Data Protection Act 2018UK · 2018 c. 12
Digiphile
Data Protection Act 2018 (c. 12) – Section 76 – Transfers based on special circumstances

Sections

Section 76Transfers [F1based on] special circumstances

(A1) [F2 A transfer of personal data to a third country or international organisation is based on special circumstances where—
  • (a)
    it is made in the absence of approval by regulations under section 74AA and of compliance with section 75 (appropriate safeguards), and
  • (b)
    it is necessary for a special purpose.]
(1) [F3A transfer of personal data is necessary for a special purpose if it is necessary—]
  • (a)
    to protect the vital interests of the data subject or another person,
  • (b)
    to safeguard the legitimate interests of the data subject,
  • (c)
    for the prevention of an immediate and serious threat to the public security [F4or national security] of F5... a third country [F6or the United Kingdom],
  • (d)
    [F7in particular circumstances,] for any of the law enforcement purposes, or
  • (e)
    [F8in particular circumstances,] for a legal purpose.
(2) [F9But a transfer of personal data is not necessary for a special purpose by virtue of subsection (1)(d) or (e)] if the controller determines that fundamental rights and freedoms of the data subject override the public interest in the transfer.
(2A) [F10 In accordance with the third data protection principle, the amount of personal data transferred in reliance on this section must not be excessive in relation to the special purpose relied on.]
(3) Where a transfer of data takes place in reliance on [F11this section]—
  • (a)
    the transfer must be documented,
  • (b)
    the documentation must be provided to the [F12Commission] on request, and
  • (c)
    the documentation must include, in particular—
    • (i)
      the date and time of the transfer,
    • (ii)
      the name of and any other pertinent information about the recipient,
    • (iii)
      the justification for the transfer, and
    • (iv)
      a description of the personal data transferred.
(4) For the purposes of this section, a transfer is necessary for a legal purpose if—
  • (a)
    it is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings) relating to any of the law enforcement purposes,
  • (b)
    it is necessary for the purpose of obtaining legal advice in relation to any of the law enforcement purposes, or
  • (c)
    it is otherwise necessary for the purposes of establishing, exercising or defending legal rights in relation to any of the law enforcement purposes.

Amended text

This Section is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.

Annotations

Textual Amendments

  1. F1 Words in s. 76 heading substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 7(2); S.I. 2026/82, reg. 2(z10)
  2. F2 S. 76(A1) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 7(3); S.I. 2026/82, reg. 2(z10)
  3. F3 Words in s. 76(1) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 7(4)(a); S.I. 2026/82, reg. 2(z10)
  4. F4 Words in s. 76(1)(c) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 7(4)(b)(i); S.I. 2026/82, reg. 2(z10)
  5. F5 Words in s. 76(1)(c) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 43 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  6. F6 Words in s. 76(1)(c) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 7(4)(b)(ii); S.I. 2026/82, reg. 2(z10)
  7. F7 Words in s. 76(1)(d) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 7(4)(c); S.I. 2026/82, reg. 2(z10)
  8. F8 Words in s. 76(1)(e) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 7(4)(d); S.I. 2026/82, reg. 2(z10)
  9. F9 Words in s. 76(2) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 7(5); S.I. 2026/82, reg. 2(z10)
  10. F10 S. 76(2A) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 7(6); S.I. 2026/82, reg. 2(z10)
  11. F11 Words in s. 76(3) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 7(7); S.I. 2026/82, reg. 2(z10)
  12. F12 Word in s. 76(3)(b) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)

Commencement Information

  1. I1 S. 76 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

https://dpa2018.digiphile.law/article/article-76.html

Text as at 18 September 2026.

This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.

Type to search the full text.