[Part 3 Transfers to Third Countries and International Organisations]

[UK GDPR: adequacy decisions and adequacy regulations


(1)     On and after exit day, for the purposes of the UK GDPR and Part 2 of this Act, a transfer of personal data to a third country or an international organisation is based on adequacy regulations if, at the time of the transfer, paragraph 5 specifies, or specifies a description which includes—

(a)     in the case of a third country, the country or a relevant territory or sector within the country, or

(b)     in the case of an international organisation, the organisation.

(2)     Sub-paragraph (1) has effect subject to provision in paragraph 5 providing that only particular transfers to the country, territory, sector or organisation may rely on a particular provision of paragraph 5 for the purposes of sub-paragraph (1).

(3)     The Secretary of State may by regulations—

(a)     repeal sub-paragraphs (1) and (2) and paragraph 5;

(b)     amend paragraph 5 so as to omit a third country, territory, sector or international organisation specified, or of a description specified, in that paragraph;

(c)     amend paragraph 5 so as to replace a reference to, or description of, a third country, territory, sector or organisation with a narrower reference or description, including by specifying or describing particular transfers of personal data and making provision described in sub-paragraph (2).

(4)     Regulations under this paragraph may, among other things—

(a)     identify a transfer of personal data by any means, including by reference to the controller or processor, the recipient, the personal data transferred or the means by which the transfer

Popular documents