Part 4: Intelligence services processing Chapter 5: Transfers of personal data outside the United Kingdom Section 109: Transfers of personal data outside the United Kingdom
This section provides that the transfer of personal data to a country outside the United Kingdom or to an international organisation may only take place where the transfer is necessary and proportionate in accordance with the controller’s statutory functions, or relevant provisions of the Security Service Act 1989 and the Intelligence Services Act 1994. Those provisions place the Director General, Chief and Director of the Security Service, Secret Intelligence Service and GCHQ respectively under a duty to ensure that there are arrangements for securing that no information is obtained by the relevant service except so far as necessary for the proper discharge of its functions and that no information is disclosed by it except so far as necessary for that purpose or:
	In the case of the Security Service – for the purpose of the prevention or detection of serious crime or for the purpose of any criminal proceedings;
	In the case of the Secret Intelligence Service – in the interests of national security; for the purpose of the prevention or detection of serious crime; or for the purpose of any criminal proceedings; and
	In the case of GCHQ – for the purpose of any criminal proceedings.