Legislation – Data (Use and Access) Act 2025
Schedule 9Transfers of personal data to third countries etc: minor and consequential amendments and transitional provision
Part 1Minor and consequential amendments
The UK GDPR
1
The UK GDPR is amended as follows.
2
In Article 13(1)(f) (information to be provided where personal data is collected from the data subject)—
(a)
for “adequacy regulations under section 17A of the 2018 Act” substitute “regulations under Article 45A”
, and
(b)
for “reference to the appropriate or suitable safeguards” substitute “the safeguards relied on”
.
3
In Article 14(1)(f) (information to be provided where personal data is not obtained from the data subject)—
(a)
for “adequacy regulations under section 17A of the 2018 Act” substitute “regulations under Article 45A”
, and
(b)
for “reference to the appropriate or suitable safeguards” substitute “the safeguards relied on”
.
4
In Article 15(2) (right of access by the data subject)—
(a)
after “organisation” insert “in reliance on Article 46”
, and
(b)
for “appropriate safeguards pursuant to Article 46 relating to” substitute “safeguards provided in accordance with Article 46(1A)(a)(i) or (b)(i) for the purposes of”
.
5
(1)
Article 40 (codes of conduct) is amended as follows.
(2)
In paragraph 3 omit “appropriate” in both places.
(3)
In paragraph 5, for “provides sufficient appropriate safeguards” substitute “is capable of providing safeguards for the purposes of Article 46”
.
6
In Article 42(2) (certification) omit “appropriate” in both places.
7
In Article 46(2)(d) (transfers subject to appropriate safeguards: standard data protection clauses), after “Commissioner” insert “for the purposes of this Article”
.
8
In Article 57(1) (Commissioner’s tasks)—
(a)
in point (m) omit “which provide sufficient safeguards,”, and
(b)
“(sa)
provide authorisation required under regulations made under Article 47A;”.
9
“(k)
to provide authorisation required under regulations made under Article 47A”.
10
In Article 83(5)(c) (general conditions for imposing administrative fines), for “44” substitute “44A”
.
The 2018 Act
11
The 2018 Act is amended as follows.
12
Omit section 17A (transfers based on adequacy regulations) and the italic heading before it.
13
Omit section 17B (transfers based on adequacy regulations: review etc).
14
Omit section 17C (standard data protection clauses).
15
Omit section 18 (transfers of personal data to third countries etc: public interest).
16
In section 24(2) (manual unstructured data held by FOI public authorities)—
(a)
in paragraph (c), for “44 to 49” substitute “44A to 49A”
, and
(b)
omit paragraph (ca).
17
In section 26(2) (national security and defence exemption), omit paragraph (fa).
18
“(8)
For provision about standard data protection clauses which the Commissioner considers are capable of securing that the data protection test in this section is met, see section 119A.”
19
“(ia)
section 119A (standard clauses for transfers to third countries);”.
20
(1)
Section 119A (power of Commissioner to specify standard clauses for transfers to third countries etc providing appropriate safeguards) is amended as follows.
(2)
In subsection (1), for the words from “provide” to the end substitute “are capable of securing that the data protection test set out in Article 46 of the UK GDPR or section 75 of this Act (or both) is met in relation to transfers of personal data”
.
(3)
“(aa)
may make provision generally or in relation to types of transfer described in the document,”.
21
In section 149(2)(e) (enforcement notices), for “44 to 49” substitute “44A to 49A”
.
22
(1)
Section 182 (regulations and consultation) is amended as follows.
(2)
Omit subsection (4).
(3)
In subsection (6), for “Where regulations under this Act” substitute “For the purposes of this Act, where regulations”
.
(4)
In subsection (7), for “Where regulations under this Act” substitute “For the purposes of this Act, where regulations”
.
(5)
In subsection (8)—
(a)
for “Where regulations under this Act” substitute “For the purposes of this Act, regulations”
,
(b)
after “procedure”” insert “if”
,
(c)
in paragraph (a), for “the urgency” substitute “an urgency”
, and
(d)
in paragraph (b), for “the period of 120 days” substitute “a period”
.
(6)
Omit subsections (9) and (10).
(7)
In subsection (11), after “by regulations” insert “made under this Act or another enactment that are”
.
(8)
“(14)
For the purposes of this section, an urgency statement is a reasoned statement that the Secretary of State considers it desirable for regulations to come into force without delay.”
23
In section 205(2)(e) (references to periods of time) omit “and (9)”.
