Data Protection Act 2018, section 76

Transfers based on special circumstances

PART 3 Law enforcement processing

[F317 (A1)A transfer of personal data to a third country or international organisation is based on special circumstances where—

(a)it is made in the absence of approval by regulations under section 74AA and of compliance with section 75 (appropriate safeguards), and

(b)it is necessary for a special purpose.F317]

(1)[F318 A transfer of personal data is necessary for a special purpose if it is necessary—F318]

(a)to protect the vital interests of the data subject or another person,

(b)to safeguard the legitimate interests of the data subject,

(c)F320for the prevention of an immediate and serious threat to the public security [F319or national securityF319] of ... a third country[F321 or the United KingdomF321] ,

(d)[F322 in particular circumstances,F322] for any of the law enforcement purposes, or

(e)[F323 in particular circumstances,F323] for a legal purpose.

(2)[F324 But a transfer of personal data is not necessary for a special purpose by virtue of subsection (1)(d) or (e)F324] if the controller determines that fundamental rights and freedoms of the data subject override the public interest in the transfer.

[F325 (2A)In accordance with the third data protection principle, the amount of personal data transferred in reliance on this section must not be excessive in relation to the special purpose relied on.F325]

(3)Where a transfer of data takes place in reliance on [F326this sectionF326] —

(a)the transfer must be documented,

(b)the documentation must be provided to the [F327CommissionF327] on request, and

(c)the documentation must include, in particular—

(i)the date and time of the transfer,

(ii)the name of and any other pertinent information about the recipient,

(iii)the justification for the transfer, and

(iv)a description of the personal data transferred.

(4)For the purposes of this section, a transfer is necessary for a legal purpose if—

(a)it is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings) relating to any of the law enforcement purposes,

(b)it is necessary for the purpose of obtaining legal advice in relation to any of the law enforcement purposes, or

(c)it is otherwise necessary for the purposes of establishing, exercising or defending legal rights in relation to any of the law enforcement purposes.

Definitions used in section 76 5

Third country

(7) “Third country” means a country or territory outside the United Kingdom .

Defined in s.33(7) · see it in the full Act
international organisation

“international organisation” means an organisation and its subordinate bodies governed by international law, or any other body which is set up by, or on the basis of, an agreement between two or more countries;

Defined in s.205(1) · see it in the full Act
the law enforcement purposes

For the purposes of this Part, “the law enforcement purposes” are the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.

Defined in s.31 · see it in the full Act
controller

(1) In this Part, “controller” means the competent authority which, alone or jointly with others—

(a)determines the purposes and means of the processing of personal data, or

(b)is the controller by virtue of subsection (2).

Defined in s.32(1) · see it in the full Act
Recipient

(5) “Recipient”, in relation to any personal data, means any person to whom the data is disclosed, whether a third party or not, but it does not include a public authority to whom disclosure is or may be made in the framework of a particular inquiry in accordance with the law.

Defined in s.33(5) · see it in the full Act

Cases considering section 76 3

Elgizouli v Secretary of State for the Home Department

[2020] UKSC 10 · 25 March 2020Interprets

A transfer is based on special circumstances only where it is necessary for one of the listed purposes. The derogation is restrictive and limited to data which are strictly necessary. (see paras [156]-[158]; [221]-[227]) The immediate and serious threat gateway illustrates that urgent information-sharing to protect public security may be permitted despite possible death-penalty consequences. No such imminent threat justified this transfer. (see paras [205]; [221]) A transfer in an individual case for a law-enforcement purpose must still be strictly necessary and consciously assessed under the statutory criteria. Political expediency did not establish that particular personal data were strictly necessary. (see paras [222]-[227]) A transfer in an individual case for a legal purpose must be strictly necessary and based on a contemporaneous statutory assessment. The uncertain prospect of a United States prosecution did not demonstrate that any particular personal data were strictly necessary. (see paras [222]-[227]) The controller must determine whether the data subject’s fundamental rights and freedoms override the public interest in transfers under paragraphs (d) and (e). Failure to consider that question was at least a further reason why the decision could not stand; whether it invariably bars death-penalty facilitation was left open. (see paras [12]-[15]; [228]; [230]) The provision’s documentation requirements form part of the structured statutory scheme and cannot be replaced by an ex post facto search through general contemporaneous records. (see paras [218]; [224]-[225]) The provision defines a legal purpose to include existing or prospective legal proceedings. This did not dispense with the requirement that the transfer be strictly necessary. (see para [222])

El Gizouli, R (On the Application Of) v The Secretary of State for the Home Department

[2019] EWHC 60 (Admin) · 18 January 2019

The transfer also fell within special circumstances because it was necessary in an individual case for law-enforcement or legal purposes. The statutory documentation requirements did not justify relief where the relevant details were recorded elsewhere (see paras [206]-[211]).

Elgizouli, R. (On Application of) v The Secretary of State for the Home Department

[2020] EWHC 2516 (Admin) · 22 September 2020

Was relied on as the special-circumstances gateway for transfer where other gateways were unavailable. The Secretary of State considered the transfer strictly necessary and the public interest sufficient, but the court did not need to determine the gateway independently (see para [19]).

What each judgment says about section 76 is in the case-law panel in the full Act.

Amendments and notes

13 notes from legislation.gov.uk

Amendments

  1. F316Words in s. 76 heading substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 7(2); S.I. 2026/82, reg. 2(z10)
  2. F317S. 76(A1) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 7(3); S.I. 2026/82, reg. 2(z10)
  3. F318Words in s. 76(1) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 7(4)(a); S.I. 2026/82, reg. 2(z10)
  4. F320Words in s. 76(1)(c) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 43 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  5. F319Words in s. 76(1)(c) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 7(4)(b)(i); S.I. 2026/82, reg. 2(z10)
  6. F321Words in s. 76(1)(c) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 7(4)(b)(ii); S.I. 2026/82, reg. 2(z10)
  7. F322Words in s. 76(1)(d) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 7(4)(c); S.I. 2026/82, reg. 2(z10)
  8. F323Words in s. 76(1)(e) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 7(4)(d); S.I. 2026/82, reg. 2(z10)
  9. F324Words in s. 76(2) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 7(5); S.I. 2026/82, reg. 2(z10)
  10. F325S. 76(2A) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 7(6); S.I. 2026/82, reg. 2(z10)
  11. F326Words in s. 76(3) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 7(7); S.I. 2026/82, reg. 2(z10)
  12. F327Word in s. 76(3)(b) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)

Commencement

  1. I75S. 76 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)