(6) In subsection (5)(a), for the words from “either” to “State” substitute “to the public security, national security or essential interests of a third country or the United Kingdom” .
I349 Sch. 8 para. 3 not in force at Royal Assent, see s. 142(1)
I350 Sch. 8 para. 3 in force at 5.2.2026 by S.I. 2026/82 , reg. 2(z10)
4 (1) Omit section 74A (transfers based on adequacy regulations).
(2) After that section insert—
“ 74AA Transfers approved by regulations
(1) For the purposes of section 73, the Secretary of State may by regulations approve transfers of personal data to—
(2) The Secretary of State may only make regulations under this section approving transfers to a third country or international organisation if the Secretary of State considers that the data protection test is met in relation to the transfers (see section 74AB).
(3) In making regulations under this section, the Secretary of State may have regard to any matter which the Secretary of State considers relevant, including the desirability of facilitating transfers of personal data to and from the United Kingdom.
(4) Regulations under this section may, among other things—
(a) make provision by reference to a third country or international organisation specified in the regulations or a description of country or organisation;
(5) Regulations under this section are subject to the negative resolution procedure.
74AB The data protection test
(1) For the purposes of section 74AA, the data protection test is met in relation to transfers to a third country or international organisation if the standard of the protection provided for data subjects with regard to law enforcement processing of personal data in the country or by the organisation is not materially lower than the standard of the protection provided for data subjects by or under—
(a) this Part, and
(b) Parts 5 to 7, so far as relevant to law enforcement processing.
(2) In considering whether the data protection test is met in relation to transfers of personal data to a third country or international organisation, the Secretary of State must consider, among other things—
(3) In subsections (1) and (2)—
(b) the references to law enforcement processing are to processing by a competent authority for any of the law enforcement purposes or equivalent types of processing in the third country or by the international organisation (as appropriate), and
(c) the references to processing of personal data in the third country or by the international organisation are references only to the processing of personal data transferred to the country or organisation by means of processing to which this Act applies as described in section 207(2).
(4) When the data protection test is applied only to certain transfers to a third country or international organisation that are specified or described, or to be specified or described, in regulations (in accordance with section 74AA(4)(b))—
(a) the references in subsections (1) to (3) to personal data are to be read as references only to personal data likely to be the subject of such transfers, and
(b) the reference in subsection (2)(d) to transfer to other countries or international organisations is to be read as including transfer within the third country or international organisation. ”
I351 Sch. 8 para. 4 in force at Royal Assent for specified purposes, see s. 142(1)(2) (h)
I352 Sch. 8 para. 4 in force at 5.2.2026 in so far as not already in force by S.I. 2026/82 , reg. 2(z10)
5 (1) Section 74B (transfers based on adequacy regulations: review etc) is amended as follows.