What is a legally binding and enforceable instrument?
-
Due to the Data (Use and Access) Act coming into law on 19 June 2025, this guidance is under review and may be subject to change. The Plans for new and updated guidance page will tell you about which guidance will be updated and when this will happen.
You can make a restricted transfer if it’s covered by a legally binding and enforceable instrument that is:
- agreed between a public body and:
- another public body;
- an international organisation; or
- an organisation carrying out public functions; and
- intended to protect the type of restricted transfer you want to make.
An example of such an instrument is an international treaty between two or more governments. You should check the instrument you want to use:
- gives people enforceable rights; and
- offers effective remedies over their transferred information.
You don’t need to be a public body or a party to the legal instrument to rely on it as a safeguard. The important thing is that the safeguards in the legal instrument apply to the transferred information. For example, this can be the case when the safeguard is an international treaty intended to protect restricted transfers made by private sector organisations.
If you want to rely on this safeguard, you must complete a TRA to make sure that the standard of protection for people’s information is not materially lower after you transfer it.
Further reading – ICO guidance