(7) At the end insert—
“ (4) For the purposes of this section, a legal instrument is “ appropriate ”, in relation to a transfer of personal data, if—
(a) the instrument is intended to be relied on in connection with the transfer or that type of transfer,
(b) at least one competent authority is a party to the instrument, and
(c) each competent authority that is a party to the instrument, acting reasonably and proportionately, considers that the data protection test is met in relation to the transfers, or types of transfer, intended to be made in reliance on the instrument (see subsection (5)).
(5) For the purposes of this section, the data protection test is met in relation to a transfer, or a type of transfer, of personal data if, after the transfer, the standard of the protection provided for the data subject with regard to that personal data, whether by a binding legal instrument or by other means, would not be materially lower than the standard of the protection provided for the data subject with regard to the personal data by or under—
(b) Parts 5 to 7, so far as they relate to processing by a competent authority for any of the law enforcement purposes.
(6) For the purposes of subsections (1A)(b) and (4)(c), what is reasonable and proportionate is to be determined by reference to all the circumstances, or likely circumstances, of the transfer or type of transfer, including the nature and volume of the personal data transferred.
(7) In this section, references to the protection provided for the data subject are to that protection taken as a whole. ”
I355 Sch. 8 para. 6 not in force at Royal Assent, see s. 142(1)
I356 Sch. 8 para. 6 in force at 5.2.2026 by S.I. 2026/82 , reg. 2(z10)
Transfers based on special circumstances U.K.
7 (1) Section 76 (transfers on the basis of special circumstances) is amended as follows.
(2) In the heading, for “on the basis of” substitute “based on” .
(3) Before subsection (1) insert—
“ (A1) A transfer of personal data to a third country or international organisation is based on special circumstances where—
(a) it is made in the absence of approval by regulations under section 74AA and of compliance with section 75 (appropriate safeguards), and
(b) it is necessary for a special purpose. ”
(4) In subsection (1)—
(a) for the words before paragraph (a) substitute “A transfer of personal data is necessary for a special purpose if it is necessary—” ,
(b) in paragraph (c)—
(i) after “public security” insert “or national security” , and
(ii) at the end insert “or the United Kingdom” ,
(c) in paragraph (d), for “in individual cases” substitute “in particular circumstances,” , and
(d) in paragraph (e), for “in individual cases” substitute “in particular circumstances,” .
(5) In subsection (2), for “But subsection (1)(d) and (e) do not apply” substitute “But a transfer of personal data is not necessary for a special purpose by virtue of subsection (1)(d) or (e)” .