in the particular case.

Where a transfer could not be based on [F43 Article 45A] or 46, including the provisions on binding corporate rules, and none of the derogations for a specific situation referred to in the first subparagraph of this paragraph is applicable, a transfer to a third country or an international organisation may take place only if the transfer is not repetitive, concerns only a limited number of data subjects, is necessary for the purposes of compelling legitimate interests pursued by the controller which are not overridden by the interests or rights and freedoms of the data subject, and the controller has assessed all the circumstances surrounding the data transfer and has on the basis of that assessment provided suitable safeguards with regard to the protection of personal data. The controller shall inform [F44 the Commissioner] of the transfer. The controller shall, in addition to providing the information referred to in Articles 13 and 14, inform the data subject of the transfer and on the compelling legitimate interests pursued.

2. A transfer pursuant to point (g) of the first subparagraph of paragraph 1 shall not involve the entirety of the personal data or entire categories of the personal data contained in the register. Where the register is intended for consultation by persons having a legitimate interest, the transfer shall be made only at the request of those persons or if they are to be the recipients.

3. Points (a), (b) and (c) of the first subparagraph of paragraph 1 and the second subparagraph thereof shall not apply to activities carried out by public authorities in the exercise of their public powers.

4. The public interest referred to in point (d) of the first subparagraph of paragraph 1 [F45 must be public interest that is recognised in domestic law (whether in regulations under [F46 paragraph 4A] or otherwise)].

[F47 4A. The Secretary of State may by regulations specify for the purposes of point (d) of paragraph 1—

(a) circumstances in which a transfer of personal data to a third country or international organisation is to be taken to be necessary for important reasons of public interest, and

(b) circumstances in which a transfer of personal data to a third country or international organisation which is not required by an enactment is not to be taken to be necessary for important reasons of public interest.]

F48 5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F49 5A. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

6. The controller or processor shall document the assessment as well as the suitable safeguards referred to in the second subparagraph of paragraph 1 of this Article in the records referred to in Article 30.

[F50 7. Regulations under this Article—

(a) are subject to the made affirmative resolution procedure where the Secretary of State has made an urgency statement in respect of them;

(b) otherwise, are subject to the affirmative resolution procedure.

8. For the purposes of this Article, an urgency statement is a reasoned statement that the Secretary of State considers it desirable for the regulations to come into force without delay.]

Textual Amendments

F40 Words in Art. 49(1) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 7 para. 9(2)(a); S.I. 2026/82, reg. 2(z9)

F41 Words in Art. 49(1)(a) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 7 para. 9(2)(b); S.I. 2026/82, reg. 2(z9)

F42 Words in Art. 49(1)(g) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 42(2)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F43 Words in Art. 49(1) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 7 para. 9(3); S.I. 2026/82, reg. 2(z9)

F44 Words in Art. 49(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 42(2)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F45 Words in Art. 49(4) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 42(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F46 Words in Art. 49(4) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 7 para. 9(4); S.I. 2026/82, reg. 2(z9)

F47 Art. 49(4A) inserted (19.6.2025 for specified purposes, 5.2.2026 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), s. 142(1)(2)(h), Sch. 7 para. 9(5); S.I. 2026/82, reg. 2(z9)

F48 Art. 49(5) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 42(4) (with reg. 5, Sch. 1 para. 80); 2020 c. 1, Sch. 5 para. 1(1)

F49 Art. 49(5A) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 7 para. 9(6); S.I. 2026/82, reg. 2(z9)

F50 Art. 49(7)(8) inserted (19.6.2025 for specified purposes, 5.2.2026 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), s. 142(1)(2)(h), Sch. 7 para. 9(7); S.I. 2026/82, reg. 2(z9)

[F51 Article 49A U.K. Restriction in the public interest

1. The Secretary of State may by regulations restrict the transfer of a category of personal data to a third country or international organisation where—

(a) the transfer is not approved by regulations under Article 45A for the time being in force, and

(b) the Secretary of State considers the restriction to be necessary for important reasons of public interest.

2. Regulations under this Article—

(a) are subject to the made affirmative resolution procedure where the Secretary of State has made an urgency statement in respect of them;

(b) otherwise, are subject to the affirmative resolution procedure.

3. For the purposes of this Article, an urgency statement is a reasoned statement that the Secretary of State considers it desirable for the regulations to come into force without delay.]

Textual Amendments

F51 Art. 49A inserted (19.6.2025 for specified purposes, 5.2.2026 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), s. 142(1)(2)(h), Sch. 7 para. 10; S.I. 2026/82, reg. 2(z9)

Article 50 U.K. International cooperation for the protection of personal data

In relation to third countries and international organisations, [F52 the Commissioner] shall take appropriate steps to:

(a)

develop international cooperation mechanisms to facilitate the effective enforcement of legislation for the protection of personal data;

(b)

provide international mutual assistance in the enforcement of legislation for the protection of personal data, including through notification, complaint referral, investigative assistance and information exchange, subject to appropriate safeguards for the protection of personal data and F53 ... fundamental rights and freedoms;

(c)

engage relevant stakeholders in discussion and activities aimed at furthering international cooperation in the enforcement of legislation for the protection of personal data;

(d)

promote the exchange and documentation of personal data protection legislation and practice, including on jurisdictional conflicts with third countries.

Textual Amendments

F52 Words in Art. 50 substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 43 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F53 Word in Art. 50(b) omitted (31.12.2023 immediately before the end of 2023) by virtue of The Data Protection (Fundamental Rights and Freedoms) (Amendment) Regulations 2023 (S.I. 2023/1417), regs. 1(2), 2(6)