Data Protection Act 2018UK · 2018 c. 12
Digiphile
Data Protection Act 2018 (c. 12) – Section 120 – Further international role

Sections

Section 120Further international role

(1) The [F1Commission] must, in relation to third countries and international organisations, take appropriate steps to—
  • (a)
    develop international co-operation mechanisms to facilitate the effective enforcement of legislation for the protection of personal data;
  • (b)
    provide international mutual assistance in the enforcement of legislation for the protection of personal data, subject to appropriate safeguards for the protection of personal data and F2... fundamental rights and freedoms;
  • (c)
    engage relevant stakeholders in discussion and activities aimed at furthering international co-operation in the enforcement of legislation for the protection of personal data;
  • (d)
    promote the exchange and documentation of legislation and practice for the protection of personal data, including legislation and practice relating to jurisdictional conflicts with third countries.
(2) Subsection (1) applies only in connection with the processing of personal data to which the [F3UK GDPR] does not apply; for the equivalent duty in connection with the processing of personal data to which the [F3UK GDPR] applies, see Article 50 of the [F3UK GDPR] (international co-operation for the protection of personal data).
(2A) [F4 The [F5Commission] may contribute to the activities of international organisations with data protection functions.]
(3) The [F6Commission] must carry out data protection functions which the Secretary of State directs the [F6Commission] to carry out for the purpose of enabling Her Majesty's Government in the United Kingdom to give effect to an international obligation of the United Kingdom.
(4) The [F6Commission] may provide an authority carrying out data protection functions under the law of a British overseas territory with assistance in carrying out those functions.
(5) The Secretary of State may direct that assistance under subsection (4) is to be provided on terms, including terms as to payment, specified or approved by the Secretary of State.
(6) In this section—
  • “data protection functions” means functions relating to the protection of individuals with respect to the processing of personal data;
  • “mutual assistance in the enforcement of legislation for the protection of personal data” includes assistance in the form of notification, complaint referral, investigative assistance and information exchange;
  • “third country” means a country or territory [F7outside the United Kingdom].
(7) Section 3(14)(c) does not apply to references to personal data and the processing of personal data in this section.

Amended text

This Section is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.

Annotations

Textual Amendments

  1. F1 Word in s. 120(1) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
  2. F2 Word in s. 120(1)(b) omitted (31.12.2023 immediately before the end of 2023) by virtue of The Data Protection (Fundamental Rights and Freedoms) (Amendment) Regulations 2023 (S.I. 2023/1417), regs. 1(2), 3(2)
  3. F3 Words in s. 120(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 52(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  4. F4 S. 120(2A) inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 52(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  5. F5 Word in s. 120(2A) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
  6. F6 Word in s. 120(3)(4) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
  7. F7 Words in s. 120(6) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 52(4) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

Commencement Information

  1. I1 S. 120 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

https://dpa2018.digiphile.law/article/article-120.html

Text as at 18 September 2026.

This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.

Type to search the full text.