Data Protection Act 2018

General principles for transfers U.K.

73 General principles for transfers of personal data U.K.

[F1 (A1) This section applies in relation to a transfer of personal data to a third country or international organisation for a law enforcement purpose.]

(1) [F2 The controller in relation to the transfer must secure that the transfer takes place only if—]

(a) the three conditions set out in subsections (2) to (4) are met, F3 ...

(b) in a case where the personal data was originally transmitted or otherwise made available to the controller or another competent authority by a member State F4 ..., that member State, or any person based in that member State which is a competent authority for the purposes of the Law Enforcement Directive, has authorised the transfer in accordance with the law of the member State [F5 , and—

(c) the transfer is carried out in accordance with the other provisions of this Part.]

(2) Condition 1 is that the transfer is necessary for any of the law enforcement purposes.

[F6 (3) Condition 2 is that the transfer—

(a) is approved by regulations under section 74AA that are in force at the time of the transfer,

(b) is made subject to appropriate safeguards (see section 75), or

(c) is based on special circumstances (see section 76).]

(4) Condition 3 is that—

(a) the intended recipient is a relevant authority in a third country or an international organisation that is a relevant international organisation,

[F7 (aa) the intended recipient is a person in a third country who—

(i) is not a person described in paragraph (a), but

(ii) is a processor whose processing, on behalf of the controller, of the personal data transferred is governed by, or authorised in accordance with, a contract with the controller that complies with section 59,] or

(b) in a case where the controller is a competent authority specified in any of paragraphs 5 to 17, 21, 24 to 28, 34 to 51, 54 and 56 of Schedule 7—

(i) the intended recipient is a person in a third country [F8 who is not a person described in paragraph (a) or (aa)], and

(ii) the additional conditions in section 77 are met.

(5) Authorisation is not required as mentioned in subsection (1)(b) if—

(a) the transfer is necessary for the prevention of an immediate and serious threat [F9 to the public security, national security or essential interests of a third country or the United Kingdom], and

(b) the authorisation cannot be obtained in good time.

(6) Where a transfer is made without the authorisation mentioned in subsection (1)(b), the authority in the member State which would have been responsible for deciding whether to authorise the transfer must be informed without delay.

(7) In this section, “relevant international organisation” means an international organisation that carries out functions for any of the law enforcement purposes.

Textual Amendments

F1 S. 73(A1) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 3(2); S.I. 2026/82, reg. 2(z10)

F2 Words in s. 73(1) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 3(3)(a); S.I. 2026/82, reg. 2(z10)

F3 Word in s. 73(1)(a) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 3(3)(b); S.I. 2026/82, reg. 2(z10)

F4 Words in s. 73(1)(b) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 40(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F5 S. 73(1)(c) and word inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 3(3)(c); S.I. 2026/82, reg. 2(z10)

F6 S. 73(3) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 3(4); S.I. 2026/82, reg. 2(z10)

F7 S. 73(4)(aa) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 3(5)(a); S.I. 2026/82, reg. 2(z10)

F8 Words in s. 73(4)(b)(i) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 3(5)(b); S.I. 2026/82, reg. 2(z10)

F9 Words in s. 73(5)(a) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 3(6); S.I. 2026/82, reg. 2(z10)

Commencement Information

I1 S. 73 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

F10 74 Transfers on the basis of an adequacy decision U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Textual Amendments

F10 S. 74 omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 41 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F11 74A Transfers based on adequacy regulations U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Textual Amendments

F11 S. 74A omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 4(1); S.I. 2026/82, reg. 2(z10)

[F12 74AA Transfers approved by regulations U.K.

(1) For the purposes of section 73, the Secretary of State may by regulations approve transfers of personal data to—

(a) a third country, or

(b) an international organisation.

(2) The Secretary of State may only make regulations under this section approving transfers to a third country or international organisation if the Secretary of State considers that the data protection test is met in relation to the transfers (see section 74AB).

(3) In making regulations under this section, the Secretary of State may have regard to any matter which the Secretary of State considers relevant, including the desirability of facilitating transfers of personal data to and from the United Kingdom.

