Data Protection Act 2018

UK GDPR: transfers subject to appropriate safeguards provided by standard data protection clauses U.K.

[F1 7 (1) Subject to paragraph 8, the appropriate safeguards referred to in Article 46(1) of the UK GDPR may be provided for on and after IP completion day as described in this paragraph.

(2) The safeguards may be provided for by any standard data protection clauses included in an arrangement which, if the arrangement had been entered into immediately before IP completion day, would have provided for the appropriate safeguards referred to in Article 46(1) of the EU GDPR by virtue of Article 46(2)(c) or (d) or (5) of the EU GDPR.

(3) The safeguards may be provided for by a version of standard data protection clauses described in sub-paragraph (2) incorporating changes where—

(a) all of the changes are made in consequence of the withdrawal of the United Kingdom from the EU or provision made by regulations under section 8 or 23 of the European Union (Withdrawal) Act 2018 (or both), and

(b) none of the changes alters the effect of the clauses.

(4) The following changes are to be treated as falling within sub-paragraph (3)(a) and (b)—

(a) changing references to adequacy decisions made by the European Commission into references to equivalent provision made by regulations under section 17A or by or under paragraphs 4 to 6 of this Schedule;

(b) changing references to transferring personal data outside the European Union or the European Economic Area into references to transferring personal data outside the United Kingdom.

(5) In the case of a transfer of personal data made under arrangements entered into before IP completion day, the safeguards may be provided for on and after IP completion day by standard data protection clauses not falling within sub-paragraph (2) which—

(a) formed part of the arrangements immediately before IP completion day, and

(b) at that time, provided for the appropriate safeguards referred to in Article 46(1) of the EU GDPR by virtue of Article 46(2)(c) or (d) or (5) of the EU GDPR.

(6) The Secretary of State and the Commissioner must keep the operation of this paragraph under review.

(7) In this paragraph, “adequacy decision” means a decision made on the basis of—

(a) Article 45(3) of the EU GDPR, or

(b) Article 25(6) of Directive 95/46/EC of the European Parliament and of the Council of 24th October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.

(8) This paragraph has effect in addition to Article 46(2) and (3) of the UK GDPR.]

Textual Amendments

F1 Sch. 21 inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 102 (with reg. 5, Sch. 3 para. 111(6)) (as amended by S.I. 2020/1586, regs. 1(2), 5(4)); 2020 c. 1, Sch. 5 para. 1(1)