(6) After subsection (2) insert—
“ (2A) In accordance with the third data protection principle, the amount of personal data transferred in reliance on this section must not be excessive in relation to the special purpose relied on. ”
(7) In subsection (3), for “subsection (1)” substitute “this section” .
I357 Sch. 8 para. 7 not in force at Royal Assent, see s. 142(1)
I358 Sch. 8 para. 7 in force at 5.2.2026 by S.I. 2026/82 , reg. 2(z10)
Transfers to particular recipients U.K.
8 For the italic heading before section 77 substitute “Additional conditions” .
I359 Sch. 8 para. 8 not in force at Royal Assent, see s. 142(1)
I360 Sch. 8 para. 8 in force at 5.2.2026 by S.I. 2026/82 , reg. 2(z10)
9 (1) Section 77 (conditions for transfers of personal data to persons other than relevant authorities) is amended as follows. U.K.
(2) For the heading substitute “Additional conditions for transfers in reliance on section 73(4)(b)” .
(3) In subsection (6), for “other than a relevant authority” substitute “in reliance on section 73(4)(b)” .
(4) In subsection (7)(a), for “other than a relevant authority” substitute “that takes place in reliance on section 73(4)(b)” .
I361 Sch. 8 para. 9 not in force at Royal Assent, see s. 142(1)
I362 Sch. 8 para. 9 in force at 5.2.2026 by S.I. 2026/82 , reg. 2(z10)
Subsequent transfers U.K.
10 (1) Section 78 (subsequent transfers) is amended as follows.
“ (A1) Subsections (1) to (6) apply where a transfer to which section 73 applies takes place otherwise than in reliance on section 73(4)(aa) (transfer to processor). ”
(a) omit “Where personal data is transferred in accordance with section 73,”,
(b) after “transfer” insert “ —
(a)” ,
(c) for “the data” substitute “the personal data” , and
(d) at the end insert “(the “ “UK authoriser”), or
(b) that—
(i) the personal data is not to be so transferred without such authorisation except where subsection (1A) applies, and
(ii) where a transfer is made without such authorisation, the UK authoriser must be informed without delay. ”