Legislation – Data Protection Act 2018
Changes to legislation:
Data Protection Act 2018, Section 75 is up to date with all changes known to be in force on or before 02 April 2026. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations.
Changes to Legislation
Changes and effects yet to be applied by the editorial team are only applicable when viewing the latest version or prospective version of legislation. They are therefore not accessible when viewing legislation as at a specific point in time. To view the ‘Changes to Legislation’ information for this provision return to the latest version view using the options provided in the ‘What Version’ box above.
PART 3Law enforcement processing
CHAPTER 5Transfers of personal data to third countries etc
General principles for transfers
75Transfers on the basis of appropriate safeguards
(1)
A transfer of personal data to a third country or an international organisation is based on there being appropriate safeguards where—
(a)
a legal instrument containing appropriate safeguards for the protection of personal data binds the intended recipient of the data, or
(b)
the controller, having assessed all the circumstances surrounding transfers of that type of personal data to the third country or international organisation, concludes that appropriate safeguards exist to protect the data.
(2)
The controller must inform the Commissioner about the categories of data transfers that take place in reliance on subsection (1)(b).
(3)
Where a transfer of data takes place in reliance on subsection (1)—
(a)
the transfer must be documented,
(b)
the documentation must be provided to the Commissioner on request, and
(c)
the documentation must include, in particular—
(i)
the date and time of the transfer,
(ii)
the name of and any other pertinent information about the recipient,
(iii)
the justification for the transfer, and
(iv)
a description of the personal data transferred.