From 25 May 2018 this Act ceased to apply to processing of personal data except for processing to safeguard the security of the State, the defence of the State, international relations, or processing under the Criminal Justice (Forensic Evidence and DNA Database System) Act 2014 or the Vehicle Registration Data (Automated Searching and Exchange) Act 2018, and remains applicable to complaints under s.10 and contraventions before 25 May 2018. Transfers of personal data outside the EEA may not take place unless the destination ensures an adequate level of protection, having regard to the nature, purposes and period of processing, origin and destination, governing law, enforceable codes, security measures and international obligations; a Community finding determines adequacy where made and the Commissioner must comply with European Commission decisions under Article 31.2.

Exceptions include transfers authorised by law or international obligation, data subject consent, necessity for contract performance or steps to enter a contract, contracts between the controller and a third party at the data subject's request and in their interests, substantial public interest, legal advice or proceedings, vital interests, public or legitimate‑interest registers, and Commissioner‑authorised transfers with adequate safeguards. The Minister may prescribe regulations on substantial public interest. Article 26 contractual clauses afford data subjects enforceable rights and damages. The Commissioner may prohibit transfers, considering likely damage or distress, by serving a prohibition notice stating effect, grounds, timing and appeal to the Court within 21 days (urgent notices may require compliance after 7 days); cancellation is permitted and non‑compliance is an offence.