Transfers of personal data outside the United Kingdom
- A controller may not transfer personal data to—
- a country or territory outside the United Kingdom, or
- an international organisation,
unless the transfer falls within subsection (2).
- A transfer of personal data falls within this subsection if the transfer is a necessary and proportionate measure carried out—
- for the purposes of the controller’s statutory functions, or
- for other purposes provided for, in relation to the controller, in section 2(2)(a) of the Security Service Act 1989 or section 2(2)(a) or 4(2)(a) of the Intelligence Services Act 1994.