24
In paragraph 26(9)(d) of Schedule 2 (exemptions etc for journalistic, academic, artistic and literary purposes), for “44” substitute “44A”
.
25
(1)
Part 3 of Schedule 21 (further transitional provision etc: transfers to third countries and international organisations) is amended as follows.
(2)
In the heading before paragraph 4, for “adequacy decisions and adequacy regulations” substitute “transfers approved by regulations”
.
(3)
In paragraph 4 (UK GDPR: adequacy decisions and adequacy regulations)—
(a)
in sub-paragraph (1), for “based on adequacy regulations” substitute “to be treated as approved by regulations made under Article 45A of the UK GDPR”
,
(b)
in sub-paragraph (4)(a), for “lists or other” substitute “schemes, lists or other arrangements or”
, and
(c)
omit sub-paragraph (6).
(4)
In paragraph 6 (UK GDPR: application of certain provisions referring to regulations made under section 17A of the 2018 Act)—
(a)
in sub-paragraph (1)(a), for “section 17A” substitute “Article 45A of the UK GDPR”
,
(b)
“(2)
Those provisions are Articles 13(1)(f), 14(1)(f), 45C, 49(1) and 49A(1) of the UK GDPR.”, and
(c)
“(3)
In its application to transfers treated as approved by virtue of paragraph 1, Article 45C(5) of the UK GDPR (transfers approved by regulations: monitoring) has effect as if the reference to Article 45A(4)(b) were omitted.”
(5)
Omit paragraphs 7 and 8 (UK GDPR: transfers subject to appropriate safeguards provided by standard data protection clauses).
(6)
In paragraph 9 (UK GDPR: transfers subject to appropriate safeguards provided by binding corporate rules)—
(a)
in sub-paragraph (1)—
(i)
for “The appropriate safeguards referred to in Article 46(1) of the UK GDPR may be provided for” substitute “The requirement for safeguards to be provided under Article 46(1A)(a)(i) of the UK GDPR may be satisfied”
, and
(ii)
after “described” insert “in”
,
(b)
in sub-paragraph (3)(a)—
(i)
for “or provision” substitute “, of provision”
, and
(ii)
for “(or both)” substitute “or of the amendment of Chapter 5 of the UK GDPR by the Data (Use and Access) Act 2025”
, and
(c)
“(aa)
changing references to provision made by regulations under section 17A into references to provision made by regulations made under Article 45A of the UK GDPR;”.
(7)
In the heading before paragraph 10, for “adequacy decisions and adequacy regulations” substitute “transfers approved by regulations”
.
(8)
In paragraph 10 (law enforcement processing: adequacy decisions and adequacy regulations)—
(a)
in sub-paragraph (1), for “based on adequacy regulations” substitute “to be treated as approved by regulations made under section 74AA”
,
(b)
in sub-paragraph (4)(a), for “lists or other” substitute “schemes, lists or other arrangements or”
, and
(c)
omit sub-paragraph (6).
(9)
In paragraph 12 (Part 3 (law enforcement processing): application of certain provisions referring to regulations made under section 74A)—
(a)
the existing text becomes sub-paragraph (1),
(b)
in that sub-paragraph—
(i)
for the words before paragraph (a) substitute “In sections 74B and 76(A1)—”
, and
(ii)
in paragraph (a), for “74A” substitute “74AA”
, and
(c)
“(2)
In its application to transfers treated as approved by virtue of paragraph 10, section 74B(7) (transfers approved by regulations: monitoring) has effect as if the reference to section 74AA(4)(b) were omitted.”
Part 2Transitional provision
The UK GDPR: transfers approved by regulations
26
(1)
Regulations made under section 17A of the 2018 Act (transfers based on adequacy regulations) and in force immediately before the relevant day are to be treated, on and after that day, as if made under Article 45A of the UK GDPR (inserted by Schedule 7 to this Act).
(2)
The UK GDPR: transfers subject to appropriate safeguards
27
(1)
For the purposes of Article 44A(1)(a) and (2)(b) of the UK GDPR (general principles for transfers of personal data), a transfer of personal data to a third country or an international organisation made on or after the relevant day is made subject to appropriate safeguards where—
(a)
the transfer is made under arrangements entered into before the relevant day,
(b)
safeguards are provided in accordance with paragraph 2 or 3 of Article 46 of the UK GDPR or paragraph 9 of Schedule 21 to the 2018 Act, and
(c)
if the transfer had been made immediately before the relevant day, it would have satisfied—
(i)
the condition in Article 46(1) of the UK GDPR relating to data subjects’ rights and legal remedies, and
(ii)
the requirements of the last sentence of Article 44 of the UK GDPR (level of protection must not be undermined).
