Data (Use and Access) Act 2025

Section 85

Schedule 8 U.K. Transfers of personal data to third countries etc: law enforcement processing

Prospective

Introduction U.K.

1 Chapter 5 of Part 3 of the 2018 Act (transfers of personal data to third countries etc) is amended as follows.

Commencement Information

I1 Sch. 8 para. 1 not in force at Royal Assent, see s. 142(1)

Prospective

Overview and interpretation U.K.

2 In section 72 (overview and interpretation), in subsection (1)(b)—

(a) for “the special conditions that apply” substitute “additional conditions that apply in certain cases”, and

(b) after “organisation” insert “(see section 73(4)(b))”.

Commencement Information

I2 Sch. 8 para. 2 not in force at Royal Assent, see s. 142(1)

Prospective

General principles for transfer U.K.

3 (1) Section 73 (general principles for transfers) is amended as follows.

(2) Before subsection (1) insert—

“(A1) This section applies in relation to a transfer of personal data to a third country or international organisation for a law enforcement purpose.”

(3) In subsection (1)—

(a) for the words before paragraph (a) substitute “The controller in relation to the transfer must secure that the transfer takes place only if—”,

(b) omit the “and” at the end of paragraph (a), and

(c) after paragraph (b) insert “, and—

(c) the transfer is carried out in accordance with the other provisions of this Part.”

(4) For subsection (3) substitute—

“(3) Condition 2 is that the transfer—

(a) is approved by regulations under section 74AA that are in force at the time of the transfer,

(b) is made subject to appropriate safeguards (see section 75), or

(c) is based on special circumstances (see section 76).”

(5) In subsection (4)—

(a) after paragraph (a) (but before the “or” at the end of that paragraph) insert—

“(aa) the intended recipient is a person in a third country who—

(i) is not a person described in paragraph (a), but

(ii) is a processor whose processing, on behalf of the controller, of the personal data transferred is governed by, or authorised in accordance with, a contract with the controller that complies with section 59,”, and

(b) in paragraph (b)(i), for “other than a relevant authority” substitute “who is not a person described in paragraph (a) or (aa)”.

(6) In subsection (5)(a), for the words from “either” to “State” substitute “to the public security, national security or essential interests of a third country or the United Kingdom”.

Commencement Information

I3 Sch. 8 para. 3 not in force at Royal Assent, see s. 142(1)

Transfers approved by regulations U.K.

4 (1) Omit section 74A (transfers based on adequacy regulations).

(2) After that section insert—

“74AA Transfers approved by regulations

(1) For the purposes of section 73, the Secretary of State may by regulations approve transfers of personal data to—

(a) a third country, or

(b) an international organisation.

(2) The Secretary of State may only make regulations under this section approving transfers to a third country or international organisation if the Secretary of State considers that the data protection test is met in relation to the transfers (see section 74AB).

(3) In making regulations under this section, the Secretary of State may have regard to any matter which the Secretary of State considers relevant, including the desirability of facilitating transfers of personal data to and from the United Kingdom.

(4) Regulations under this section may, among other things—

(a) make provision by reference to a third country or international organisation specified in the regulations or a description of country or organisation;

(b) approve all transfers of personal data to a third country or international organisation or only transfers specified or described in the regulations;

(c) identify a transfer of personal data by any means, including by reference to—

(i) a sector or geographic area within a third country,

(ii) the controller or processor,

(iii) the recipient of the personal data,

(iv) the personal data transferred,

(v) the means by which the transfer is made, or

(vi) relevant legislation, schemes, lists or other arrangements or documents, as they have effect from time to time;

(d) confer a discretion on a person.

(5) Regulations under this section are subject to the negative resolution procedure.

74AB The data protection test

(1) For the purposes of section 74AA, the data protection test is met in relation to transfers to a third country or international organisation if the standard of the protection provided for data subjects with regard to law enforcement processing of personal data in the country or by the organisation is not materially lower than the standard of the protection provided for data subjects by or under—

(a) this Part, and

(b) Parts 5 to 7, so far as relevant to law enforcement processing.

(2) In considering whether the data protection test is met in relation to transfers of personal data to a third country or international organisation, the Secretary of State must consider, among other things—

(a) respect for the rule of law and for human rights in the country or by the organisation,

(b) the existence, and powers, of an authority responsible for enforcing the protection of data subjects with regard to the processing of personal data in the country or by the organisation,

(c) arrangements for judicial or non-judicial redress for data subjects in connection with such processing,

(d) rules about the transfer of personal data from the country or by the organisation to other countries or international organisations,

(e) relevant international obligations of the country or organisation, and

(f) the constitution, traditions and culture of the country or organisation.

