Legislation – Data (Use and Access) Act 2025
Changes to legislation:
There are currently no known outstanding effects for the Data (Use and Access) Act 2025, Schedule 8.
Changes to Legislation
Revised legislation carried on this site may not be fully up to date. At the current time any known changes or effects made by subsequent legislation have been applied to the text of the legislation you are viewing by the editorial team. Please see ‘Frequently Asked Questions’ for details regarding the timescales for which new effects are identified and recorded on this site.
Schedule 8Transfers of personal data to third countries etc: law enforcement processing
Introduction
1
Chapter 5 of Part 3 of the 2018 Act (transfers of personal data to third countries etc) is amended as follows.
Overview and interpretation
2
In section 72 (overview and interpretation), in subsection (1)(b)—
(a)
for “the special conditions that apply” substitute “additional conditions that apply in certain cases”
, and
(b)
after “organisation” insert “(see section 73(4)(b))”
.
General principles for transfer
3
(1)
Section 73 (general principles for transfers) is amended as follows.
(2)
“A1
This section applies in relation to a transfer of personal data to a third country or international organisation for a law enforcement purpose.”
(3)
In subsection (1)—
(a)
for the words before paragraph (a) substitute “The controller in relation to the transfer must secure that the transfer takes place only if—”
,
(b)
omit the “and” at the end of paragraph (a), and
(c)
“, and—
(c)
the transfer is carried out in accordance with the other provisions of this Part.”
(4)
“(3)
Condition 2 is that the transfer—
(a)
is approved by regulations under section 74AA that are in force at the time of the transfer,
(b)
is made subject to appropriate safeguards (see section 75), or
(c)
is based on special circumstances (see section 76).”
(5)
In subsection (4)—
(a)
“(aa)
the intended recipient is a person in a third country who—
(i)
is not a person described in paragraph (a), but
(ii)
is a processor whose processing, on behalf of the controller, of the personal data transferred is governed by, or authorised in accordance with, a contract with the controller that complies with section 59,”, and
(b)
in paragraph (b)(i), for “other than a relevant authority” substitute “who is not a person described in paragraph (a) or (aa)”
.
(6)
In subsection (5)(a), for the words from “either” to “State” substitute “to the public security, national security or essential interests of a third country or the United Kingdom”
.
Transfers approved by regulations
4
(1)
Omit section 74A (transfers based on adequacy regulations).
(2)
“74AATransfers approved by regulations
(1)
For the purposes of section 73, the Secretary of State may by regulations approve transfers of personal data to—
(a)
a third country, or
(b)
an international organisation.
(2)
The Secretary of State may only make regulations under this section approving transfers to a third country or international organisation if the Secretary of State considers that the data protection test is met in relation to the transfers (see section 74AB).
(3)
In making regulations under this section, the Secretary of State may have regard to any matter which the Secretary of State considers relevant, including the desirability of facilitating transfers of personal data to and from the United Kingdom.
(4)
Regulations under this section may, among other things—
(a)
make provision by reference to a third country or international organisation specified in the regulations or a description of country or organisation;
(b)
approve all transfers of personal data to a third country or international organisation or only transfers specified or described in the regulations;
(c)
identify a transfer of personal data by any means, including by reference to—
(i)
a sector or geographic area within a third country,
(ii)
the controller or processor,
(iii)
the recipient of the personal data,
(iv)
the personal data transferred,
(v)
the means by which the transfer is made, or
(vi)
relevant legislation, schemes, lists or other arrangements or documents, as they have effect from time to time;
(d)
confer a discretion on a person.
(5)
Regulations under this section are subject to the negative resolution procedure.
74ABThe data protection test
(1)
For the purposes of section 74AA, the data protection test is met in relation to transfers to a third country or international organisation if the standard of the protection provided for data subjects with regard to law enforcement processing of personal data in the country or by the organisation is not materially lower than the standard of the protection provided for data subjects by or under—
(a)
this Part, and
(b)
Parts 5 to 7, so far as relevant to law enforcement processing.
(2)
In considering whether the data protection test is met in relation to transfers of personal data to a third country or international organisation, the Secretary of State must consider, among other things—
(a)
respect for the rule of law and for human rights in the country or by the organisation,
(b)
the existence, and powers, of an authority responsible for enforcing the protection of data subjects with regard to the processing of personal data in the country or by the organisation,
(c)
arrangements for judicial or non-judicial redress for data subjects in connection with such processing,
(d)
rules about the transfer of personal data from the country or by the organisation to other countries or international organisations,
(e)
relevant international obligations of the country or organisation, and
(f)
the constitution, traditions and culture of the country or organisation.
