(6) The 2018 Act is amended in accordance with subsections (7) and (8).
(7) Before section 10 (and the italic heading before that section) insert—
“ Relevant international law U.K.
9A Processing in reliance on relevant international law
(1) Processing of personal data meets the requirement in Article 6(3), 8A(3)(e), 9(2)(g) or 10(1) of the UK GDPR for a basis in, or authorisation by, relevant international law only if it meets a condition in Schedule A1.
(2) A condition in Schedule A1 may be relied on for the purposes of any of those provisions, unless that Schedule provides otherwise.
(3) The Secretary of State may by regulations amend Schedule A1 by adding, varying or omitting—
(a) conditions,
(b) provision about the purposes for which a condition may be relied on, and
(c) safeguards in connection with processing carried out in reliance on a condition in the Schedule.
(4) Regulations under this section may only add a condition relating entirely or partly to a treaty ratified by the United Kingdom.
(5) Regulations under this section are subject to the affirmative resolution procedure.
(6) In this section, “ treaty ” and “ ratified ” have the same meaning as in Part 2 of the Constitutional Reform and Governance Act 2010 (see section 25 of that Act). ”
(8) Before Schedule 1 insert—
Section 9A
“ Schedule A1 U.K. Processing in reliance on relevant international law
This condition is met where the processing is necessary for the purposes of responding to a request made in accordance with the Agreement between the Government of the United Kingdom of Great Britain and Northern Ireland and the Government of the United States of America on Access to Electronic Data for the Purpose of Countering Serious Crime, signed on 3 October 2019. ”
I127 S. 72 in force at Royal Assent for specified purposes, see s. 142(1)(2) (h)
I128 S. 72(1)(2)(4)-(6) (8) in force at 20.8.2025 in so far as not already in force by S.I. 2025/904 , reg. 2(b)
I129 S. 72(3) (7) in force at 5.2.2026 in so far as not already in force by S.I. 2026/82 , reg. 2(e)
I130 S. 72(7) in force at 20.8.2025 for specified purposes by S.I. 2025/904 , reg. 2(b)
Processing of special categories of personal data U.K.
73 Elected representatives responding to requests U.K.
In paragraph 23 of Schedule 1 to the 2018 Act (processing of special categories of personal data: elected representatives responding to requests), in sub-paragraph (4), for “fourth day after” substitute “period of 30 days beginning with the day after” .
I131 S. 73 not in force at Royal Assent, see s. 142(1)
I132 S. 73 in force at 5.2.2026 by S.I. 2026/82 , reg. 2(f)