A01 chaf6542 06 se fm indd

Subject access 

request

A request by a data 

subject to view personal 

data from an organisation.

M04_CHAF6542_06_SE_C04.indd   144

7/23/14   12:18 PM

---

145

Chapter 4  E‑environment

be protected. (ii) The data controller must take reasonable steps to ensure the reliability 

of staff having access to the personal data.

8 

Not transferred to countries without adequate protection.

In full: ‘Personal data shall not be transferred to a country or territory outside the European 

Economic Area, unless that country or territory ensures an adequate level of protection of 

the rights and freedoms of data subjects in relation to the processing of personal data.’

Transfer of data beyond Europe is likely for multinational companies. This principle 

prevents export of data to countries that do not have sound data processing laws. If the 

transfer is required in concluding a sale or contract or if the data subject agrees to it, 

then transfer is legal. Data transfer with the US is possible through companies registered 

through the Safe Harbor scheme (

www.export.gov/safeharbor

).