(4) Regulations under this section may, among other things—

(a) make provision by reference to a third country or international organisation specified in the regulations or a description of country or organisation;

(b) approve all transfers of personal data to a third country or international organisation or only transfers specified or described in the regulations;

(c) identify a transfer of personal data by any means, including by reference to—

(i) a sector or geographic area within a third country,

(ii) the controller or processor,

(iii) the recipient of the personal data,

(iv) the personal data transferred,

(v) the means by which the transfer is made, or

(vi) relevant legislation, schemes, lists or other arrangements or documents, as they have effect from time to time;

(d) confer a discretion on a person.

(5) Regulations under this section are subject to the negative resolution procedure.

Textual Amendments

F12 Ss. 74AA, 74AB inserted (19.6.2025 for specified purposes, 5.2.2026 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), s. 142(1)(2)(h), Sch. 8 para. 4(2); S.I. 2026/82, reg. 2(z10)

74AB The data protection test U.K.

(1) For the purposes of section 74AA, the data protection test is met in relation to transfers to a third country or international organisation if the standard of the protection provided for data subjects with regard to law enforcement processing of personal data in the country or by the organisation is not materially lower than the standard of the protection provided for data subjects by or under—

(a) this Part, and

(b) Parts 5 to 7, so far as relevant to law enforcement processing.

(2) In considering whether the data protection test is met in relation to transfers of personal data to a third country or international organisation, the Secretary of State must consider, among other things—

(a) respect for the rule of law and for human rights in the country or by the organisation,

(b) the existence, and powers, of an authority responsible for enforcing the protection of data subjects with regard to the processing of personal data in the country or by the organisation,

(c) arrangements for judicial or non-judicial redress for data subjects in connection with such processing,

(d) rules about the transfer of personal data from the country or by the organisation to other countries or international organisations,

(e) relevant international obligations of the country or organisation, and

(f) the constitution, traditions and culture of the country or organisation.

(3) In subsections (1) and (2)—

(a) the references to the protection provided for data subjects are to that protection taken as a whole,

(b) the references to law enforcement processing are to processing by a competent authority for any of the law enforcement purposes or equivalent types of processing in the third country or by the international organisation (as appropriate), and

(c) the references to processing of personal data in the third country or by the international organisation are references only to the processing of personal data transferred to the country or organisation by means of processing to which this Act applies as described in section 207(2).

(4) When the data protection test is applied only to certain transfers to a third country or international organisation that are specified or described, or to be specified or described, in regulations (in accordance with section 74AA(4)(b))—

(a) the references in subsections (1) to (3) to personal data are to be read as references only to personal data likely to be the subject of such transfers, and

(b) the reference in subsection (2)(d) to transfer to other countries or international organisations is to be read as including transfer within the third country or international organisation.]

Textual Amendments

F12 Ss. 74AA, 74AB inserted (19.6.2025 for specified purposes, 5.2.2026 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), s. 142(1)(2)(h), Sch. 8 para. 4(2); S.I. 2026/82, reg. 2(z10)

[F13 74B [F14 Transfers approved by regulations: monitoring] U.K.

F15 (1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F15 (2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(3) The Secretary of State must, on an ongoing basis, monitor developments in third countries and international organisations that could affect decisions to make regulations [F16 giving approval under section 74AA] or to amend or revoke such regulations.

(4) [F17 Where the Secretary of State becomes aware that the data protection test is no longer met in relation to transfers approved, or of a description approved, in regulations under section 74AA,] the Secretary of State must, to the extent necessary, amend or revoke the regulations.

(5) Where regulations under [F18 section 74AA] are amended or revoked in accordance with subsection (4), the Secretary of State must enter into consultations with the third country or international organisation concerned with a view to [F19 improving the protection provided to data subjects with regard to the processing of personal data in the country or by the organisation].

(6) The Secretary of State must publish—

(a) a list of the third countries F20 ... and international organisations, and the descriptions of such countries F21 ... and organisations, which are for the time being [F22 approved by regulations under section 74AA as places or persons to which personal data may be transferred], and

(b) a list of the third countries F23 ... and international organisations, and the descriptions of such countries F24 ... and organisations, which have been but are no longer [F25 approved by] such regulations.

