(1) The Secretary of State may by regulations specify any of the following which the Secretary of State considers ensures an adequate level of protection of personal data -
(a) a third country,
(b) a territory or one or more sectors within a third country,
(c) an international organisation, or
(d) a description of such a country, territory, sector or organisation.
(2) For the purposes of this Part of this Act, a transfer of personal data to a third country or an international organisation is based on adequacy regulations if, at the time of the transfer, regulations made under this section are in force which specify, or specify a description which includes -
(a) in the case of a third country, the country or a relevant territory or sector within the country, and
(b) in the case of an international organisation, the organisation, and such a transfer does not require specific authorisation.
(3) Regulations under this section may specify that the Secretary of State considers that an adequa
…