Data (Use and Access) Act 2025

Prospective

Section 85

Schedule 9 U.K. Transfers of personal data to third countries etc: minor and consequential amendments and transitional provision

Part 1 U.K. Minor and consequential amendments

The UK GDPR U.K.

1 The UK GDPR is amended as follows.

Commencement Information

I1 Sch. 9 para. 1 not in force at Royal Assent, see s. 142(1)

2 In Article 13(1)(f) (information to be provided where personal data is collected from the data subject)—

(a) for “adequacy regulations under section 17A of the 2018 Act” substitute “regulations under Article 45A”, and

(b) for “reference to the appropriate or suitable safeguards” substitute “the safeguards relied on”.

Commencement Information

I2 Sch. 9 para. 2 not in force at Royal Assent, see s. 142(1)

3 In Article 14(1)(f) (information to be provided where personal data is not obtained from the data subject)—

(a) for “adequacy regulations under section 17A of the 2018 Act” substitute “regulations under Article 45A”, and

(b) for “reference to the appropriate or suitable safeguards” substitute “the safeguards relied on”.

Commencement Information

I3 Sch. 9 para. 3 not in force at Royal Assent, see s. 142(1)

4 In Article 15(2) (right of access by the data subject)—

(a) after “organisation” insert “in reliance on Article 46”, and

(b) for “appropriate safeguards pursuant to Article 46 relating to” substitute “safeguards provided in accordance with Article 46(1A)(a)(i) or (b)(i) for the purposes of”.

Commencement Information

I4 Sch. 9 para. 4 not in force at Royal Assent, see s. 142(1)

5 (1) Article 40 (codes of conduct) is amended as follows.

(2) In paragraph 3 omit “appropriate” in both places.

(3) In paragraph 5, for “provides sufficient appropriate safeguards” substitute “is capable of providing safeguards for the purposes of Article 46”.

Commencement Information

I5 Sch. 9 para. 5 not in force at Royal Assent, see s. 142(1)

6 In Article 42(2) (certification) omit “appropriate” in both places.

Commencement Information

I6 Sch. 9 para. 6 not in force at Royal Assent, see s. 142(1)

7 In Article 46(2)(d) (transfers subject to appropriate safeguards: standard data protection clauses), after “Commissioner” insert “for the purposes of this Article”.

Commencement Information

I7 Sch. 9 para. 7 not in force at Royal Assent, see s. 142(1)

8 In Article 57(1) (Commissioner’s tasks)—

(a) in point (m) omit “which provide sufficient safeguards,”, and

(b) after point (s) insert—

“(sa) provide authorisation required under regulations made under Article 47A;”.

Commencement Information

I8 Sch. 9 para. 8 not in force at Royal Assent, see s. 142(1)

9 In Article 58(3) (authorisation and advisory powers of the Commissioner), after point (j) insert—

“(k) to provide authorisation required under regulations made under Article 47A”.

Commencement Information

I9 Sch. 9 para. 9 not in force at Royal Assent, see s. 142(1)

10 In Article 83(5)(c) (general conditions for imposing administrative fines), for “44” substitute “44A”.

Commencement Information

I10 Sch. 9 para. 10 not in force at Royal Assent, see s. 142(1)

The 2018 Act U.K.

11 The 2018 Act is amended as follows.

Commencement Information

I11 Sch. 9 para. 11 not in force at Royal Assent, see s. 142(1)

12 Omit section 17A (transfers based on adequacy regulations) and the italic heading before it.

Commencement Information

I12 Sch. 9 para. 12 not in force at Royal Assent, see s. 142(1)

13 Omit section 17B (transfers based on adequacy regulations: review etc).

Commencement Information

I13 Sch. 9 para. 13 not in force at Royal Assent, see s. 142(1)

14 Omit section 17C (standard data protection clauses).

Commencement Information

I14 Sch. 9 para. 14 not in force at Royal Assent, see s. 142(1)

15 Omit section 18 (transfers of personal data to third countries etc: public interest).

Commencement Information

I15 Sch. 9 para. 15 not in force at Royal Assent, see s. 142(1)

16 In section 24(2) (manual unstructured data held by FOI public authorities)—

(a) in paragraph (c), for “44 to 49” substitute “44A to 49A”, and

(b) omit paragraph (ca).

Commencement Information

I16 Sch. 9 para. 16 not in force at Royal Assent, see s. 142(1)

17 In section 26(2) (national security and defence exemption), omit paragraph (fa).

Commencement Information

I17 Sch. 9 para. 17 not in force at Royal Assent, see s. 142(1)

18 In section 75 (transfers on the basis of appropriate safeguards), after subsection (7) (inserted by Schedule 8 to this Act) insert—

“(8) For provision about standard data protection clauses which the Commissioner considers are capable of securing that the data protection test in this section is met, see section 119A.”