(7) In the case of [F26 regulations under section 74AA which approve only certain transfers to a third country or international organisation that are] specified or described in the regulations [F27 (in accordance with section 74AA(4)(b))]—

F28 (a) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(b) the lists published under subsection (6) must specify or describe the relevant transfers.]

Textual Amendments

F13 Ss. 74A, 74B inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 42 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F14 S. 74B heading substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 5(2); S.I. 2026/82, reg. 2(z10)

F15 S. 74B(1)(2) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 5(3); S.I. 2026/82, reg. 2(z10)

F16 Words in s. 74B(3) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 5(4); S.I. 2026/82, reg. 2(z10)

F17 Words in s. 74B(4) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 5(5); S.I. 2026/82, reg. 2(z10)

F18 Words in s. 74B(5) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 5(6)(a); S.I. 2026/82, reg. 2(z10)

F19 Words in s. 74B(5) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 5(6)(b); S.I. 2026/82, reg. 2(z10)

F20 Words in s. 74B(6)(a) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 5(7)(a); S.I. 2026/82, reg. 2(z10)

F21 Words in s. 74B(6)(a) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 5(7)(b); S.I. 2026/82, reg. 2(z10)

F22 Words in s. 74B(6)(a) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 5(7)(c); S.I. 2026/82, reg. 2(z10)

F23 Words in s. 74B(6)(b) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 5(8)(a); S.I. 2026/82, reg. 2(z10)

F24 Words in s. 74B(6)(b) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 5(8)(b); S.I. 2026/82, reg. 2(z10)

F25 Words in s. 74B(6)(b) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 5(8)(c); S.I. 2026/82, reg. 2(z10)

F26 Words in s. 74B(7) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 5(9)(a); S.I. 2026/82, reg. 2(z10)

F27 Words in s. 74B(7) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 5(9)(b); S.I. 2026/82, reg. 2(z10)

F28 S. 74B(7)(a) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 5(9)(c); S.I. 2026/82, reg. 2(z10)

75 Transfers [F29 subject to] appropriate safeguards U.K.

F30 (1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

[F31 (1A) A transfer of personal data to a third country or an international organisation is made subject to appropriate safeguards only if—

(a) an appropriate legal instrument binds the intended recipient of the data (see subsection (4)), or

(b) the controller, acting reasonably and proportionately, considers that the data protection test is met in relation to the transfer or that type of transfer (see subsection (5)).]

(2) The controller must inform the Commissioner about the categories of data transfers that take place in reliance on [F32 subsection (1A)(b) but not in reliance on section 73(4)(aa) (transfer to processor)].

(3) Where a transfer of data takes place in reliance on [F33 this section but not in reliance on section 73(4)(aa) (transfer to processor)]—

(a) the transfer must be documented,

(b) the documentation must be provided to the Commissioner on request, and

(c) the documentation must include, in particular—

(i) the date and time of the transfer,

(ii) the name of and any other pertinent information about the recipient,

(iii) the justification for the transfer, and

(iv) a description of the personal data transferred.

[F34 (4) For the purposes of this section, a legal instrument is “appropriate”, in relation to a transfer of personal data, if—

(a) the instrument is intended to be relied on in connection with the transfer or that type of transfer,

(b) at least one competent authority is a party to the instrument, and

(c) each competent authority that is a party to the instrument, acting reasonably and proportionately, considers that the data protection test is met in relation to the transfers, or types of transfer, intended to be made in reliance on the instrument (see subsection (5)).

(5) For the purposes of this section, the data protection test is met in relation to a transfer, or a type of transfer, of personal data if, after the transfer, the standard of the protection provided for the data subject with regard to that personal data, whether by a binding legal instrument or by other means, would not be materially lower than the standard of the protection provided for the data subject with regard to the personal data by or under—

(a) this Part, and

(b) Parts 5 to 7, so far as they relate to processing by a competent authority for any of the law enforcement purposes.

