http://www.legislation.gov.uk/id/ukpga/2018/12/schedule/6/part/1

http://www.legislation.gov.uk/ukpga/2018/12/schedule/6/part/1/crossheading/chapter-v-of-the-gdpr-transfers-of-data-to-third-countries-or-international-organisations/2018-05-23

Data Protection Act 2018

An Act to make provision for the regulation of the processing of information relating to individuals; to make provision in connection with the Information Commissioner's functions under certain regulations relating to information; to make provision for a direct marketing code of practice; and for connected purposes.

text

text/xml

Statute Law Database

2024-05-03

2018-05-23

Data Protection Act 2018

Sch. 3

para. 8(1)(y)

Adoption and Children Act (Northern Ireland) 2022

Sch. 3

para. 78(3)

s. 160(1)

Data Protection Act 2018

s. 204(1)(l)

The Anaesthesia Associates and Physician Associates Order 2024

Sch. 5

para. 7

art. 1(3)

Data Protection Act 2018

s. 13A

Victims and Prisoners Act 2024

s. 31(4)

s. 32

s. 81(2)

SCHEDULES

SCHEDULE 6The applied GDPR and the applied Chapter 2

PART 1Modifications to the GDPR

Chapter V of the GDPR (transfers of data to third countries or international organisations)

35

In Article 45 (transfers on the basis of an adequacy decision)—

a

in paragraph 1, after “decided” insert “ in accordance with Article 45 of the GDPR ”;

b

after paragraph 1 insert—

1A
But a transfer of personal data to a third country or international organisation must not take place under paragraph 1, if the Commission's decision in relation to the third country (including a territory or sector within it) or the international organisation—
a
is suspended,
b
has been amended, or
c
has been repealed,
by the Commission under Article 45(5) of the GDPR.

c

omit paragraphs 2 to 8;

d

in paragraph 9, for “of this Article” substitute “ of Article 45 of the GDPR ”.

36

In Article 46 (transfers subject to appropriate safeguards)—

a

in paragraph 1, for “Article 45(3)” substitute “ Article 45(3) of the GDPR ”;

b

in paragraph 2, omit point (c);

c

in paragraph 2, in point (d), omit “and approved by the Commission pursuant to the examination procedure referred to in Article 93(2)”;

d

omit paragraph 4;

e

in paragraph 5—

i

in the first sentence, for “a Member State or supervisory authority” substitute “ the Commissioner ”;

ii

in the second sentence, for “this Article” substitute “ Article 46 of the GDPR ”.

37

In Article 47 (binding corporate rules)—

a

in paragraph 1, in the first sentence, omit “in accordance with the consistency mechanism set out in Article 63”;

b

in paragraph 2, in point (e), for “the competent courts of the Member States” substitute “ a court ”;

c

in paragraph 2, in point (f), for “on the territory of a Member State” substitute “ in the United Kingdom ”;

d

omit paragraph 3.

38

In Article 49 (derogations for specific situations)—

a

in paragraph 1, in the first sentence—

i

for “Article 45(3)” substitute “ Article 45(3) of the GDPR ”;

ii

for “Article 46” substitute “ Article 46 of this Regulation ”;

b

in paragraph 4, for “Union law or in the law of the Member State to which the controller is subject” substitute “ domestic law (see section 18 of the 2018 Act which makes certain provision about the public interest) ”;

c

for paragraph 5 substitute—

5
Paragraph 1 is subject to any regulations made under section 18(2) of the 2018 Act.

39

In Article 50 (international co-operation for the protection of personal data), omit “the Commission and”.