Part 1 of Schedule 9 makes consequential amendments to other parts of the UK GDPR and DPA 2018 which arise as a result of the changes made to the UK’s regime for international transfers of personal data by Schedule 7 and Schedule 8 (as explained earlier in these Explanatory Notes).
	Part 2 of Schedule 9 sets out transitional provisions which are required to ensure a smooth transition between the previous international transfers regime, and the new regime which is implemented by the Act.
	With regard to the new regime for approving transfers of personal data to other countries and international organisations, the transitional provisions ensure that following the commencement of the new regime, transfers continue to be allowed to any countries or international organisations which were found adequate by the Secretary of State under the previous regime, as well as to those countries and international organisations which are treated as adequate under Schedule 21 of the DPA 2018.
	With regard to the new regime for transfers subject to appropriate safeguards, the transitional provisions ensure that standard data protection clauses laid by the Secretary of State under section 17C of the DPA 2018 or issued by the Commissioner under section 119A of the DPA 2018 (for example, the International Data Transfer Agreement and the EU Addendum) provide safeguards for the purposes of new Article 46(1A)(a)(i). Controllers will be able to enter into new contracts containing the IDTA clauses to transfer personal data overseas, if the controller considers the data protection test in the new Article 46(6) of the UK GDPR is met.
	For controllers wishing to use pre-commencement transfer mechanisms, the transitional provisions state that such mechanisms continue to provide appropriate safeguards following commencement of the new regime if they:
Were contained in arrangements which were entered into before the new regime commenced; and
Provide safeguards in accordance with Article 46(2) or (3) of the UK GDPR or paragraph 9 of Schedule 21 of the DPA 2018; or
Are a legal instrument, to which a competent authority is a party and which binds the data recipient, containing appropriate safeguards in accordance with section 75(1)(a) of the DPA 2018; and
Could validly be relied on to transfer personal data immediately before the commencement of the new regime.
	The effect of these provisions is to allow controllers to use pre-commencement transfer mechanisms following commencement of the new regime, so long as those mechanisms satisfy the requirements of existing Article 46(1) and the last sentence of existing Article 44 of the UK GDPR, or section 73(3) of the DPA 2018, immediately before the regime commenced. Controllers who satisfy these criteria will therefore not need to apply the data protection test in Article 46(6) and section 75(5) of the DPA 2018 (unless they seek to enter into new transfer mechanisms post-commencement of the Act).
	With regard to the new regime for derogations for specific situations, the transitional provisions also ensure that any regulations made by the Secretary of State under section 18(1) or 18(2) of the DPA 2018 are to be treated as having been made under the restated powers in Article 49(4A) and Article 49A of the UK GDPR respectively.
Schedules Schedule 9: Transfers of personal data to third countries etc: minor and consequential amendments and transitional provision