http://www.legislation.gov.uk/ukpga/2018/12/section/109Data Protection Act 2018An Act to make provision for the regulation of the processing of information relating to individuals; to make provision in connection with the Information Commissioner's functions under certain regulations relating to information; to make provision for a direct marketing code of practice; and for connected purposes.texttext/xmlenStatute Law Database2026-07-09Expert Participation2026-06-19
Data Protection Act 2018s. 26(2)(f)(ai)The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026Sch. 2 para. 23(2)(3)reg. 1(4)reg. 1(2)Data Protection Act 2018s. 160(4)(ab)The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026Sch. 2 para. 23(2)(3)reg. 1(2)Data Protection Act 2018Sch. 7 para. 51AThe Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026Sch. 2 para. 23(12)(a)reg. 1(2)Data Protection Act 2018Sch. 3 para. 8(1)(y)Adoption and Children Act (Northern Ireland) 2022Sch. 3 para. 78(3)s. 160(1)
PART 4Intelligence services processingCHAPTER 5Transfers of personal data outside the United KingdomTransfers of personal data outside the United Kingdom1091A controller may not transfer personal data to—aa country or territory outside the United Kingdom, orban international organisation,unless the transfer falls within subsection (2).2A transfer of personal data falls within this subsection if the transfer is a necessary and proportionate measure carried out—afor the purposes of the controller's statutory functions, orbfor other purposes provided for, in relation to the controller, in section 2(2)(a) of the Security Service Act 1989 or section 2(2)(a) or 4(2)(a) of the Intelligence Services Act 1994.S. 109 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)