Legislation – Data Protection Act 2018
Changes to legislation:
Data Protection Act 2018, Section 74AA is up to date with all changes known to be in force on or before 04 April 2026. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations.
Changes to Legislation
Changes and effects yet to be applied by the editorial team are only applicable when viewing the latest version or prospective version of legislation. They are therefore not accessible when viewing legislation as at a specific point in time. To view the ‘Changes to Legislation’ information for this provision return to the latest version view using the options provided in the ‘What Version’ box above.
PART 3Law enforcement processing
CHAPTER 5Transfers of personal data to third countries etc
General principles for transfers
F174AATransfers approved by regulations
(1)
For the purposes of section 73, the Secretary of State may by regulations approve transfers of personal data to—
(a)
a third country, or
(b)
an international organisation.
(2)
The Secretary of State may only make regulations under this section approving transfers to a third country or international organisation if the Secretary of State considers that the data protection test is met in relation to the transfers (see section 74AB).
(3)
In making regulations under this section, the Secretary of State may have regard to any matter which the Secretary of State considers relevant, including the desirability of facilitating transfers of personal data to and from the United Kingdom.
(4)
Regulations under this section may, among other things—
(a)
make provision by reference to a third country or international organisation specified in the regulations or a description of country or organisation;
(b)
approve all transfers of personal data to a third country or international organisation or only transfers specified or described in the regulations;
(c)
identify a transfer of personal data by any means, including by reference to—
(i)
a sector or geographic area within a third country,
(ii)
the controller or processor,
(iii)
the recipient of the personal data,
(iv)
the personal data transferred,
(v)
the means by which the transfer is made, or
(vi)
relevant legislation, schemes, lists or other arrangements or documents, as they have effect from time to time;
(d)
confer a discretion on a person.
(5)
Regulations under this section are subject to the negative resolution procedure.