Data Protection Act 2018

73General principles for transfers of personal data

(1)A controller may not transfer personal data to a third country or to an international organisation unless—

(a)the three conditions set out in subsections (2) to (4) are met, and

(b)in a case where the personal data was originally transmitted or otherwise made available to the controller or another competent authority by a member State other than the United Kingdom, that member State, or any person based in that member State which is a competent authority for the purposes of the Law Enforcement Directive, has authorised the transfer in accordance with the law of the member State.

(2)Condition 1 is that the transfer is necessary for any of the law enforcement purposes.

(3)Condition 2 is that the transfer—

(a)is based on an adequacy decision (see section 74),

(b)if not based on an adequacy decision, is based on there being appropriate safeguards (see section 75), or

(c)if not based on an adequacy decision or on there being appropriate safeguards, is based on special circumstances (see section 76).

(4)Condition 3 is that—

(a)the intended recipient is a relevant authority in a third country or an international organisation that is a relevant international organisation, or

(b)in a case where the controller is a competent authority specified in any of paragraphs 5 to 17, 21, 24 to 28, 34 to 51, 54 and 56 of Schedule 7—

(i)the intended recipient is a person in a third country other than a relevant authority, and

(ii)the additional conditions in section 77 are met.

(5)Authorisation is not required as mentioned in subsection (1)(b) if—

(a)the transfer is necessary for the prevention of an immediate and serious threat either to the public security of a member State or a third country or to the essential interests of a member State, and

(b)the authorisation cannot be obtained in good time.

(6)Where a transfer is made without the authorisation mentioned in subsection (1)(b), the authority in the member State which would have been responsible for deciding whether to authorise the transfer must be informed without delay.

(7)In this section, “relevant international organisation” means an international organisation that carries out functions for any of the law enforcement purposes.