# Data (Use and Access) Act 2025, Paragraph 27: The UK GDPR: transfers subject to appropriate safeguards

Extent: E+W+S+N.I.

(1) For the purposes of Article 44A(1)(a) and (2)(b) of the UK GDPR (general principles for transfers of personal data), a transfer of personal data to a third country or an international organisation made on or after the relevant day is made subject to appropriate safeguards where—
(a) the transfer is made under arrangements entered into before the relevant day,
(b) safeguards are provided in accordance with paragraph 2 or 3 of Article 46 of the UK GDPR or paragraph 9 of Schedule 21 to the 2018 Act, and
(c) if the transfer had been made immediately before the relevant day, it would have satisfied—
(i) the condition in Article 46(1) of the UK GDPR relating to data subjects’ rights and legal remedies, and
(ii) the requirements of the last sentence of Article 44 of the UK GDPR (level of protection must not be undermined).
(2) Sub-paragraph (1) has effect in addition to Article 46(1A) of the UK GDPR.
(3) In this paragraph—
“international organisation” has the same meaning as in the 2018 Act (see section 205 of that Act);
“personal data” has the same meaning as in the 2018 Act (see section 3 of that Act);
“the relevant day” means the day on which paragraph 6 of Schedule 7 to this Act comes into force;
“third country” has the same meaning as in Part 3 of the 2018 Act (see section 33 of that Act).

---
Source: https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/27 (the official version)
Page: https://openlegislation.uk/data-use-and-access-act-2025/schedule-9/paragraph-27
Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives.