OpenLegislation

Paragraph 4 UK GDPR: transfers approved by regulationsF1F5

United Kingdom

(1)

On and after IP completion day, for the purposes of the UK GDPR and Part 2 of this Act, a transfer of personal data to a third country or an international organisation is F2to be treated as approved by regulations made under Article 45A of the UK GDPR if, at the time of the transfer, paragraph 5 specifies, or specifies a description which includes—

(a)

in the case of a third country, the country or a relevant territory or sector within the country, or

(b)

in the case of an international organisation, the organisation.

(2)

Sub-paragraph (1) has effect subject to provision in paragraph 5 providing that only particular transfers to the country, territory, sector or organisation may rely on a particular provision of paragraph 5 for the purposes of sub-paragraph (1).

(3)

The Secretary of State may by regulations—

(a)

repeal sub-paragraphs (1) and (2) and paragraph 5;

(b)

amend paragraph 5 so as to omit a third country, territory, sector or international organisation specified, or of a description specified, in that paragraph;

(c)

amend paragraph 5 so as to replace a reference to, or description of, a third country, territory, sector or organisation with a narrower reference or description, including by specifying or describing particular transfers of personal data and making provision described in sub-paragraph (2).

(4)

Regulations under this paragraph may, among other things——

(a)

identify a transfer of personal data by any means, including by reference to the controller or processor, the recipient, the personal data transferred or the means by which the transfer is made or by reference to relevant legislation, F3schemes, lists or other arrangements or documents, as they have effect from time to time;

(b)

confer a discretion on a person.

(5)

Regulations under this paragraph are subject to the negative resolution procedure.

F4(6)

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Annotations

Textual amendments

F1

Sch. 21 inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 102 (with reg. 5, Sch. 3 para. 111(6)) (as amended by S.I. 2020/1586, regs. 1(2), 5(4)); 2020 c. 1, Sch. 5 para. 1(1)

F2

Words in Sch. 21 para. 4(1) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(3)(a) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

F3

Words in Sch. 21 para. 4(4)(a) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(3)(b) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

F4

Sch. 21 para. 4(6) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(3)(c) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

F5

Words in Sch. 21 para. 4 heading substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(2) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

Notes on Schedule 21

Modifications

C1

Sch. 21: power to amend conferred (19.6.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 142(2)(g), 143(2)