(c) the references to processing of personal data in the third country or by the international organisation are references only to the processing of personal data transferred to the country or organisation by means of processing to which this Regulation applies as described in Article 3.
4. When the data protection test is applied only to certain transfers to a third country or international organisation that are specified or described, or to be specified or described, in regulations (in accordance with Article 45A(4)(b))—
(a) the references in paragraphs 1 to 3 to personal data are to be read as references only to personal data likely to be the subject of such transfers, and
(b) the reference in paragraph 2(d) to transfer to other countries or international organisations is to be read as including transfer within the third country or international organisation. ”
I331 Sch. 7 para. 4 in force at Royal Assent for specified purposes, see s. 142(1)(2) (h)
I332 Sch. 7 para. 4 in force at 5.2.2026 in so far as not already in force by S.I. 2026/82 , reg. 2(z9)
Transfers approved by regulations: monitoring U.K.
5 After Article 45B (inserted by paragraph 4 ) insert—
“ Article 45C Transfers approved by regulations: monitoring
1. The Secretary of State must, on an ongoing basis, monitor developments in third countries and international organisations that could affect decisions to make regulations under Article 45A or to amend or revoke such regulations.
2. Where the Secretary of State becomes aware that the data protection test is no longer met in relation to transfers approved, or of a description approved, in regulations under Article 45A, the Secretary of State must, to the extent necessary, amend or revoke the regulations.
3. Where regulations under Article 45A are amended or revoked in accordance with paragraph 2, the Secretary of State must enter into consultations with the third country or international organisation concerned with a view to improving the protection provided to data subjects with regard to the processing of personal data in the country or by the organisation.
4. The Secretary of State must publish—
(a) a list of the third countries and international organisations, and the descriptions of such countries and organisations, which are for the time being approved by regulations under Article 45A as places or persons to which personal data may be transferred, and
(b) a list of the third countries and international organisations, and the descriptions of such countries and organisations, which have been but are no longer approved by such regulations.
5. In the case of regulations under Article 45A which approve only certain transfers to a third country or international organisation specified or described in the regulations (in accordance with Article 45A(4)(b)), the lists published under paragraph 4 must specify or describe the relevant transfers. ”
I333 Sch. 7 para. 5 not in force at Royal Assent, see s. 142(1)
I334 Sch. 7 para. 5 in force at 5.2.2026 by S.I. 2026/82 , reg. 2(z9)
Transfers subject to appropriate safeguards U.K.
6 (1) Article 46 (transfers subject to appropriate safeguards) is amended as follows.
(2) Omit paragraph 1.
(3) After that paragraph insert—
“ 1A. A transfer of personal data to a third country or an international organisation by a controller or processor is made subject to appropriate safeguards only—
(a) in a case in which—
(i) safeguards are provided in connection with the transfer as described in paragraph 2 or 3 or regulations made under Article 47A(4), and
(ii) the controller or processor, acting reasonably and proportionately, considers that the data protection test is met in relation to the transfer or that type of transfer (see paragraph 6), or