http://www.legislation.gov.uk/ukpga/2018/12/schedule/21/part/3Data Protection Act 2018An Act to make provision for the regulation of the processing of information relating to individuals; to make provision in connection with the Information Commissioner's functions under certain regulations relating to information; to make provision for a direct marketing code of practice; and for connected purposes.texttext/xmlenStatute Law Database2026-07-09Expert Participation2026-06-19 Data Protection Act 2018s. 26(2)(f)(ai)The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026Sch. 2 para. 23(2)(3)reg. 1(4)reg. 1(2)Data Protection Act 2018s. 160(4)(ab)The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026Sch. 2 para. 23(2)(3)reg. 1(2)Data Protection Act 2018Sch. 7 para. 51AThe Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026Sch. 2 para. 23(12)(a)reg. 1(2)Data Protection Act 2018Sch. 3 para. 8(1)(y)Adoption and Children Act (Northern Ireland) 2022Sch. 3 para. 78(3)s. 160(1) SCHEDULE 21Part 341On and after IP completion day, for the purposes of the UK GDPR and Part 2 of this Act, a transfer of personal data to a third country or an international organisation is to be treated as approved by regulations made under Article 45A of the UK GDPR if, at the time of the transfer, paragraph 5 specifies, or specifies a description which includes—ain the case of a third country, the country or a relevant territory or sector within the country, orbin the case of an international organisation, the organisation.2Sub-paragraph (1) has effect subject to provision in paragraph 5 providing that only particular transfers to the country, territory, sector or organisation may rely on a particular provision of paragraph 5 for the purposes of sub-paragraph (1).3The Secretary of State may by regulations—arepeal sub-paragraphs (1) and (2) and paragraph 5;bamend paragraph 5 so as to omit a third country, territory, sector or international organisation specified, or of a description specified, in that paragraph;camend paragraph 5 so as to replace a reference to, or description of, a third country, territory, sector or organisation with a narrower reference or description, including by specifying or describing particular transfers of personal data and making provision described in sub-paragraph (2).4Regulations under this paragraph may, among other things——aidentify a transfer of personal data by any means, including by reference to the controller or processor, the recipient, the personal data transferred or the means by which the transfer is made or by reference to relevant legislation, schemes, lists or other arrangements or documents, as they have effect from time to time;bconfer a discretion on a person.5Regulations under this paragraph are subject to the negative resolution procedure.6. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .51The following are specified for the purposes of paragraph 4(1)—aan EEA state;bGibraltar;ca Union institution, body, office or agency set up by, or on the basis of, the Treaty on the European Union, the Treaty on the Functioning of the European Union or the Euratom Treaty;dan equivalent institution, body, office or agency set up by, or on the basis of, the Treaties establishing the European Economic Area;ea third country which is the subject of a decision listed in sub-paragraph (2), other than a decision that, immediately before IP completion day, had been repealed or was suspended;fa third country, territory or sector within a third country or international organisation which is the subject of an adequacy decision made by the European Commission before IP completion day on the basis of Article 45(3) of the EU GDPR, other than a decision that, immediately before IP completion day, had been repealed or was suspended.2The decisions mentioned in sub-paragraph (1)(e) are the following—aCommission Decision 2000/518/EC of 26th July 2000 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided in Switzerland;bCommission Decision 2002/2/EC of 20th December 2001 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided by the Canadian Personal Information Protection and Electronic Documents Act;cCommission Decision 2003/490/EC of 30th June 2003 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Argentina;dCommission Decision 2003/821/EC of 21st November 2003 on the adequate protection of personal data in Guernsey;eCommission Decision 2004/411/EC of 28th April 2004 on the adequate protection of personal data in the Isle of Man;fCommission Decision 2008/393/EC of 8th May 2008 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Jersey;gCommission Decision 2010/146/EU of 5th March 2010 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection provided by the Faeroese Act on processing of personal data;hCommission Decision 2010/625/EU of 19th October 2010 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Andorra;iCommission Decision 2011/61/EU of 31st January 2011 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by the State of Israel with regard to automated processing of personal data;jCommission Implementing Decision 2012/484/EU of 21st August 2012 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by the Eastern Republic of Uruguay with regard to automated processing of personal data;kCommission Implementing Decision 2013/65/EU of 19th December 2012 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by New Zealand;mCommission Implementing Decision (EU) 2019/419 of 23rd January 2019 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by Japan under the Act on the Protection of Personal Information.3Where a decision described in sub-paragraph (1)(e) or (f) states that an adequate level of protection of personal data is ensured only for a transfer specified or described in the decision, only such a transfer may rely on that provision and that decision for the purposes of paragraph 4(1).4The references to a decision in sub-paragraphs (1)(e) and (f) and (2) are to the decision as it had effect in EU law immediately before IP completion day, subject to sub-paragraphs (5) and (6). 