Data Protection Act 2018

• Permanent Page URL

Chapter 5

Transfers of personal data to third countries or international organisations

Transfer to third country or international organisation

96. (1) The transfer of personal data to a third country or an international organisation shall not take place, subject to section 100 , unless—

(a) the transfer is necessary for a purpose specified in section 70 (1)(a),

(b) the personal data are to be transferred to a controller in a third country or an international organisation that is an authority competent for the purposes specified in section 70 (1)(a),

(c) where the personal data were transmitted or made available to the controller making the transfer from a controller in another Member State, subject to subsection (2), the controller in the other Member State or another relevant controller in that state has given its prior authorisation to the transfer,

(d) section 97 , 98 or 99 applies, and

(e) the transfer is subject to a condition that a subsequent transfer to another third country or international organisation from the third country or international organisation to which the data are being transferred by the controller shall only occur where the controller authorises the subsequent transfer, having taken into due account all relevant factors, including—

(i) the seriousness of any criminal offence to which the data relate,

(ii) the purpose for which the data were originally transferred, and

(iii) the level of protection for personal data in the third country or the international organisation to which the data are to be transferred onwards.

(2) Subsection (1)(c) shall not apply where—

(a) the transfer of the personal data concerned is necessary for the prevention of an immediate and serious threat to—

(i) public security in a Member State or a third country, or

(ii) the essential interests of a Member State,

and

(b) an authorisation under the said subsection (1)(c) cannot be obtained in good time.

(3) Where subsection (2) applies and personal data are transferred to a third country or an international organisation without an authorisation from the controller in the other Member State that transmitted or made available the personal data, the controller making the transfer, or on whose behalf the transfer is being made, shall inform the controller in the other Member State of the transfer without delay.

(4) Without prejudice to the generality of section 71 , a processor shall not transfer personal data to a third country or an international organisation, or to a recipient in a third country, under this Chapter unless explicitly instructed in writing to do so by the controller.