Commencement Information

I18 Sch. 9 para. 18 not in force at Royal Assent, see s. 142(1)

19 In section 78A (law enforcement processing: national security exemption) (inserted by section 88 of this Act), in subsection (2)(e), after sub-paragraph (i) insert—

“(ia) section 119A (standard clauses for transfers to third countries);”.

Commencement Information

I19 Sch. 9 para. 19 not in force at Royal Assent, see s. 142(1)

20 (1) Section 119A (power of Commissioner to specify standard clauses for transfers to third countries etc providing appropriate safeguards) is amended as follows.

(2) In subsection (1), for the words from “provide” to the end substitute “are capable of securing that the data protection test set out in Article 46 of the UK GDPR or section 75 of this Act (or both) is met in relation to transfers of personal data”.

(3) In subsection (3), after paragraph (a) insert—

“(aa) may make provision generally or in relation to types of transfer described in the document,”.

Commencement Information

I20 Sch. 9 para. 20 not in force at Royal Assent, see s. 142(1)

21 In section 149(2)(e) (enforcement notices), for “44 to 49” substitute “44A to 49A”.

Commencement Information

I21 Sch. 9 para. 21 not in force at Royal Assent, see s. 142(1)

22 (1) Section 182 (regulations and consultation) is amended as follows.

(2) Omit subsection (4).

(3) In subsection (6), for “Where regulations under this Act” substitute “For the purposes of this Act, where regulations”.

(4) In subsection (7), for “Where regulations under this Act” substitute “For the purposes of this Act, where regulations”.

(5) In subsection (8)—

(a) for “Where regulations under this Act” substitute “For the purposes of this Act, regulations”,

(b) after “procedure”” insert “if”,

(c) in paragraph (a), for “the urgency” substitute “an urgency”, and

(d) in paragraph (b), for “the period of 120 days” substitute “a period”.

(6) Omit subsections (9) and (10).

(7) In subsection (11), after “by regulations” insert “made under this Act or another enactment that are”.

(8) For subsection (14) substitute—

“(14) For the purposes of this section, an urgency statement is a reasoned statement that the Secretary of State considers it desirable for regulations to come into force without delay.”

Commencement Information

I22 Sch. 9 para. 22 not in force at Royal Assent, see s. 142(1)

23 In section 205(2)(e) (references to periods of time) omit “and (9)”.

Commencement Information

I23 Sch. 9 para. 23 not in force at Royal Assent, see s. 142(1)

24 In paragraph 26(9)(d) of Schedule 2 (exemptions etc for journalistic, academic, artistic and literary purposes), for “44” substitute “44A”.

Commencement Information

I24 Sch. 9 para. 24 not in force at Royal Assent, see s. 142(1)

25 (1) Part 3 of Schedule 21 (further transitional provision etc: transfers to third countries and international organisations) is amended as follows.

(2) In the heading before paragraph 4, for “adequacy decisions and adequacy regulations” substitute “transfers approved by regulations”.

(3) In paragraph 4 (UK GDPR: adequacy decisions and adequacy regulations)—

(a) in sub-paragraph (1), for “based on adequacy regulations” substitute “to be treated as approved by regulations made under Article 45A of the UK GDPR”,

(b) in sub-paragraph (4)(a), for “lists or other” substitute “schemes, lists or other arrangements or”, and

(c) omit sub-paragraph (6).

(4) In paragraph 6 (UK GDPR: application of certain provisions referring to regulations made under section 17A of the 2018 Act)—

(a) in sub-paragraph (1)(a), for “section 17A” substitute “Article 45A of the UK GDPR”,

(b) for sub-paragraph (2) substitute—

“(2) Those provisions are Articles 13(1)(f), 14(1)(f), 45C, 49(1) and 49A(1) of the UK GDPR.”, and

(c) after that sub-paragraph insert—

“(3) In its application to transfers treated as approved by virtue of paragraph 1, Article 45C(5) of the UK GDPR (transfers approved by regulations: monitoring) has effect as if the reference to Article 45A(4)(b) were omitted.”

(5) Omit paragraphs 7 and 8 (UK GDPR: transfers subject to appropriate safeguards provided by standard data protection clauses).