(2)
Sub-paragraph (1) has effect in addition to Article 46(1A) of the UK GDPR.
(3)
In this paragraph—
“international organisation” has the same meaning as in the 2018 Act (see section 205 of that Act);
“personal data” has the same meaning as in the 2018 Act (see section 3 of that Act);
“third country” has the same meaning as in Part 3 of the 2018 Act (see section 33 of that Act).
The UK GDPR: transfers subject to appropriate safeguards provided by standard data protection clauses
28
(1)
Regulations made under section 17C of the 2018 Act (standard data protection clauses) and in force immediately before the relevant day are to be treated, on and after that day, as if made under Article 47A(1) of the UK GDPR (inserted by Schedule 7 to this Act).
(2)
29
(1)
This paragraph applies to a requirement for safeguards to be provided under—
(a)
Article 46(1A)(a)(i) of the UK GDPR, or
(b)
paragraph 27(1)(b) of this Schedule.
(2)
The requirement may be satisfied on and after the relevant day by a version of pre-commencement standard clauses incorporating changes where—
(a)
all of the changes are made in consequence of the amendment of Chapter 5 of the UK GDPR by this Act, and
(b)
none of the changes alters the effect of the clauses.
(3)
Changing a reference to regulations under section 17A of the 2018 Act into a reference to regulations made under Article 45A of the UK GDPR is to be treated as a change falling within sub-paragraph (2).
(4)
(a)
the clauses are specified in regulations and a provision of the regulations relating to the clauses is amended or revoked on or after the relevant day, or
(b)
the clauses are specified in another document and a provision of the document relating to the clauses is amended or withdrawn by the Information Commissioner on or after the relevant day.
(5)
Sub-paragraph (2) has effect in addition to Article 46(2) and (3) of the UK GDPR.
(6)
In this paragraph—
“pre-commencement standard clauses” means standard data protection clauses specified in—
(a)
regulations made under section 17C of the 2018 Act and in force immediately before the relevant day, or
(b)
a document issued by the Information Commissioner under section 119A of the 2018 Act before the relevant day and not withdrawn before that day;
The UK GDPR: transfers necessary for important reasons of public interest
30
(1)
Regulations made under section 18(1) of the 2018 Act (transfers necessary for important reasons of public interest) and in force immediately before the relevant day are to be treated, on and after that day, as if made under Article 49(4A) of the UK GDPR (inserted by Schedule 7 to this Act).
(2)
In this paragraph, “the relevant day” means the day on which paragraph 9(5) of Schedule 7 to this Act comes into force.
The UK GDPR: restrictions on transfers of personal data to third countries and international organisations
31
(1)
Regulations made under section 18(2) of the 2018 Act (restrictions on transfers of personal data to third countries and international organisations) and in force immediately before the relevant day are to be treated, on and after that day, as if made under Article 49A of the UK GDPR (inserted by Schedule 7 to this Act).
(2)
Part 3 of the 2018 Act (law enforcement processing): transfers approved by regulations
32
(1)
(2)
Part 3 of the 2018 Act (law enforcement processing): transfers subject to appropriate safeguards
33
(1)
For the purposes of section 73(3) of the 2018 Act (general principles for transfers of personal data), a transfer of personal data to a third country or an international organisation made on or after the relevant day is a transfer made subject to appropriate safeguards where—
(a)
an appropriate pre-commencement legal instrument binds the intended recipient of the data, and
(b)
if the transfer had been made immediately before the relevant day, the requirement in section 75(1)(a) of the 2018 Act (binding legal instrument containing appropriate safeguards) would have been satisfied by virtue of that instrument.
(2)
(3)
For the purposes of sub-paragraph (1), a legal instrument is an “appropriate pre-commencement legal instrument”, in relation to a transfer of personal data, if—
(a)
it was entered into before the relevant day,
(b)
it is intended to be relied on in connection with the transfer or that type of transfer, and
(c)
at least one competent authority is a party to the instrument.
(4)
In this paragraph—
“competent authority” has the same meaning as in Part 3 of the 2018 Act (see section 30 of that Act);
“international organisation” has the same meaning as in the 2018 Act (see section 205 of that Act);
“personal data” has the same meaning as in the 2018 Act (see section 3 of that Act);
“third country” has the same meaning as in Part 3 of the 2018 Act (see section 33 of that Act).