Data Protection Act 2018UK · 2018 c. 12
Digiphile
Data Protection Act 2018 (c. 12) – Section 75 – Transfers subject to appropriate safeguards

Sections

Section 75Transfers [F1subject to] appropriate safeguards

(1) F2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(1A) [F3 A transfer of personal data to a third country or an international organisation is made subject to appropriate safeguards only if—
  • (a)
    an appropriate legal instrument binds the intended recipient of the data (see subsection (4)), or
  • (b)
    the controller, acting reasonably and proportionately, considers that the data protection test is met in relation to the transfer or that type of transfer (see subsection (5)).]
(2) The controller must inform the [F4Commission] about the categories of data transfers that take place in reliance on [F5subsection (1A)(b) but not in reliance on section 73(4)(aa) (transfer to processor)].
(3) Where a transfer of data takes place in reliance on [F6this section but not in reliance on section 73(4)(aa) (transfer to processor)]—
  • (a)
    the transfer must be documented,
  • (b)
    the documentation must be provided to the [F7Commission] on request, and
  • (c)
    the documentation must include, in particular—
    • (i)
      the date and time of the transfer,
    • (ii)
      the name of and any other pertinent information about the recipient,
    • (iii)
      the justification for the transfer, and
    • (iv)
      a description of the personal data transferred.
(4) [F8 For the purposes of this section, a legal instrument is “appropriate”, in relation to a transfer of personal data, if—
  • (a)
    the instrument is intended to be relied on in connection with the transfer or that type of transfer,
  • (b)
    at least one competent authority is a party to the instrument, and
  • (c)
    each competent authority that is a party to the instrument, acting reasonably and proportionately, considers that the data protection test is met in relation to the transfers, or types of transfer, intended to be made in reliance on the instrument (see subsection (5)).
(5) For the purposes of this section, the data protection test is met in relation to a transfer, or a type of transfer, of personal data if, after the transfer, the standard of the protection provided for the data subject with regard to that personal data, whether by a binding legal instrument or by other means, would not be materially lower than the standard of the protection provided for the data subject with regard to the personal data by or under—
  • (a)
    this Part, and
  • (b)
    Parts 5 to 7, so far as they relate to processing by a competent authority for any of the law enforcement purposes.
(6) For the purposes of subsections (1A)(b) and (4)(c), what is reasonable and proportionate is to be determined by reference to all the circumstances, or likely circumstances, of the transfer or type of transfer, including the nature and volume of the personal data transferred.
(7) In this section, references to the protection provided for the data subject are to that protection taken as a whole.]
(8) [F9 For provision about standard data protection clauses which the [F10Commission] considers are capable of securing that the data protection test in this section is met, see section 119A.]

Amended text

This Section is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.

Annotations

Textual Amendments

  1. F1 Words in s. 75 heading substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 6(2); S.I. 2026/82, reg. 2(z10)
  2. F2 S. 75(1) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 6(3); S.I. 2026/82, reg. 2(z10)
  3. F3 S. 75(1A) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 6(4); S.I. 2026/82, reg. 2(z10)
  4. F4 Word in s. 75(2) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
  5. F5 Words in s. 75(2) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 6(5); S.I. 2026/82, reg. 2(z10)
  6. F6 Words in s. 75(3) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 6(6); S.I. 2026/82, reg. 2(z10)
  7. F7 Word in s. 75(3)(b) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
  8. F8 S. 75(4)-(7) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 6(7); S.I. 2026/82, reg. 2(z10)
  9. F9 S. 75(8) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 18 (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)
  10. F10 Word in s. 75(8) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)

Commencement Information

  1. I1 S. 75 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

https://dpa2018.digiphile.law/article/article-75.html

Text as at 18 September 2026.

This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.

Type to search the full text.