Data Protection Act 2018 - Part 4 Intelligence Services Processing Chapter 5 Transfer of Personal Data outsite the United Kingdom

Transfers of personal data outside the United Kingdom

  1. A controller may not transfer personal data to—
    1. a country or territory outside the United Kingdom, or
    2. an international organisation,
      unless the transfer falls within subsection (2).
  2. A transfer of personal data falls within this subsection if the transfer is a necessary and proportionate measure carried out—
    1. for the purposes of the controller’s statutory functions, or
    2. for other purposes provided for, in relation to the controller, in section 2(2)(a) of the Security Service Act 1989 or section 2(2)(a) or 4(2)(a) of the Intelligence Services Act 1994.