Data Protection Act 2018, section 73

General principles for transfers of personal data

PART 3 Law enforcement processing

[F278 (A1)This section applies in relation to a transfer of personal data to a third country or international organisation for a law enforcement purpose.F278]

(1)[F279 The controller in relation to the transfer must secure that the transfer takes place only if—F279]

(a)F280the three conditions set out in subsections (2) to (4) are met, ...

(b)F281in a case where the personal data was originally transmitted or otherwise made available to the controller or another competent authority by a member State ..., that member State, or any person based in that member State which is a competent authority for the purposes of the Law Enforcement Directive, has authorised the transfer in accordance with the law of the member State [F282, and—

(c)the transfer is carried out in accordance with the other provisions of this Part.F282]

(2)Condition 1 is that the transfer is necessary for any of the law enforcement purposes.

[F283 (3)Condition 2 is that the transfer—

(a)is approved by regulations under section 74AA that are in force at the time of the transfer,

(b)is made subject to appropriate safeguards (see section 75), or

(c)is based on special circumstances (see section 76).F283]

(4)Condition 3 is that—

(a)the intended recipient is a relevant authority in a third country or an international organisation that is a relevant international organisation,

[F284 (aa)the intended recipient is a person in a third country who—

(i)is not a person described in paragraph (a), but

(ii)is a processor whose processing, on behalf of the controller, of the personal data transferred is governed by, or authorised in accordance with, a contract with the controller that complies with section 59,F284] or

(b)in a case where the controller is a competent authority specified in any of paragraphs 5 to 17, 21, 24 to 28, 34 to 51, 54 and 56 of Schedule 7—

(i)the intended recipient is a person in a third country[F285 who is not a person described in paragraph (a) or (aa)F285] , and

(ii)the additional conditions in section 77 are met.

(5)Authorisation is not required as mentioned in subsection (1)(b) if—

(a)the transfer is necessary for the prevention of an immediate and serious threat [F286to the public security, national security or essential interests of a third country or the United KingdomF286] , and

(b)the authorisation cannot be obtained in good time.

(6)Where a transfer is made without the authorisation mentioned in subsection (1)(b), the authority in the member State which would have been responsible for deciding whether to authorise the transfer must be informed without delay.

(7) In this section, “relevant international organisation” means an international organisation that carries out functions for any of the law enforcement purposes.

Definitions used in section 73 8

Third country

(7) “Third country” means a country or territory outside the United Kingdom .

Defined in s.33(7) · see it in the full Act
international organisation

“international organisation” means an organisation and its subordinate bodies governed by international law, or any other body which is set up by, or on the basis of, an agreement between two or more countries;

Defined in s.205(1) · see it in the full Act
the law enforcement purposes

For the purposes of this Part, “the law enforcement purposes” are the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.

Defined in s.31 · see it in the full Act
controller

(1) In this Part, “controller” means the competent authority which, alone or jointly with others—

(a)determines the purposes and means of the processing of personal data, or

(b)is the controller by virtue of subsection (2).

Defined in s.32(1) · see it in the full Act
competent authority

(1) In this Part, “competent authority” means—

(a)a person specified or described in Schedule 7, and

(b)any other person if and to the extent that the person has statutory functions for any of the law enforcement purposes.

Defined in s.30(1) · see it in the full Act
Recipient

(5) “Recipient”, in relation to any personal data, means any person to whom the data is disclosed, whether a third party or not, but it does not include a public authority to whom disclosure is or may be made in the framework of a particular inquiry in accordance with the law.

Defined in s.33(5) · see it in the full Act
relevant authority

(2) In this Chapter, “relevant authority”, in relation to a third country, means any person based in a third country that has (in that country) functions comparable to those of a competent authority.

Defined in s.72(2) · see it in the full Act
processor

(3) In this Part, “processor” means any person who processes personal data on behalf of the controller (other than a person who is an employee of the controller).

Defined in s.32(3) · see it in the full Act

Cases considering section 73 3

Elgizouli v Secretary of State for the Home Department

[2020] UKSC 10 · 25 March 2020Limits

A controller may not transfer personal data to a third country unless all three statutory conditions are met. The Secretary of State did not undertake the required assessment. (see paras [8]; [209]-[225]) Condition 1 requires the transfer to be necessary for a law-enforcement purpose. Necessity is strict and requires a contemporaneous proportionality assessment by the controller. (see paras [9]; [210]; [219]) Condition 2 requires a transfer to be based successively on an adequacy decision, appropriate safeguards or special circumstances. None supplied a lawful basis without the necessary contemporaneous statutory assessment. (see paras [154]-[158]; [211]-[225]) Where neither an adequacy decision nor appropriate safeguards exist, legality depends on the transfer being based on special circumstances under section 76. The Secretary of State had not made that statutory assessment. (see paras [221]-[227])

Elgizouli, R. (On Application of) v The Secretary of State for the Home Department

[2020] EWHC 2516 (Admin) · 22 September 2020Interprets

Prohibits transfer of personal data to a third country unless the statutory conditions are met. The court treated section 73 as the governing provision for the international transfer (see paras [35], [57]). Requires an international transfer to be necessary for a law-enforcement purpose. The court held that necessity was assessed by reference to the specified US investigation and prosecution, and was satisfied because the US could not prosecute without the material (see paras [35], [57]-[59]). Sets out the second condition for an international transfer, concerning adequacy decisions, appropriate safeguards or special circumstances. The court recognised this as part of the statutory conditions governing the transfer (see para [35]). Provides for transfer based on an adequacy decision. The court set out the gateway but did not decide that it supplied the legal basis for this transfer (see para [35]). Provides for transfer based on appropriate safeguards where no adequacy decision applies. The court recorded this statutory gateway as part of the framework considered by the Secretary of State (see paras [35], [51]). Provides for transfer based on special circumstances where neither an adequacy decision nor appropriate safeguards apply. The court recognised the gateway within the statutory scheme; the decision expressly considered special circumstances (see paras [35], [19]). Sets out the third condition concerning the status of the intended recipient. The court included this condition in the statutory framework but the challenge focused on necessity and proportionality (see para [35]).

El Gizouli, R (On the Application Of) v The Secretary of State for the Home Department

[2019] EWHC 60 (Admin) · 18 January 2019

The transfer conditions were strictly applicable. Necessity and the recipient condition were satisfied, and the transfer was authorised through the appropriate-safeguards or special-circumstances gateways (see paras [198]-[211]).

What each judgment says about section 73 is in the case-law panel in the full Act.

Amendments and notes

10 notes from legislation.gov.uk

Amendments

  1. F278S. 73(A1) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 3(2); S.I. 2026/82, reg. 2(z10)
  2. F279Words in s. 73(1) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 3(3)(a); S.I. 2026/82, reg. 2(z10)
  3. F280Word in s. 73(1)(a) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 3(3)(b); S.I. 2026/82, reg. 2(z10)
  4. F281Words in s. 73(1)(b) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 40(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  5. F282S. 73(1)(c) and word inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 3(3)(c); S.I. 2026/82, reg. 2(z10)
  6. F283S. 73(3) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 3(4); S.I. 2026/82, reg. 2(z10)
  7. F284S. 73(4)(aa) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 3(5)(a); S.I. 2026/82, reg. 2(z10)
  8. F285Words in s. 73(4)(b)(i) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 3(5)(b); S.I. 2026/82, reg. 2(z10)
  9. F286Words in s. 73(5)(a) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 3(6); S.I. 2026/82, reg. 2(z10)

Commencement

  1. I73S. 73 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)