(6) In paragraph 9 (UK GDPR: transfers subject to appropriate safeguards provided by binding corporate rules)—

(a) in sub-paragraph (1)—

(i) for “The appropriate safeguards referred to in Article 46(1) of the UK GDPR may be provided for” substitute “The requirement for safeguards to be provided under Article 46(1A)(a)(i) of the UK GDPR may be satisfied”, and

(ii) after “described” insert “in”,

(b) in sub-paragraph (3)(a)—

(i) for “or provision” substitute “, of provision”, and

(ii) for “(or both)” substitute “or of the amendment of Chapter 5 of the UK GDPR by the Data (Use and Access) Act 2025”, and

(c) in sub-paragraph (4), after paragraph (a) insert—

“(aa) changing references to provision made by regulations under section 17A into references to provision made by regulations made under Article 45A of the UK GDPR;”.

(7) In the heading before paragraph 10, for “adequacy decisions and adequacy regulations” substitute “transfers approved by regulations”.

(8) In paragraph 10 (law enforcement processing: adequacy decisions and adequacy regulations)—

(a) in sub-paragraph (1), for “based on adequacy regulations” substitute “to be treated as approved by regulations made under section 74AA”,

(b) in sub-paragraph (4)(a), for “lists or other” substitute “schemes, lists or other arrangements or”, and

(c) omit sub-paragraph (6).

(9) In paragraph 12 (Part 3 (law enforcement processing): application of certain provisions referring to regulations made under section 74A)—

(a) the existing text becomes sub-paragraph (1),

(b) in that sub-paragraph—

(i) for the words before paragraph (a) substitute “In sections 74B and 76(A1)—”, and

(ii) in paragraph (a), for “74A” substitute “74AA”, and

(c) after that sub-paragraph insert—

“(2) In its application to transfers treated as approved by virtue of paragraph 10, section 74B(7) (transfers approved by regulations: monitoring) has effect as if the reference to section 74AA(4)(b) were omitted.”

Commencement Information

I25 Sch. 9 para. 25 not in force at Royal Assent, see s. 142(1)

Part 2 U.K. Transitional provision

The UK GDPR: transfers approved by regulations U.K.

26 (1) Regulations made under section 17A of the 2018 Act (transfers based on adequacy regulations) and in force immediately before the relevant day are to be treated, on and after that day, as if made under Article 45A of the UK GDPR (inserted by Schedule 7 to this Act).

(2) In this paragraph, “the relevant day” means the day on which paragraph 4 of Schedule 7 to this Act comes into force.

Commencement Information

I26 Sch. 9 para. 26 not in force at Royal Assent, see s. 142(1)

The UK GDPR: transfers subject to appropriate safeguards U.K.

27 (1) For the purposes of Article 44A(1)(a) and (2)(b) of the UK GDPR (general principles for transfers of personal data), a transfer of personal data to a third country or an international organisation made on or after the relevant day is made subject to appropriate safeguards where—

(a) the transfer is made under arrangements entered into before the relevant day,

(b) safeguards are provided in accordance with paragraph 2 or 3 of Article 46 of the UK GDPR or paragraph 9 of Schedule 21 to the 2018 Act, and

(c) if the transfer had been made immediately before the relevant day, it would have satisfied—

(i) the condition in Article 46(1) of the UK GDPR relating to data subjects’ rights and legal remedies, and

(ii) the requirements of the last sentence of Article 44 of the UK GDPR (level of protection must not be undermined).

(2) Sub-paragraph (1) has effect in addition to Article 46(1A) of the UK GDPR.

(3) In this paragraph—

• “international organisation” has the same meaning as in the 2018 Act (see section 205 of that Act);

• “personal data” has the same meaning as in the 2018 Act (see section 3 of that Act);

• “the relevant day” means the day on which paragraph 6 of Schedule 7 to this Act comes into force;

• “third country” has the same meaning as in Part 3 of the 2018 Act (see section 33 of that Act).

Commencement Information

I27 Sch. 9 para. 27 not in force at Royal Assent, see s. 142(1)

The UK GDPR: transfers subject to appropriate safeguards provided by standard data protection clauses U.K.

28 (1) Regulations made under section 17C of the 2018 Act (standard data protection clauses) and in force immediately before the relevant day are to be treated, on and after that day, as if made under Article 47A(1) of the UK GDPR (inserted by Schedule 7 to this Act).

(2) In this paragraph, “the relevant day” means the day on which paragraph 8 of Schedule 7 to this Act comes into force.

Commencement Information

I28 Sch. 9 para. 28 not in force at Royal Assent, see s. 142(1)

29 (1) This paragraph applies to a requirement for safeguards to be provided under—

(a) Article 46(1A)(a)(i) of the UK GDPR, or

(b) paragraph 27(1)(b) of this Schedule.

