Data Protection Act 2018UK · 2018 c. 12
Digiphile
Data Protection Act 2018 (c. 12) – Section 78 – Subsequent transfers

Sections

Section 78Subsequent transfers

(A1) [F1 Subsections (1) to (6) apply where a transfer to which section 73 applies takes place otherwise than in reliance on section 73(4)(aa) (transfer to processor).]
(1) F2... The transferring controller must make it a condition of the transfer [F3—
  • (a)
    ] that [F4the personal data] is not to be further transferred to a third country or international organisation without the authorisation of the transferring controller or another competent authority [F5(the “UK authoriser”), or
  • (b)
    that—
    • (i)
      the personal data is not to be so transferred without such authorisation except where subsection (1A) applies, and
    • (ii)
      where a transfer is made without such authorisation, the UK authoriser must be informed without delay.]
(1A) [F6 This subsection applies if—
  • (a)
    the transfer is necessary for the prevention of an immediate and serious threat to the public security or national security of a third country or the United Kingdom, and
  • (b)
    authorisation from the UK authoriser cannot be obtained in good time.]
(2) [F7The UK authoriser] may give an authorisation [F8for the purposes of a condition described in subsection (1)] only where the further transfer is necessary for a law enforcement purpose.
(3) In deciding whether to give the authorisation, the [F9UK authoriser] must take into account (among any other relevant factors)—
  • (a)
    the seriousness of the circumstances leading to the request for authorisation,
  • (b)
    the purpose for which the personal data was originally transferred, and
  • (c)
    the standards for the protection of personal data that apply in the third country or international organisation to which the personal data would be transferred.
(4) In a case where the personal data was originally transmitted or otherwise made available to the transferring controller or another competent authority by a member State F10..., [F11the UK authoriser may not give an authorisation for the purposes of a condition described in subsection (1)] unless that member State, or any person based in that member State which is a competent authority for the purposes of the Law Enforcement Directive, has authorised the transfer in accordance with the law of the member State.
(5) Authorisation is not required as mentioned in subsection (4) if—
  • (a)
    the transfer is necessary for the prevention of an immediate and serious threat [F12to the public security, national security or essential interests of a third country or the United Kingdom], and
  • (b)
    the authorisation cannot be obtained in good time.
(6) Where a transfer is made [F13in a case described in subsection (4)] without the authorisation mentioned in [F14that subsection (whether made with or without authorisation from the UK authoriser), the UK authoriser must, without delay, inform], the authority in the member State which would have been responsible for deciding whether to authorise the transfer F15....
(7) [F16 Where a transfer takes place in reliance on section 73(4)(aa) (transfer to processor), the transferring controller must make it a condition of the transfer that the data is only to be further transferred to a third country or international organisation where—
  • (a)
    the terms of any relevant contract entered into, or authorisation given, by the transferring controller in accordance with section 59 are complied with, and
  • (b)
    the further transfer satisfies the requirements in section 73(1).]

Amended text

This Section is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.

Annotations

Textual Amendments

  1. F1 S. 78(A1) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 10(2); S.I. 2026/82, reg. 2(z10)
  2. F2 Words in s. 78(1) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 10(3)(a); S.I. 2026/82, reg. 2(z10)
  3. F3 Word in s. 78(1) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 10(3)(b); S.I. 2026/82, reg. 2(z10)
  4. F4 Words in s. 78(1) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 10(3)(c); S.I. 2026/82, reg. 2(z10)
  5. F5 Words in s. 78(1) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 10(3)(d); S.I. 2026/82, reg. 2(z10)
  6. F6 S. 78(1A) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 10(4); S.I. 2026/82, reg. 2(z10)
  7. F7 Words in s. 78(2) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 10(5)(a); S.I. 2026/82, reg. 2(z10)
  8. F8 Words in s. 78(2) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 10(5)(b); S.I. 2026/82, reg. 2(z10)
  9. F9 Words in s. 78(3) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 10(6); S.I. 2026/82, reg. 2(z10)
  10. F10 Words in s. 78(4) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 45(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  11. F11 Words in s. 78(4) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 10(7); S.I. 2026/82, reg. 2(z10)
  12. F12 Words in s. 78(5)(a) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 10(8); S.I. 2026/82, reg. 2(z10)
  13. F13 Words in s. 78(6) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 10(9)(a); S.I. 2026/82, reg. 2(z10)
  14. F14 Words in s. 78(6) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 10(9)(b); S.I. 2026/82, reg. 2(z10)
  15. F15 Words in s. 78(6) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 10(9)(c); S.I. 2026/82, reg. 2(z10)
  16. F16 S. 78(7) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 10(10); S.I. 2026/82, reg. 2(z10)

Commencement Information

  1. I1 S. 78 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

https://dpa2018.digiphile.law/article/article-78.html

Text as at 18 September 2026.

This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.

Type to search the full text.