Privacy and Data Protection Act 2014

If an approved information usage arrangement provides for acts and practices for handling personal information that modify or do not comply with an Information Privacy Principle (other than IPP 4 or 6) or approved code of practice specified in the Information Commissioner's certificate issued under section 49, the parties to the arrangement are not required to comply with the Information Privacy Principle or approved code of practice in respect of those acts or practices to the extent specified in the certificate.

If an approved information usage arrangement provides for the handling of personal information for the purposes of an information handling provision, the handling of that information in accordance with the arrangement is taken to be permitted for the purposes of that provision.