Legislation – Data (Use and Access) Act 2025

Revised legislation carried on this site may not be fully up to date. At the current time any known changes or effects made by subsequent legislation have been applied to the text of the legislation you are viewing by the editorial team. Please see ‘Frequently Asked Questions’ for details regarding the timescales for which new effects are identified and recorded on this site.

Schedules

Schedule 8Transfers of personal data to third countries etc: law enforcement processing

Subsequent transfers

10 (1)

Section 78 (subsequent transfers) is amended as follows.

(2)

Before subsection (1) insert—

“A1

Subsections (1) to (6) apply where a transfer to which section 73 applies takes place otherwise than in reliance on section 73(4)(aa) (transfer to processor).”

(3)

In subsection (1)—

(a)

omit “Where personal data is transferred in accordance with section 73,”,

(b)

after “transfer” insert “—

(a)”,

(c)

for “the data” substitute “the personal data”, and

(d)

at the end insert “(the ““UK authoriser”), or

(b)

that—

(i)

the personal data is not to be so transferred without such authorisation except where subsection (1A) applies, and

(ii)

where a transfer is made without such authorisation, the UK authoriser must be informed without delay.”

(4)

After subsection (1) insert—

“(1A)

This subsection applies if—

(a)

the transfer is necessary for the prevention of an immediate and serious threat to the public security or national security of a third country or the United Kingdom, and

(b)

authorisation from the UK authoriser cannot be obtained in good time.”

(5)

In subsection (2)—

(a)

for “A competent authority” substitute “The UK authoriser”, and

(b)

for “under subsection (1)” substitute “for the purposes of a condition described in subsection (1)”.

(6)

In subsection (3), for “competent authority” substitute “UK authoriser”.

(7)

In subsection (4), for “an authorisation may not be given under subsection (1)” substitute “the UK authoriser may not give an authorisation for the purposes of a condition described in subsection (1)”.

(8)

In subsection (5)(a), for the words from “either” to “State” substitute “to the public security, national security or essential interests of a third country or the United Kingdom”.

(9)

In subsection (6)—

(a)

after “made” insert “in a case described in subsection (4)”,

(b)

for “subsection (4)” substitute “that subsection (whether made with or without authorisation from the UK authoriser), the UK authoriser must, without delay, inform”, and

(c)

omit “must be informed without delay”.

(10)

At the end insert—

“(7)

Where a transfer takes place in reliance on section 73(4)(aa) (transfer to processor), the transferring controller must make it a condition of the transfer that the data is only to be further transferred to a third country or international organisation where—

(a)

the terms of any relevant contract entered into, or authorisation given, by the transferring controller in accordance with section 59 are complied with, and

(b)

the further transfer satisfies the requirements in section 73(1).”