(2) The requirement may be satisfied on and after the relevant day by a version of pre-commencement standard clauses incorporating changes where—

(a) all of the changes are made in consequence of the amendment of Chapter 5 of the UK GDPR by this Act, and

(b) none of the changes alters the effect of the clauses.

(3) Changing a reference to regulations under section 17A of the 2018 Act into a reference to regulations made under Article 45A of the UK GDPR is to be treated as a change falling within sub-paragraph (2).

(4) Sub-paragraphs (2) and (3) cease to apply in relation to pre-commencement standard clauses if—

(a) the clauses are specified in regulations and a provision of the regulations relating to the clauses is amended or revoked on or after the relevant day, or

(b) the clauses are specified in another document and a provision of the document relating to the clauses is amended or withdrawn by the Information Commissioner on or after the relevant day.

(5) Sub-paragraph (2) has effect in addition to Article 46(2) and (3) of the UK GDPR.

(6) In this paragraph—

• “pre-commencement standard clauses” means standard data protection clauses specified in—

  (a)

  regulations made under section 17C of the 2018 Act and in force immediately before the relevant day, or

  (b)

  a document issued by the Information Commissioner under section 119A of the 2018 Act before the relevant day and not withdrawn before that day;

• “the relevant day” means the day on which paragraph 6 of Schedule 7 to this Act comes into force.

Commencement Information

I29 Sch. 9 para. 29 not in force at Royal Assent, see s. 142(1)

The UK GDPR: transfers necessary for important reasons of public interest U.K.

30 (1) Regulations made under section 18(1) of the 2018 Act (transfers necessary for important reasons of public interest) and in force immediately before the relevant day are to be treated, on and after that day, as if made under Article 49(4A) of the UK GDPR (inserted by Schedule 7 to this Act).

(2) In this paragraph, “the relevant day” means the day on which paragraph 9(5) of Schedule 7 to this Act comes into force.

Commencement Information

I30 Sch. 9 para. 30 not in force at Royal Assent, see s. 142(1)

The UK GDPR: restrictions on transfers of personal data to third countries and international organisations U.K.

31 (1) Regulations made under section 18(2) of the 2018 Act (restrictions on transfers of personal data to third countries and international organisations) and in force immediately before the relevant day are to be treated, on and after that day, as if made under Article 49A of the UK GDPR (inserted by Schedule 7 to this Act).

(2) In this paragraph, “the relevant day” means the day on which paragraph 10 of Schedule 7 to this Act comes into force.

Commencement Information

I31 Sch. 9 para. 31 not in force at Royal Assent, see s. 142(1)

Part 3 of the 2018 Act (law enforcement processing): transfers approved by regulations U.K.

32 (1) Regulations made under section 74A of the 2018 Act (transfers based on adequacy regulations) and in force immediately before the relevant day are to be treated, on and after that day, as if made under section 74AA of that Act (inserted by Schedule 8 to this Act).

(2) In this paragraph, “the relevant day” means the day on which paragraph 4 of Schedule 8 to this Act comes into force.

Commencement Information

I32 Sch. 9 para. 32 not in force at Royal Assent, see s. 142(1)

Part 3 of the 2018 Act (law enforcement processing): transfers subject to appropriate safeguards U.K.

33 (1) For the purposes of section 73(3) of the 2018 Act (general principles for transfers of personal data), a transfer of personal data to a third country or an international organisation made on or after the relevant day is a transfer made subject to appropriate safeguards where—

(a) an appropriate pre-commencement legal instrument binds the intended recipient of the data, and

(b) if the transfer had been made immediately before the relevant day, the requirement in section 75(1)(a) of the 2018 Act (binding legal instrument containing appropriate safeguards) would have been satisfied by virtue of that instrument.

(2) Sub-paragraph (1) has effect in addition to section 75(1A) of the 2018 Act.

(3) For the purposes of sub-paragraph (1), a legal instrument is an “appropriate pre-commencement legal instrument”, in relation to a transfer of personal data, if—

(a) it was entered into before the relevant day,

(b) it is intended to be relied on in connection with the transfer or that type of transfer, and

(c) at least one competent authority is a party to the instrument.

(4) In this paragraph—

• “competent authority” has the same meaning as in Part 3 of the 2018 Act (see section 30 of that Act);

• “international organisation” has the same meaning as in the 2018 Act (see section 205 of that Act);

• “personal data” has the same meaning as in the 2018 Act (see section 3 of that Act);

• “the relevant day” means the day on which paragraph 6 of Schedule 8 to this Act comes into force;

• “third country” has the same meaning as in Part 3 of the 2018 Act (see section 33 of that Act).

Commencement Information

I33 Sch. 9 para. 33 not in force at Royal Assent, see s. 142(1)