5For the purposes of this paragraph, where a reference to legislation, a list or another document in a decision described in sub-paragraph (1)(e) or (f) is a reference to the legislation, list or document as it has effect from time to time, it is to be treated as a reference to the legislation, list or other document as it has effect at the time of the transfer.6For the purposes of this paragraph, where a decision described in sub-paragraph (1)(e) or (f) relates to—atransfers from the European Union (or the European Community) or the European Economic Area, orbtransfers to which the EU GDPR applies,it is to be treated as relating to equivalent transfers to or from the United Kingdom or transfers to which the UK GDPR applies (as appropriate).61In the provisions listed in sub-paragraph (2)—areferences to regulations made under Article 45A of the UK GDPR (other than references to making such regulations) include the provision made in paragraph 5;breferences to the revocation of such regulations include the repeal of all or part of paragraph 5.2Those provisions are Articles 13(1)(f), 14(1)(f), 45C, 49(1) and 49A(1) of the UK GDPR.3In its application to transfers treated as approved by virtue of paragraph 1, Article 45C(5) of the UK GDPR (transfers approved by regulations: monitoring) has effect as if the reference to Article 45A(4)(b) were omitted.7. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .91The requirement for safeguards to be provided under Article 46(1A)(a)(i) of the UK GDPR may be satisfied on and after IP completion day as described in sub-paragraphs (2) to (4), subject to sub-paragraph (5).2The safeguards may be provided for by any binding corporate rules authorised by the Commissioner which, immediately before IP completion day, provided for the appropriate safeguards referred to in Article 46(1) of the EU GDPR by virtue of Article 46(5) of the EU GDPR.3The safeguards may be provided for by a version of binding corporate rules described in sub-paragraph (2) incorporating changes where—aall of the changes are made in consequence of the withdrawal of the United Kingdom from the EU , of provision made by regulations under section 8 or 23 of the European Union (Withdrawal) Act 2018 or of the amendment of Chapter 5 of the UK GDPR by the Data (Use and Access) Act 2025, andbnone of the changes alters the effect of the rules.4The following changes are to be treated as falling within sub-paragraph (3)(a) and (b)—achanging references to adequacy decisions made by the European Commission into references to equivalent provision made by regulations under section 17A or by or under paragraphs 4 to 6 of this Schedule;aachanging references to provision made by regulations under section 17A into references to provision made by regulations made under Article 45A of the UK GDPR;bchanging references to transferring personal data outside the European Union or the European Economic Area into references to transferring personal data outside the United Kingdom.5Sub-paragraphs (2) to (4) cease to apply in relation to binding corporate rules if, on or after IP completion day, the Commissioner withdraws the authorisation of the rules (or, where sub-paragraph (3) is relied on, the authorisation of the rules mentioned in sub-paragraph (2)).5AFor the purposes of sub-paragraph (2), binding corporate rules which, immediately before IP completion day, provided for the appropriate safeguards referred to in Article 46(1) of the EU GDPR by virtue of Article 46(5) of the EU GDPR but which were authorised other than by the Commissioner are to be treated as authorised by the Commissioner where—aa valid notification of the rules has been made to the Commissioner,bthe Commissioner has approved them, andcthat approval has not been withdrawn.5BA notification is valid if it—ais made by a controller or processor established in the United Kingdom,bis made to the Commissioner before the end of the period of 6 months beginning with IP completion day, andcincludes—ithe name and contact details of the data protection officer or other contact point for the controller or processor, andiisuch other information as the Commissioner may reasonably require.5CWhere a valid notification is made the Commissioner must, without undue delay—adecide whether or not to approve the rules, andbnotify the controller or processor of that decision.6The Commissioner must keep the operation of this paragraph under review.7In this paragraph—“adequacy decision” means a decision made on the basis of—Article 45(3) of the EU GDPR, orArticle 25(6) of Directive 95/46/EC of the European Parliament and of the Council of 24th October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data;“binding corporate rules” has the meaning given in Article 4(20) of the UK GDPR.8This paragraph has effect in addition to Article 46(2) and (3) of the UK GDPR.101On and after IP completion day, for the purposes of Part 3 of this Act, a transfer of personal data to a third country or an international organisation is to be treated as approved by regulations made under section 74AA if, at the time of the transfer, paragraph 11 specifies, or specifies a description which includes—ain the case of a third country, the country or a relevant territory or sector within the country, orbin the case of an international organisation, the organisation.2Sub-paragraph (1) has effect subject to provision in paragraph 11 providing that only particular transfers to the country, territory, sector or organisation may rely on a particular provision of paragraph 11 for the purposes of sub-paragraph (1).3The Secretary of State may by regulations—arepeal sub-paragraphs (1) and (2) and paragraph 11;bamend paragraph 11 so as to omit a third country, territory, sector or international organisation specified, or of a description specified, in that paragraph;camend paragraph 11 so as to replace a reference to, or description of, a third country, territory, sector or organisation with a narrower reference or description, including by specifying or describing particular transfers of personal data and by making provision described in sub-paragraph (2).4Regulations under this paragraph may, among other things—aidentify a transfer of personal data by any means, including by reference to the controller or processor, the recipient, the personal data transferred or the means by which the transfer is made or by reference to relevant legislation, schemes, lists or other arrangements or documents, as they have effect from time to time;bconfer a discretion on a person.5Regulations under this paragraph are subject to the negative resolution procedure.6. