Paragraph 9 UK GDPR: transfers subject to appropriate safeguards provided by binding corporate rules

(1)

F1F2The requirement for safeguards to be provided under Article 46(1A)(a)(i) of the UK GDPR may be satisfied on and after IP completion day as described F3in sub-paragraphs (2) to (4), subject to sub-paragraph (5).

(2)

The safeguards may be provided for by any binding corporate rules authorised by the Commissioner which, immediately before IP completion day, provided for the appropriate safeguards referred to in Article 46(1) of the EU GDPR by virtue of Article 46(5) of the EU GDPR.

(3)

The safeguards may be provided for by a version of binding corporate rules described in sub-paragraph (2) incorporating changes where—

(a)

all of the changes are made in consequence of the withdrawal of the United Kingdom from the EU F4, of provision made by regulations under section 8 or 23 of the European Union (Withdrawal) Act 2018 F5or of the amendment of Chapter 5 of the UK GDPR by the Data (Use and Access) Act 2025, and

(b)

none of the changes alters the effect of the rules.

(4)

The following changes are to be treated as falling within sub-paragraph (3)(a) and (b)—

(a)

changing references to adequacy decisions made by the European Commission into references to equivalent provision made by regulations under section 17A or by or under paragraphs 4 to 6 of this Schedule;

(aa)

F6changing references to provision made by regulations under section 17A into references to provision made by regulations made under Article 45A of the UK GDPR;

(b)

changing references to transferring personal data outside the European Union or the European Economic Area into references to transferring personal data outside the United Kingdom.

(5)

Sub-paragraphs (2) to (4) cease to apply in relation to binding corporate rules if, on or after IP completion day, the F7Commission withdraws the authorisation of the rules (or, where sub-paragraph (3) is relied on, the authorisation of the rules mentioned in sub-paragraph (2)).

(5A)

For the purposes of sub-paragraph (2), binding corporate rules which, immediately before IP completion day, provided for the appropriate safeguards referred to in Article 46(1) of the EU GDPR by virtue of Article 46(5) of the EU GDPR but which were authorised other than by the Commissioner are to be treated as authorised by the Commissioner where—

(a)

a valid notification of the rules has been made to the Commissioner,

(b)

the Commissioner has approved them, and

(c)

that approval has not been withdrawn.

(5B)

A notification is valid if it—

(a)

is made by a controller or processor established in the United Kingdom,

(b)

is made to the Commissioner before the end of the period of 6 months beginning with IP completion day, and

(c)

includes—

(i)

the name and contact details of the data protection officer or other contact point for the controller or processor, and

(ii)

such other information as the Commissioner may reasonably require.

(5C)

Where a valid notification is made the F8Commission must, without undue delay—

(a)

decide whether or not to approve the rules, and

(b)

notify the controller or processor of that decision.

(6)

The F9Commission must keep the operation of this paragraph under review.

(7)

In this paragraph—

“adequacy decision” means a decision made on the basis of—
1. Article 45(3) of the EU GDPR, or
2. Article 25(6) of Directive 95/46/EC of the European Parliament and of the Council of 24th October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data;
“binding corporate rules” has the meaning given in Article F10“4(1)(20) of the UK GDPR.

(8)

This paragraph has effect in addition to Article 46(2) and (3) of the UK GDPR.

Annotations

Textual amendments

F1: Sch. 21 inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 102 (with reg. 5, Sch. 3 para. 111(6)) (as amended by S.I. 2020/1586, regs. 1(2), 5(4)); 2020 c. 1, Sch. 5 para. 1(1)
F2: Words in Sch. 21 para. 9(1) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(6)(a)(i) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)
F3: Word in Sch. 21 para. 9(1) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(6)(a)(ii) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)
F4: Words in Sch. 21 para. 9(3)(a) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(6)(b)(i) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)
F5: Words in Sch. 21 para. 9(3)(a) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(6)(b)(ii) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)
F6: Sch. 21 para. 9(4)(aa) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(6)(c) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)
F7: Word in Sch. 21 para. 9(5) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
F8: Word in Sch. 21 para. 9(5C) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
F9: Word in Sch. 21 para. 9(6) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
F10: Word in Sch. 21 para. 9(7) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(15); S.I. 2026/1015, reg. 2(c)