Regulations 22(2), 23(1) and 34(3)

1. The specified public authority has delivered to the registrar a statement that it intends to use the information only for the purpose of facilitating the carrying out by that specified public authority of a public function ("the permitted purpose").

2. Subject to paragraph 3, the specified public authority has delivered to the registrar a statement that, where it supplies a copy of the information to a processor for the purpose of processing the information for use in respect of the permitted purpose, the specified public authority will -

(a) ensure that the processor is one who carries on business in the United Kingdom or in the European Economic Area;

(b) require that the processor does not transmit the information outside the area comprising the United Kingdom and the European Economic Area; and

(c) require that the processor does not disclose the information except to that specified public authority or an employee of that specified public authority.

3. Paragraph 2 does not apply where the specified public authority is the National Crime Agency, Secret Intelligence Service, Security Service or Government Communications Headquarters.