(3)
In subsections (1) and (2)—
(a)
the references to the protection provided for data subjects are to that protection taken as a whole,
(b)
the references to law enforcement processing are to processing by a competent authority for any of the law enforcement purposes or equivalent types of processing in the third country or by the international organisation (as appropriate), and
(c)
the references to processing of personal data in the third country or by the international organisation are references only to the processing of personal data transferred to the country or organisation by means of processing to which this Act applies as described in section 207(2).
(4)
When the data protection test is applied only to certain transfers to a third country or international organisation that are specified or described, or to be specified or described, in regulations (in accordance with section 74AA(4)(b))—
(a)
the references in subsections (1) to (3) to personal data are to be read as references only to personal data likely to be the subject of such transfers, and
(b)
the reference in subsection (2)(d) to transfer to other countries or international organisations is to be read as including transfer within the third country or international organisation.”
Transfers approved by regulations: monitoring
5
(1)
Section 74B (transfers based on adequacy regulations: review etc) is amended as follows.
(2)
For the heading substitute “Transfers approved by regulations: monitoring”
.
(3)
Omit subsections (1) and (2).
(4)
In subsection (3), for “under section 74A” substitute “giving approval under section 74AA”
.
(5)
In subsection (4), for the words from the beginning to “otherwise,” substitute “Where the Secretary of State becomes aware that the data protection test is no longer met in relation to transfers approved, or of a description approved, in regulations under section 74AA,”
.
(6)
In subsection (5)—
(a)
for “section 74A” substitute “section 74AA”
, and
(b)
for “remedying the lack of an adequate level of protection” substitute “improving the protection provided to data subjects with regard to the processing of personal data in the country or by the organisation”
.
(7)
In subsection (6)(a)—
(a)
omit “, territories and specified sectors within a third country”,
(b)
omit “, territories, sectors”, and
(c)
for “specified in regulations under section 74A” substitute “approved by regulations under section 74AA as places or persons to which personal data may be transferred”
.
(8)
In subsection (6)(b)—
(a)
omit “, territories and specified sectors within a third country”,
(b)
omit “, territories, sectors”, and
(c)
for “specified in” substitute “approved by”
.
(9)
In subsection (7)—
(a)
for “regulations under section 74A which specify that an adequate level of protection of personal data is ensured only for a transfer” substitute “regulations under section 74AA which approve only certain transfers to a third country or international organisation that are”
,
(b)
after “the regulations” insert “(in accordance with section 74AA(4)(b))”
, and
(c)
omit paragraph (a) (together with the final “and”).
Transfers subject to appropriate safeguards
6
(1)
Section 75 (transfers on the basis of appropriate safeguards) is amended as follows.
(2)
In the heading, for “on the basis of” substitute “subject to”
.
(3)
Omit subsection (1).
(4)
“(1A)
A transfer of personal data to a third country or an international organisation is made subject to appropriate safeguards only if—
(a)
an appropriate legal instrument binds the intended recipient of the data (see subsection (4)), or
(b)
the controller, acting reasonably and proportionately, considers that the data protection test is met in relation to the transfer or that type of transfer (see subsection (5)).”
(5)
In subsection (2), for “subsection (1)(b)” substitute “subsection (1A)(b) but not in reliance on section 73(4)(aa) (transfer to processor)”
.
(6)
In subsection (3), for “subsection (1)” substitute “this section but not in reliance on section 73(4)(aa) (transfer to processor)”
.
(7)
“(4)
For the purposes of this section, a legal instrument is “appropriate”, in relation to a transfer of personal data, if—
(a)
the instrument is intended to be relied on in connection with the transfer or that type of transfer,
(b)
at least one competent authority is a party to the instrument, and
(c)
each competent authority that is a party to the instrument, acting reasonably and proportionately, considers that the data protection test is met in relation to the transfers, or types of transfer, intended to be made in reliance on the instrument (see subsection (5)).
(5)
For the purposes of this section, the data protection test is met in relation to a transfer, or a type of transfer, of personal data if, after the transfer, the standard of the protection provided for the data subject with regard to that personal data, whether by a binding legal instrument or by other means, would not be materially lower than the standard of the protection provided for the data subject with regard to the personal data by or under—
(a)
this Part, and
(b)
Parts 5 to 7, so far as they relate to processing by a competent authority for any of the law enforcement purposes.
