Data (Use and Access) Act 2025

25 (1) Part 3 of Schedule 21 (further transitional provision etc: transfers to third countries and international organisations) is amended as follows. U.K.

(2) In the heading before paragraph 4, for “adequacy decisions and adequacy regulations” substitute “transfers approved by regulations”.

(3) In paragraph 4 (UK GDPR: adequacy decisions and adequacy regulations)—

(a) in sub-paragraph (1), for “based on adequacy regulations” substitute “to be treated as approved by regulations made under Article 45A of the UK GDPR”,

(b) in sub-paragraph (4)(a), for “lists or other” substitute “schemes, lists or other arrangements or”, and

(c) omit sub-paragraph (6).

(4) In paragraph 6 (UK GDPR: application of certain provisions referring to regulations made under section 17A of the 2018 Act)—

(a) in sub-paragraph (1)(a), for “section 17A” substitute “Article 45A of the UK GDPR”,

(b) for sub-paragraph (2) substitute—

“(2) Those provisions are Articles 13(1)(f), 14(1)(f), 45C, 49(1) and 49A(1) of the UK GDPR.”, and

(c) after that sub-paragraph insert—

“(3) In its application to transfers treated as approved by virtue of paragraph 1, Article 45C(5) of the UK GDPR (transfers approved by regulations: monitoring) has effect as if the reference to Article 45A(4)(b) were omitted.”

(5) Omit paragraphs 7 and 8 (UK GDPR: transfers subject to appropriate safeguards provided by standard data protection clauses).

(6) In paragraph 9 (UK GDPR: transfers subject to appropriate safeguards provided by binding corporate rules)—

(a) in sub-paragraph (1)—

(i) for “The appropriate safeguards referred to in Article 46(1) of the UK GDPR may be provided for” substitute “The requirement for safeguards to be provided under Article 46(1A)(a)(i) of the UK GDPR may be satisfied”, and

(ii) after “described” insert “in”,

(b) in sub-paragraph (3)(a)—

(i) for “or provision” substitute “, of provision”, and

(ii) for “(or both)” substitute “or of the amendment of Chapter 5 of the UK GDPR by the Data (Use and Access) Act 2025”, and

(c) in sub-paragraph (4), after paragraph (a) insert—

“(aa) changing references to provision made by regulations under section 17A into references to provision made by regulations made under Article 45A of the UK GDPR;”.

(7) In the heading before paragraph 10, for “adequacy decisions and adequacy regulations” substitute “transfers approved by regulations”.

(8) In paragraph 10 (law enforcement processing: adequacy decisions and adequacy regulations)—

(a) in sub-paragraph (1), for “based on adequacy regulations” substitute “to be treated as approved by regulations made under section 74AA”,

(b) in sub-paragraph (4)(a), for “lists or other” substitute “schemes, lists or other arrangements or”, and

(c) omit sub-paragraph (6).

(9) In paragraph 12 (Part 3 (law enforcement processing): application of certain provisions referring to regulations made under section 74A)—

(a) the existing text becomes sub-paragraph (1),

(b) in that sub-paragraph—

(i) for the words before paragraph (a) substitute “In sections 74B and 76(A1)—”, and

(ii) in paragraph (a), for “74A” substitute “74AA”, and

(c) after that sub-paragraph insert—

“(2) In its application to transfers treated as approved by virtue of paragraph 10, section 74B(7) (transfers approved by regulations: monitoring) has effect as if the reference to section 74AA(4)(b) were omitted.”

Commencement Information

I1 Sch. 9 para. 25 not in force at Royal Assent, see s. 142(1)

I2 Sch. 9 para. 25 in force at 5.2.2026 by S.I. 2026/82, reg. 2(z11)