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .111The following are specified for the purposes of paragraph 10(1)—a an EEA state; aaSwitzerland;bGibraltar;ca third country, a territory or sector within a third country or an international organisation which is the subject of an adequacy decision made by the European Commission before IP completion day on the basis of Article 36(3) of the Law Enforcement Directive, other than a decision that, immediately before IP completion day, had been repealed or was suspended.2Where a decision described in sub-paragraph (1)(c) states that an adequate level of protection of personal data is ensured only for a transfer specified or described in the decision, only such a transfer may rely on that provision and that decision for the purposes of paragraph 10(1).3The reference to a decision in sub-paragraph (1)(c) is to the decision as it had effect in EU law immediately before IP completion day, subject to sub-paragraphs (4) and (5).4For the purposes of this paragraph, where a reference to legislation, a list or another document in a decision described in sub-paragraph (1)(c) is a reference to the legislation, list or document as it has effect from time to time, it is to be treated as a reference to the legislation, list or other document as it has effect at the time of the transfer.5For the purposes of this paragraph, where a decision described in sub-paragraph (1)(c) relates to—atransfers from the European Union (or the European Community) or the European Economic Area, orbtransfers to which the Law Enforcement Directive applies,it is to be treated as relating to equivalent transfers from the United Kingdom or transfers to which Part 3 of this Act applies (as appropriate).121 In sections 74B and 76(A1)— areferences to regulations made under section 74AA (other than references to making such regulations) include the provision made in paragraph 11;breferences to the revocation of such regulations include the repeal of all or part of paragraph 11.2In its application to transfers treated as approved by virtue of paragraph 10, section 74B(7) (transfers approved by regulations: monitoring) has effect as if the reference to section 74AA(4)(b) were omitted.Words in Sch. 21 para. 10(4)(a) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(8)(b) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)Words in Sch. 21 para. 12(1) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(9)(b)(i) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)Sch. 21 para. 10(6) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(8)(c) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)Sch. 21 para. 8 omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(5) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)Sch. 21: power to amend conferred (19.6.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 142(2)(g), 143(2)Word in Sch. 21 para. 12(1)(a) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(9)(b)(ii) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)Words in Sch. 21 para. 6(1)(a) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(4)(a) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)Words in Sch. 21 para. 9(3)(a) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(6)(b)(ii) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11) Sch. 21 para. 12 renumbered as Sch. 21 para. 12(1) (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(9)(a) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)Words in Sch. 21 para. 10(1) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(8)(a) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)Sch. 21 para. 6(3) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(4)(c) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)Words in Sch. 21 para. 9(1) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(6)(a)(i) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)Sch. 21 inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 102 (with reg. 5, Sch. 3 para. 111(6)) (as amended by S.I. 2020/1586, regs. 1(2), 5(4)); 2020 c. 1, Sch. 5 para. 1(1)Words in Sch. 21 para. 4(1) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(3)(a) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)Sch. 21 para. 4(6) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(3)(c) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)Words in Sch. 21 para. 10 heading substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(7) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)Sch. 21 para. 7 omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(5) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)Words in Sch. 21 para. 4 heading substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(2) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)Words in Sch. 21 para. 4(4)(a) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(3)(b) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)Words in Sch. 21 para. 9(3)(a) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(6)(b)(i) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)Word in Sch. 21 para. 9(1) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(6)(a)(ii) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)Sch. 21 para. 12(2) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(9)(c) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)Sch. 21 para. 9(4)(aa) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(6)(c) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)Sch. 21 para. 6(2) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(4)(b) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)