(6)
For the purposes of subsections (1A)(b) and (4)(c), what is reasonable and proportionate is to be determined by reference to all the circumstances, or likely circumstances, of the transfer or type of transfer, including the nature and volume of the personal data transferred.
(7)
In this section, references to the protection provided for the data subject are to that protection taken as a whole.”
Transfers based on special circumstances
7
(1)
Section 76 (transfers on the basis of special circumstances) is amended as follows.
(2)
In the heading, for “on the basis of” substitute “based on”
.
(3)
“A1
A transfer of personal data to a third country or international organisation is based on special circumstances where—
(a)
it is made in the absence of approval by regulations under section 74AA and of compliance with section 75 (appropriate safeguards), and
(b)
it is necessary for a special purpose.”
(4)
In subsection (1)—
(a)
for the words before paragraph (a) substitute “A transfer of personal data is necessary for a special purpose if it is necessary—”
,
(b)
in paragraph (c)—
(i)
after “public security” insert “or national security”
, and
(ii)
at the end insert “or the United Kingdom”
,
(c)
in paragraph (d), for “in individual cases” substitute “in particular circumstances,”
, and
(d)
in paragraph (e), for “in individual cases” substitute “in particular circumstances,”
.
(5)
In subsection (2), for “But subsection (1)(d) and (e) do not apply” substitute “But a transfer of personal data is not necessary for a special purpose by virtue of subsection (1)(d) or (e)”
.
(6)
“(2A)
In accordance with the third data protection principle, the amount of personal data transferred in reliance on this section must not be excessive in relation to the special purpose relied on.”
(7)
In subsection (3), for “subsection (1)” substitute “this section”
.
Transfers to particular recipients
8
For the italic heading before section 77 substitute “Additional conditions”
.
9
(1)
Section 77 (conditions for transfers of personal data to persons other than relevant authorities) is amended as follows.
(2)
For the heading substitute “Additional conditions for transfers in reliance on section 73(4)(b)”
.
(3)
In subsection (6), for “other than a relevant authority” substitute “in reliance on section 73(4)(b)”
.
(4)
In subsection (7)(a), for “other than a relevant authority” substitute “that takes place in reliance on section 73(4)(b)”
.
Subsequent transfers
10
(1)
Section 78 (subsequent transfers) is amended as follows.
(2)
“A1
Subsections (1) to (6) apply where a transfer to which section 73 applies takes place otherwise than in reliance on section 73(4)(aa) (transfer to processor).”
(3)
In subsection (1)—
(a)
omit “Where personal data is transferred in accordance with section 73,”,
(b)
“—
(a)”,
(c)
for “the data” substitute “the personal data”
, and
(d)
““UK authoriser”), or
(b)
that—
(i)
the personal data is not to be so transferred without such authorisation except where subsection (1A) applies, and
(ii)
where a transfer is made without such authorisation, the UK authoriser must be informed without delay.”
(4)
“(1A)
This subsection applies if—
(a)
the transfer is necessary for the prevention of an immediate and serious threat to the public security or national security of a third country or the United Kingdom, and
(b)
authorisation from the UK authoriser cannot be obtained in good time.”
(5)
In subsection (2)—
(a)
for “A competent authority” substitute “The UK authoriser”
, and
(b)
for “under subsection (1)” substitute “for the purposes of a condition described in subsection (1)”
.
(6)
In subsection (3), for “competent authority” substitute “UK authoriser”
.
(7)
In subsection (4), for “an authorisation may not be given under subsection (1)” substitute “the UK authoriser may not give an authorisation for the purposes of a condition described in subsection (1)”
.
(8)
In subsection (5)(a), for the words from “either” to “State” substitute “to the public security, national security or essential interests of a third country or the United Kingdom”
.
(9)
In subsection (6)—
(a)
after “made” insert “in a case described in subsection (4)”
,
(b)
for “subsection (4)” substitute “that subsection (whether made with or without authorisation from the UK authoriser), the UK authoriser must, without delay, inform”
, and
(c)
omit “must be informed without delay”.
(10)
“(7)
Where a transfer takes place in reliance on section 73(4)(aa) (transfer to processor), the transferring controller must make it a condition of the transfer that the data is only to be further transferred to a third country or international organisation where—
(a)
the terms of any relevant contract entered into, or authorisation given, by the transferring controller in accordance with section 59 are complied with, and
(b)
the further transfer satisfies the requirements in section 73(1).”