(3) In subsections (1) and (2)—

(a) the references to the protection provided for data subjects are to that protection taken as a whole,

(b) the references to law enforcement processing are to processing by a competent authority for any of the law enforcement purposes or equivalent types of processing in the third country or by the international organisation (as appropriate), and

(c) the references to processing of personal data in the third country or by the international organisation are references only to the processing of personal data transferred to the country or organisation by means of processing to which this Act applies as described in section 207(2).

(4) When the data protection test is applied only to certain transfers to a third country or international organisation that are specified or described, or to be specified or described, in regulations (in accordance with section 74AA(4)(b))—

(a) the references in subsections (1) to (3) to personal data are to be read as references only to personal data likely to be the subject of such transfers, and

(b) the reference in subsection (2)(d) to transfer to other countries or international organisations is to be read as including transfer within the third country or international organisation.”

Commencement Information

I4 Sch. 8 para. 4 in force at Royal Assent for specified purposes, see s. 142(1)(2)(h)

Prospective

Transfers approved by regulations: monitoring U.K.

5 (1) Section 74B (transfers based on adequacy regulations: review etc) is amended as follows.

(2) For the heading substitute “Transfers approved by regulations: monitoring”.

(3) Omit subsections (1) and (2).

(4) In subsection (3), for “under section 74A” substitute “giving approval under section 74AA”.

(5) In subsection (4), for the words from the beginning to “otherwise,” substitute “Where the Secretary of State becomes aware that the data protection test is no longer met in relation to transfers approved, or of a description approved, in regulations under section 74AA,”.

(6) In subsection (5)—

(a) for “section 74A” substitute “section 74AA”, and

(b) for “remedying the lack of an adequate level of protection” substitute “improving the protection provided to data subjects with regard to the processing of personal data in the country or by the organisation”.

(7) In subsection (6)(a)—

(a) omit “, territories and specified sectors within a third country”,

(b) omit “, territories, sectors”, and

(c) for “specified in regulations under section 74A” substitute “approved by regulations under section 74AA as places or persons to which personal data may be transferred”.

(8) In subsection (6)(b)—

(a) omit “, territories and specified sectors within a third country”,

(b) omit “, territories, sectors”, and

(c) for “specified in” substitute “approved by”.

(9) In subsection (7)—

(a) for “regulations under section 74A which specify that an adequate level of protection of personal data is ensured only for a transfer” substitute “regulations under section 74AA which approve only certain transfers to a third country or international organisation that are”,

(b) after “the regulations” insert “(in accordance with section 74AA(4)(b))”, and

(c) omit paragraph (a) (together with the final “and”).

Commencement Information

I5 Sch. 8 para. 5 not in force at Royal Assent, see s. 142(1)

Prospective

Transfers subject to appropriate safeguards U.K.

6 (1) Section 75 (transfers on the basis of appropriate safeguards) is amended as follows.

(2) In the heading, for “on the basis of” substitute “subject to”.

(3) Omit subsection (1).

(4) After that subsection insert—

“(1A) A transfer of personal data to a third country or an international organisation is made subject to appropriate safeguards only if—

(a) an appropriate legal instrument binds the intended recipient of the data (see subsection (4)), or

(b) the controller, acting reasonably and proportionately, considers that the data protection test is met in relation to the transfer or that type of transfer (see subsection (5)).”

(5) In subsection (2), for “subsection (1)(b)” substitute “subsection (1A)(b) but not in reliance on section 73(4)(aa) (transfer to processor)”.

(6) In subsection (3), for “subsection (1)” substitute “this section but not in reliance on section 73(4)(aa) (transfer to processor)”.

(7) At the end insert—

“(4) For the purposes of this section, a legal instrument is “appropriate”, in relation to a transfer of personal data, if—

(a) the instrument is intended to be relied on in connection with the transfer or that type of transfer,

(b) at least one competent authority is a party to the instrument, and

(c) each competent authority that is a party to the instrument, acting reasonably and proportionately, considers that the data protection test is met in relation to the transfers, or types of transfer, intended to be made in reliance on the instrument (see subsection (5)).

(5) For the purposes of this section, the data protection test is met in relation to a transfer, or a type of transfer, of personal data if, after the transfer, the standard of the protection provided for the data subject with regard to that personal data, whether by a binding legal instrument or by other means, would not be materially lower than the standard of the protection provided for the data subject with regard to the personal data by or under—

(a) this Part, and

(b) Parts 5 to 7, so far as they relate to processing by a competent authority for any of the law enforcement purposes.

(6) For the purposes of subsections (1A)(b) and (4)(c), what is reasonable and proportionate is to be determined by reference to all the circumstances, or likely circumstances, of the transfer or type of transfer, including the nature and volume of the personal data transferred.

(7) In this section, references to the protection provided for the data subject are to that protection taken as a whole.”

