Data Protection Act 2018, section 75

Transfers subject to appropriate safeguards

PART 3 Law enforcement processing

F307(1). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

[F308 (1A)A transfer of personal data to a third country or an international organisation is made subject to appropriate safeguards only if—

(a)an appropriate legal instrument binds the intended recipient of the data (see subsection (4)), or

(b)the controller, acting reasonably and proportionately, considers that the data protection test is met in relation to the transfer or that type of transfer (see subsection (5)).F308]

(2)The controller must inform the [F309CommissionF309] about the categories of data transfers that take place in reliance on [F310subsection (1A)(b) but not in reliance on section 73(4)(aa) (transfer to processor)F310] .

(3)Where a transfer of data takes place in reliance on [F311this section but not in reliance on section 73(4)(aa) (transfer to processor)F311] —

(a)the transfer must be documented,

(b)the documentation must be provided to the [F312CommissionF312] on request, and

(c)the documentation must include, in particular—

(i)the date and time of the transfer,

(ii)the name of and any other pertinent information about the recipient,

(iii)the justification for the transfer, and

(iv)a description of the personal data transferred.

[F313 (4) For the purposes of this section, a legal instrument is “appropriate”, in relation to a transfer of personal data, if—

(a)the instrument is intended to be relied on in connection with the transfer or that type of transfer,

(b)at least one competent authority is a party to the instrument, and

(c)each competent authority that is a party to the instrument, acting reasonably and proportionately, considers that the data protection test is met in relation to the transfers, or types of transfer, intended to be made in reliance on the instrument (see subsection (5)).

(5)For the purposes of this section, the data protection test is met in relation to a transfer, or a type of transfer, of personal data if, after the transfer, the standard of the protection provided for the data subject with regard to that personal data, whether by a binding legal instrument or by other means, would not be materially lower than the standard of the protection provided for the data subject with regard to the personal data by or under—

(a)this Part, and

(b)Parts 5 to 7, so far as they relate to processing by a competent authority for any of the law enforcement purposes.

(6)For the purposes of subsections (1A)(b) and (4)(c), what is reasonable and proportionate is to be determined by reference to all the circumstances, or likely circumstances, of the transfer or type of transfer, including the nature and volume of the personal data transferred.

(7)In this section, references to the protection provided for the data subject are to that protection taken as a whole.F313]

[F314 (8)For provision about standard data protection clauses which the [F315 CommissionF315] considers are capable of securing that the data protection test in this section is met, see section 119A.F314]

Definitions used in section 75 6

Third country

(7) “Third country” means a country or territory outside the United Kingdom .

Defined in s.33(7) · see it in the full Act
international organisation

“international organisation” means an organisation and its subordinate bodies governed by international law, or any other body which is set up by, or on the basis of, an agreement between two or more countries;

Defined in s.205(1) · see it in the full Act
Recipient

(5) “Recipient”, in relation to any personal data, means any person to whom the data is disclosed, whether a third party or not, but it does not include a public authority to whom disclosure is or may be made in the framework of a particular inquiry in accordance with the law.

Defined in s.33(5) · see it in the full Act
controller

(1) In this Part, “controller” means the competent authority which, alone or jointly with others—

(a)determines the purposes and means of the processing of personal data, or

(b)is the controller by virtue of subsection (2).

Defined in s.32(1) · see it in the full Act
competent authority

(1) In this Part, “competent authority” means—

(a)a person specified or described in Schedule 7, and

(b)any other person if and to the extent that the person has statutory functions for any of the law enforcement purposes.

Defined in s.30(1) · see it in the full Act
the law enforcement purposes

For the purposes of this Part, “the law enforcement purposes” are the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.

Defined in s.31 · see it in the full Act

Cases considering section 75 3

Elgizouli v Secretary of State for the Home Department

[2020] UKSC 10 · 25 March 2020Interprets

The provision defines when a transfer is based on appropriate safeguards and imposes documentation and notification requirements. A transfer without any death-penalty safeguard could not satisfy this gateway. (see paras [214]-[220]) The controller must assess all circumstances surrounding the transfer and conclude that appropriate safeguards exist. General ministerial consideration of the death penalty did not amount to applying this statutory test. (see paras [217]-[220]) The provision requires information about relevant transfers to be supplied to the Information Commissioner. The statutory scheme requires contemporaneous compliance and documentation, not merely an ex post facto conclusion that the transfer was substantively justified. (see paras [217]-[219])

El Gizouli, R (On the Application Of) v The Secretary of State for the Home Department

[2019] EWHC 60 (Admin) · 18 January 2019

Appropriate safeguards existed in substance because the decision-makers assessed all circumstances surrounding the transfer and imposed conditions limiting use to a federal criminal investigation or prosecution. Failures to notify or create a bespoke document did not invalidate the transfer (see paras [201]-[205]).

Elgizouli, R. (On Application of) v The Secretary of State for the Home Department

[2020] EWHC 2516 (Admin) · 22 September 2020

Was relied on as an alternative gateway based on appropriate safeguards. The Secretary of State considered that safeguards existed or would be made binding, but the court’s conclusion did not turn on resolving that alternative (see para [19]). Was identified as an alternative appropriate-safeguards gateway for the international transfer. The court recorded the Secretary of State’s alternative reasoning without deciding the issue separately (see para [19]).

What each judgment says about section 75 is in the case-law panel in the full Act.

Amendments and notes

11 notes from legislation.gov.uk

Amendments

  1. F306Words in s. 75 heading substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 6(2); S.I. 2026/82, reg. 2(z10)
  2. F307S. 75(1) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 6(3); S.I. 2026/82, reg. 2(z10)
  3. F308S. 75(1A) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 6(4); S.I. 2026/82, reg. 2(z10)
  4. F309Word in s. 75(2) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
  5. F310Words in s. 75(2) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 6(5); S.I. 2026/82, reg. 2(z10)
  6. F311Words in s. 75(3) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 6(6); S.I. 2026/82, reg. 2(z10)
  7. F312Word in s. 75(3)(b) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
  8. F313S. 75(4)-(7) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 6(7); S.I. 2026/82, reg. 2(z10)
  9. F314S. 75(8) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 18 (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)
  10. F315Word in s. 75(8) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)

Commencement

  1. I74S. 75 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)