(6) For the purposes of subsections (1A)(b) and (4)(c), what is reasonable and proportionate is to be determined by reference to all the circumstances, or likely circumstances, of the transfer or type of transfer, including the nature and volume of the personal data transferred.

(7) In this section, references to the protection provided for the data subject are to that protection taken as a whole.]

[F35 (8) For provision about standard data protection clauses which the Commissioner considers are capable of securing that the data protection test in this section is met, see section 119A.]

Textual Amendments

F29 Words in s. 75 heading substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 6(2); S.I. 2026/82, reg. 2(z10)

F30 S. 75(1) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 6(3); S.I. 2026/82, reg. 2(z10)

F31 S. 75(1A) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 6(4); S.I. 2026/82, reg. 2(z10)

F32 Words in s. 75(2) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 6(5); S.I. 2026/82, reg. 2(z10)

F33 Words in s. 75(3) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 6(6); S.I. 2026/82, reg. 2(z10)

F34 S. 75(4)-(7) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 6(7); S.I. 2026/82, reg. 2(z10)

F35 S. 75(8) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 18 (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

Commencement Information

I2 S. 75 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

76 Transfers [F36 based on] special circumstances U.K.

[F37 (A1) A transfer of personal data to a third country or international organisation is based on special circumstances where—

(a) it is made in the absence of approval by regulations under section 74AA and of compliance with section 75 (appropriate safeguards), and

(b) it is necessary for a special purpose.]

(1) [F38 A transfer of personal data is necessary for a special purpose if it is necessary—]

(a) to protect the vital interests of the data subject or another person,

(b) to safeguard the legitimate interests of the data subject,

(c) for the prevention of an immediate and serious threat to the public security [F39 or national security] of F40 ... a third country [F41 or the United Kingdom],

(d) [F42 in particular circumstances,] for any of the law enforcement purposes, or

(e) [F43 in particular circumstances,] for a legal purpose.

(2) [F44 But a transfer of personal data is not necessary for a special purpose by virtue of subsection (1)(d) or (e)] if the controller determines that fundamental rights and freedoms of the data subject override the public interest in the transfer.

[F45 (2A) In accordance with the third data protection principle, the amount of personal data transferred in reliance on this section must not be excessive in relation to the special purpose relied on.]

(3) Where a transfer of data takes place in reliance on [F46 this section]—

(a) the transfer must be documented,

(b) the documentation must be provided to the Commissioner on request, and

(c) the documentation must include, in particular—

(i) the date and time of the transfer,

(ii) the name of and any other pertinent information about the recipient,

(iii) the justification for the transfer, and

(iv) a description of the personal data transferred.

(4) For the purposes of this section, a transfer is necessary for a legal purpose if—

(a) it is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings) relating to any of the law enforcement purposes,

(b) it is necessary for the purpose of obtaining legal advice in relation to any of the law enforcement purposes, or

(c) it is otherwise necessary for the purposes of establishing, exercising or defending legal rights in relation to any of the law enforcement purposes.

Textual Amendments

F36 Words in s. 76 heading substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 7(2); S.I. 2026/82, reg. 2(z10)

F37 S. 76(A1) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 7(3); S.I. 2026/82, reg. 2(z10)

F38 Words in s. 76(1) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 7(4)(a); S.I. 2026/82, reg. 2(z10)

F39 Words in s. 76(1)(c) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 7(4)(b)(i); S.I. 2026/82, reg. 2(z10)

F40 Words in s. 76(1)(c) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 43 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F41 Words in s. 76(1)(c) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 7(4)(b)(ii); S.I. 2026/82, reg. 2(z10)

F42 Words in s. 76(1)(d) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 7(4)(c); S.I. 2026/82, reg. 2(z10)

F43 Words in s. 76(1)(e) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 7(4)(d); S.I. 2026/82, reg. 2(z10)

F44 Words in s. 76(2) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 7(5); S.I. 2026/82, reg. 2(z10)

F45 S. 76(2A) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 7(6); S.I. 2026/82, reg. 2(z10)

F46 Words in s. 76(3) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 7(7); S.I. 2026/82, reg. 2(z10)

Commencement Information

I3 S. 76 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)