A controller may not transfer personal data to—
a country or territory outside the United Kingdom, or
an international organisation,
unless the transfer falls within subsection (2).
A transfer of personal data falls within this subsection if the transfer is a necessary and proportionate measure carried out—
for the purposes of the controller's statutory functions, or
for other purposes provided for, in relation to the controller, in section 2(2)(a) of the Security Service Act 1989 or section 2(2)(a) or 4(2)(a) of the Intelligence Services Act 1994.