Section 109 — Data Protection Act 2018: Transfers of personal data outside the United Kingdom

Transfers of personal data outside the United Kingdom 109 1 A controller may not transfer personal data to—

a a country or territory outside the United Kingdom, or b an international organisation, unless the transfer falls within subsection (2).

2 A transfer of personal data falls within this subsection if the transfer is a necessary and proportionate measure carried out—

a for the purposes of the controller's statutory functions, or b for other purposes provided for, in relation to the controller, in section 2(2)(a) of the Security Service Act 1989 or section 2(2)(a) or 4(2)(a) of the Intelligence Services Act 1994.