Legislation – Data (Use and Access) Act 2025

Revised legislation carried on this site may not be fully up to date. At the current time any known changes or effects made by subsequent legislation have been applied to the text of the legislation you are viewing by the editorial team. Please see ‘Frequently Asked Questions’ for details regarding the timescales for which new effects are identified and recorded on this site.

Schedules

Schedule 8Transfers of personal data to third countries etc: law enforcement processing

Transfers subject to appropriate safeguards

6 (1)

Section 75 (transfers on the basis of appropriate safeguards) is amended as follows.

(2)

In the heading, for “on the basis of” substitute “subject to”.

(3)

Omit subsection (1).

(4)

After that subsection insert—

“(1A)

A transfer of personal data to a third country or an international organisation is made subject to appropriate safeguards only if—

(a)

an appropriate legal instrument binds the intended recipient of the data (see subsection (4)), or

(b)

the controller, acting reasonably and proportionately, considers that the data protection test is met in relation to the transfer or that type of transfer (see subsection (5)).”

(5)

In subsection (2), for “subsection (1)(b)” substitute “subsection (1A)(b) but not in reliance on section 73(4)(aa) (transfer to processor)”.

(6)

In subsection (3), for “subsection (1)” substitute “this section but not in reliance on section 73(4)(aa) (transfer to processor)”.

(7)

At the end insert—

“(4)

For the purposes of this section, a legal instrument is “appropriate”, in relation to a transfer of personal data, if—

(a)

the instrument is intended to be relied on in connection with the transfer or that type of transfer,

(b)

at least one competent authority is a party to the instrument, and

(c)

each competent authority that is a party to the instrument, acting reasonably and proportionately, considers that the data protection test is met in relation to the transfers, or types of transfer, intended to be made in reliance on the instrument (see subsection (5)).

(5)

For the purposes of this section, the data protection test is met in relation to a transfer, or a type of transfer, of personal data if, after the transfer, the standard of the protection provided for the data subject with regard to that personal data, whether by a binding legal instrument or by other means, would not be materially lower than the standard of the protection provided for the data subject with regard to the personal data by or under—

(a)

this Part, and

(b)

Parts 5 to 7, so far as they relate to processing by a competent authority for any of the law enforcement purposes.

(6)

For the purposes of subsections (1A)(b) and (4)(c), what is reasonable and proportionate is to be determined by reference to all the circumstances, or likely circumstances, of the transfer or type of transfer, including the nature and volume of the personal data transferred.

(7)

In this section, references to the protection provided for the data subject are to that protection taken as a whole.”