Section 109

A controller may not transfer personal data to— unless the transfer falls within subsection (2). a country or territory outside the United Kingdom, or an international organisation, A transfer of personal data falls within this subsection if the transfer is a necessary and proportionate measure carried out— for the purposes of the controller's statutory functions, or for other purposes provided for, in relation to the controller, in section 2(2)(a) of the Security Service Act 1989 or section 2(2)(a) or 4(2)(a) of the Intelligence Services Act 1994.

← 7 · All articles · 1 →

Source: legislation.gov.uk · retrieved 2026-09-04