Data (Use and Access) Act 2025

Transfers subject to appropriate safeguards U.K.

6 (1) Section 75 (transfers on the basis of appropriate safeguards) is amended as follows.

(2) In the heading, for “on the basis of” substitute “subject to”.

(3) Omit subsection (1).

(4) After that subsection insert—

“(1A) A transfer of personal data to a third country or an international organisation is made subject to appropriate safeguards only if—

(a) an appropriate legal instrument binds the intended recipient of the data (see subsection (4)), or

(b) the controller, acting reasonably and proportionately, considers that the data protection test is met in relation to the transfer or that type of transfer (see subsection (5)).”

(5) In subsection (2), for “subsection (1)(b)” substitute “subsection (1A)(b) but not in reliance on section 73(4)(aa) (transfer to processor)”.

(6) In subsection (3), for “subsection (1)” substitute “this section but not in reliance on section 73(4)(aa) (transfer to processor)”.

(7) At the end insert—

“(4) For the purposes of this section, a legal instrument is “appropriate”, in relation to a transfer of personal data, if—

(a) the instrument is intended to be relied on in connection with the transfer or that type of transfer,

(b) at least one competent authority is a party to the instrument, and

(c) each competent authority that is a party to the instrument, acting reasonably and proportionately, considers that the data protection test is met in relation to the transfers, or types of transfer, intended to be made in reliance on the instrument (see subsection (5)).

(5) For the purposes of this section, the data protection test is met in relation to a transfer, or a type of transfer, of personal data if, after the transfer, the standard of the protection provided for the data subject with regard to that personal data, whether by a binding legal instrument or by other means, would not be materially lower than the standard of the protection provided for the data subject with regard to the personal data by or under—

(a) this Part, and

(b) Parts 5 to 7, so far as they relate to processing by a competent authority for any of the law enforcement purposes.

(6) For the purposes of subsections (1A)(b) and (4)(c), what is reasonable and proportionate is to be determined by reference to all the circumstances, or likely circumstances, of the transfer or type of transfer, including the nature and volume of the personal data transferred.

(7) In this section, references to the protection provided for the data subject are to that protection taken as a whole.”

Commencement Information

I1 Sch. 8 para. 6 not in force at Royal Assent, see s. 142(1)

I2 Sch. 8 para. 6 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z10)