Legislation – Data Protection Act 2018
Changes to legislation:
Data Protection Act 2018, Section 17A is up to date with all changes known to be in force on or before 04 April 2026. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations.
Changes to Legislation
Changes and effects yet to be applied by the editorial team are only applicable when viewing the latest version or prospective version of legislation. They are therefore not accessible when viewing legislation as at a specific point in time. To view the ‘Changes to Legislation’ information for this provision return to the latest version view using the options provided in the ‘What Version’ box above.
PART 2General processing
CHAPTER 2 The UK GDPR
Transfers of personal data to third countries etc
F117ATransfers based on adequacy regulations
(1)
The Secretary of State may by regulations specify any of the following which the Secretary of State considers ensures an adequate level of protection of personal data—
(a)
a third country,
(b)
a territory or one or more sectors within a third country,
(c)
an international organisation, or
(d)
a description of such a country, territory, sector or organisation.
(2)
For the purposes of the UK GDPR and this Part of this Act, a transfer of personal data to a third country or an international organisation is based on adequacy regulations if, at the time of the transfer, regulations made under this section are in force which specify, or specify a description which includes—
(a)
in the case of a third country, the country or a relevant territory or sector within the country, or
(b)
in the case of an international organisation, the organisation.
(3)
Regulations under this section may specify that the Secretary of State considers that an adequate level of protection of personal data is ensured only for a transfer specified or described in the regulations and, if they do so, only such a transfer may rely on those regulations for the purposes of subsection (2).
(4)
Article 45(2) of the UK GDPR makes provision about the assessment of the adequacy of the level of protection for the purposes of this section and section 17B.
(5)
Regulations under this section—
(a)
where they relate to a third country, must specify their territorial and sectoral application;
(b)
where applicable, must specify the independent supervisory authority or authorities referred to in Article 45(2)(b) of the UK GDPR.
(6)
Regulations under this section may, among other things—
(a)
provide that in relation to a country, territory, sector, organisation or transfer specified, or falling within a description specified, in the regulations, section 17B(1) has effect as if it required the reviews described there to be carried out at such shorter intervals as are specified in the regulations;
(b)
identify a transfer of personal data by any means, including by reference to the controller or processor, the recipient, the personal data transferred or the means by which the transfer is made or by reference to relevant legislation, lists or other documents, as they have effect from time to time;
(c)
confer a discretion on a person.
(7)
Regulations under this section are subject to the negative resolution procedure.