Commencement Information

I6 Sch. 8 para. 6 not in force at Royal Assent, see s. 142(1)

Prospective

Transfers based on special circumstances U.K.

7 (1) Section 76 (transfers on the basis of special circumstances) is amended as follows.

(2) In the heading, for “on the basis of” substitute “based on”.

(3) Before subsection (1) insert—

“(A1) A transfer of personal data to a third country or international organisation is based on special circumstances where—

(a) it is made in the absence of approval by regulations under section 74AA and of compliance with section 75 (appropriate safeguards), and

(b) it is necessary for a special purpose.”

(4) In subsection (1)—

(a) for the words before paragraph (a) substitute “A transfer of personal data is necessary for a special purpose if it is necessary—”,

(b) in paragraph (c)—

(i) after “public security” insert “or national security”, and

(ii) at the end insert “or the United Kingdom”,

(c) in paragraph (d), for “in individual cases” substitute “in particular circumstances,”, and

(d) in paragraph (e), for “in individual cases” substitute “in particular circumstances,”.

(5) In subsection (2), for “But subsection (1)(d) and (e) do not apply” substitute “But a transfer of personal data is not necessary for a special purpose by virtue of subsection (1)(d) or (e)”.

(6) After subsection (2) insert—

“(2A) In accordance with the third data protection principle, the amount of personal data transferred in reliance on this section must not be excessive in relation to the special purpose relied on.”

(7) In subsection (3), for “subsection (1)” substitute “this section”.

Commencement Information

I7 Sch. 8 para. 7 not in force at Royal Assent, see s. 142(1)

Prospective

Transfers to particular recipients U.K.

8 For the italic heading before section 77 substitute “Additional conditions”.

Commencement Information

I8 Sch. 8 para. 8 not in force at Royal Assent, see s. 142(1)

9 (1) Section 77 (conditions for transfers of personal data to persons other than relevant authorities) is amended as follows.

(2) For the heading substitute “Additional conditions for transfers in reliance on section 73(4)(b)”.

(3) In subsection (6), for “other than a relevant authority” substitute “in reliance on section 73(4)(b)”.

(4) In subsection (7)(a), for “other than a relevant authority” substitute “that takes place in reliance on section 73(4)(b)”.

Commencement Information

I9 Sch. 8 para. 9 not in force at Royal Assent, see s. 142(1)

Prospective

Subsequent transfers U.K.

10 (1) Section 78 (subsequent transfers) is amended as follows.

(2) Before subsection (1) insert—

“(A1) Subsections (1) to (6) apply where a transfer to which section 73 applies takes place otherwise than in reliance on section 73(4)(aa) (transfer to processor).”

(3) In subsection (1)—

(a) omit “Where personal data is transferred in accordance with section 73,”,

(b) after “transfer” insert “—

(a)” ,

(c) for “the data” substitute “the personal data”, and

(d) at the end insert “(the ““UK authoriser”), or

(b) that—

(i) the personal data is not to be so transferred without such authorisation except where subsection (1A) applies, and

(ii) where a transfer is made without such authorisation, the UK authoriser must be informed without delay.”

(4) After subsection (1) insert—

“(1A) This subsection applies if—

(a) the transfer is necessary for the prevention of an immediate and serious threat to the public security or national security of a third country or the United Kingdom, and

(b) authorisation from the UK authoriser cannot be obtained in good time.”

(5) In subsection (2)—

(a) for “A competent authority” substitute “The UK authoriser”, and

(b) for “under subsection (1)” substitute “for the purposes of a condition described in subsection (1)”.

(6) In subsection (3), for “competent authority” substitute “UK authoriser”.

(7) In subsection (4), for “an authorisation may not be given under subsection (1)” substitute “the UK authoriser may not give an authorisation for the purposes of a condition described in subsection (1)”.

(8) In subsection (5)(a), for the words from “either” to “State” substitute “to the public security, national security or essential interests of a third country or the United Kingdom”.

(9) In subsection (6)—

(a) after “made” insert “in a case described in subsection (4)”,

(b) for “subsection (4)” substitute “that subsection (whether made with or without authorisation from the UK authoriser), the UK authoriser must, without delay, inform”, and

(c) omit “must be informed without delay”.

(10) At the end insert—

“(7) Where a transfer takes place in reliance on section 73(4)(aa) (transfer to processor), the transferring controller must make it a condition of the transfer that the data is only to be further transferred to a third country or international organisation where—

(a) the terms of any relevant contract entered into, or authorisation given, by the transferring controller in accordance with section 59 are complied with, and

(b) the further transfer satisfies the requirements in section 73(1).”

Commencement Information

I10 Sch. 8 para. 10 not in force at Royal Assent, see s. 142(1)