(2) For the heading substitute “Transfers approved by regulations: monitoring” .
(3) Omit subsections (1) and (2).
(4) In subsection (3), for “under section 74A” substitute “giving approval under section 74AA” .
(5) In subsection (4), for the words from the beginning to “otherwise,” substitute “Where the Secretary of State becomes aware that the data protection test is no longer met in relation to transfers approved, or of a description approved, in regulations under section 74AA,” .
(6) In subsection (5)—
(a) for “section 74A” substitute “section 74AA” , and
(b) for “remedying the lack of an adequate level of protection” substitute “improving the protection provided to data subjects with regard to the processing of personal data in the country or by the organisation” .
(a) omit “, territories and specified sectors within a third country”,
(b) omit “, territories, sectors”, and
(c) for “specified in regulations under section 74A” substitute “approved by regulations under section 74AA as places or persons to which personal data may be transferred” .
(c) for “specified in” substitute “approved by” .
(9) In subsection (7)—
(a) for “regulations under section 74A which specify that an adequate level of protection of personal data is ensured only for a transfer” substitute “regulations under section 74AA which approve only certain transfers to a third country or international organisation that are” ,
(b) after “the regulations” insert “(in accordance with section 74AA(4)(b))” , and
(c) omit paragraph (a) (together with the final “and”).
I353 Sch. 8 para. 5 not in force at Royal Assent, see s. 142(1)
I354 Sch. 8 para. 5 in force at 5.2.2026 by S.I. 2026/82 , reg. 2(z10)
6 (1) Section 75 (transfers on the basis of appropriate safeguards) is amended as follows.
(2) In the heading, for “on the basis of” substitute “subject to” .
(3) Omit subsection (1).
(4) After that subsection insert—
“ (1A) A transfer of personal data to a third country or an international organisation is made subject to appropriate safeguards only if—
(a) an appropriate legal instrument binds the intended recipient of the data (see subsection (4)), or
(b) the controller, acting reasonably and proportionately, considers that the data protection test is met in relation to the transfer or that type of transfer (see subsection (5)). ”
(5) In subsection (2), for “subsection (1)(b)” substitute “subsection (1A)(b) but not in reliance on section 73(4)(aa) (transfer to processor)” .
(6) In subsection (3), for “subsection (1)” substitute “this section but not in reliance on section 73(4)(aa) (transfer to processor)” .