The Social Security (Contributions) (Republic of India) Order 2026

Published: Wed 11th Mar 26

This Statutory Instrument brings into effect the Agreement on Social Security relating to Social Security Contributions signed between the United Kingdom and the Republic of India to ensure reciprocal arrangements and prevent double liability for social security contributions for individuals working in either territory.

It modifies relevant UK social security legislation and establishes detailed rules on which state's legislation applies to employed persons, detached workers, mariners, and aircraft crew, complemented by administrative provisions for cooperation, data protection, and dispute resolution, while stipulating that the Order comes into force upon the exchange of formal notifications between both states.

Arguments For

Establishes clear rules for determining which country's social security contribution legislation applies to individuals working across the UK and India, preventing double contributions.
Provides legal certainty and facilitates movement of labour by detailing rules for detached workers, mariners, and aircraft crew.
Ensures that social security coverage is maintained for individuals temporarily working in the other state, upholding the welfare of mobile workers.
Implements robust administrative and data protection frameworks (including an Annex) to ensure smooth cooperation and confidentiality when exchanging personal data between competent authorities.

Arguments Against

The commencement of the Order is contingent on internal statutory and constitutional requirements being met by both the UK and India, potentially causing indefinite delay before implementation.
The agreement may be complex to administer initially, requiring specific training for competent institutions regarding the detailed rules on detached workers and cross-border situations.
The provision allowing for temporary use of paper forms until July 2028 might create transitional administrative burdens compared to immediate full electronic exchange.
While protective, the data protection Annex introduces complex definitions and procedural requirements (e.g., specific notification timelines for data breaches) that require strict adherence.

STATUTORY INSTRUMENTS

2026 No. 274

SOCIAL SECURITY

The Social Security (Contributions) (Republic of India) Order 2026

This section identifies the instrument as a Statutory Instrument, numbered 2026 No. 274, dealing with the area of Social Security, titled 'The Social Security (Contributions) (Republic of India) Order 2026'.

Made - - - 10th March 2026 Coming into force in accordance with article 1

The Order was formally made on March 10th, 2026, and its effective date, or commencement, is set out in Article 1 of the Order.

At the Court at Buckingham Palace, the 10th day of March 2026 Present,

The King's Most Excellent Majesty in Council

The approval for this Order was given by the Sovereign, the King, acting in Council at Buckingham Palace on March 10th, 2026.

This Order is made under the powers in section 179(1)(a) and (2) of the Social Security Administration Act 1992( 1 ), which provide that, for the purpose of giving effect to agreements made with the governments of countries outside the United Kingdom providing for reciprocity in specified matters, His Majesty may by Order in Council make provision for modifying and adapting specified legislation in its application to cases affected by such agreements.

The legal authority for making this Order stems from Section 179 subsections (1)(a) and (2) of the Social Security Administration Act 1992.

This power allows the King, by Order in Council, to adjust UK legislation to implement reciprocity agreements made with foreign governments concerning social security matters.

At New Delhi on 10th February 2026 an Agreement on Social Security relating to Social Security Contributions between the Government of the United Kingdom of Great Britain and Northern Ireland and the Government of the Republic of India( 2 ) ('the Agreement') was signed on behalf of those Governments. This Agreement provides for reciprocal arrangements between the Governments in relation to the coordination of social security contributions.

The underlying instrument is the Agreement on Social Security Contributions signed between the UK and India in New Delhi on February 10th, 2026.

This Agreement sets out the reciprocal measures for coordinating social security contributions between the two nations.

Article 26 of the Agreement provides that the Agreement shall enter into force on the day after the Government of the United Kingdom of Great Britain and Northern Ireland and the Government of the Republic of India have exchanged written notifications that they have complied with all statutory and constitutional requirements for the entry into force of this Agreement( 3 ).

Article 26 of the Agreement specifies that it becomes legally effective the day after both the UK and Indian governments formally notify each other that they have satisfied all necessary domestic legal and constitutional procedures.

In order to give effect to the Agreement, therefore, His Majesty, in exercise of the powers conferred on Him by section 179(1)(a) and (2) of the Social Security Administration Act 1992 and of all other powers enabling Him to do so, is pleased, by and with the advice of His Privy Council, to order as follows:

To implement the Agreement, the King, using the powers granted by the Social Security Administration Act 1992 and any other relevant powers, subsequently issues this Order based on the advice of the Privy Council.

( 1 ) 1992 c. 5. Section 179 has been relevantly amended by paragraph 2(2) and (3) of Schedule 6 to the Social Security Contributions (Transfer of Functions, etc.) (Northern Ireland) Order 1999 (S.I. 1999/671).

This is a footnote referencing the Social Security Administration Act 1992 (Chapter 5) and noting that Section 179 has been amended by provisions within a 1999 Northern Ireland Order concerning the transfer of social security functions.

( 2 ) 2026 CP 1513.

This footnote provides a reference number (2026 CP 1513) for the Agreement itself.

( 3 ) The date on which the Agreement enters into force will be published on the relevant page on UK Treaties Online which can be found at https://www.gov.uk/guidance/uk-treaties.

A note advises that the exact date the Agreement becomes enforceable will be officially published on the UK Treaties Online government webpage.

Citation and commencement

This Order may be cited as the Social Security (Contributions) (Republic of India) Order 2026 and shall come into force on the day after the date on which both States exchange written notifications that they have complied with all statutory and constitutional requirements in accordance with Article 26 of the Agreement set out in the Schedule to this Order.

Article 1 states the official short title of this Order and confirms that it comes into force the day after the UK and India formally notify each other that they have met all requirements for the Agreement, as detailed in Article 26 of the Schedule.

Modification of Acts

The following legislation is modified to such extent as may be required to give effect to the provisions contained in the Agreement set out in the Schedule to this Order-

(a) the Social Security Administration Act 1992, the Social Security Contributions and Benefits Act 1992( 4 ) and Part 2 of the Social Security Contributions (Transfer of Functions, etc.) Act 1999( 5 ) so far as those provisions relate to England, Wales and Scotland;
(b) Part 3 of the Social Security Contributions (Transfer of Functions, etc.) (Northern Ireland) Order 1999( 6 ) so far as those provisions relate to Northern Ireland.

Article 2 details the UK legislation that is being modified by this Order to align with the Agreement in the Schedule.

Modifications apply primarily to legislation covering England, Wales, and Scotland (listed in 2(a)), and separate legislation concerning Northern Ireland (listed in 2(b)).

Richard Tilbrook Clerk of the Privy Council

This confirms the signature of the Clerk of the Privy Council, Richard Tilbrook, attesting to the Order.

( 4 ) 1992 c. 4.

( 5 ) 1999 c. 2.

( 6 ) S.I. 1999/671.

These are footnotes providing citations for the legislation mentioned in Article 2: the Social Security Contributions and Benefits Act 1992, the Social Security Contributions (Transfer of Functions, etc.) Act 1999, and the relevant Northern Ireland Order.

SCHEDULE

Articles 1 and 2

The Schedule contains the text of the actual Agreement, indexed by Articles 1 and 2 of the Order.

AGREEMENT ON SOCIAL SECURITY RELATING TO SOCIAL SECURITY CONTRIBUTIONS BETWEEN THE GOVERNMENT OF THE UNITED KINGDOM OF GREAT BRITAIN AND NORTHERN IRELAND AND THE GOVERNMENT OF THE REPUBLIC OF INDIA

This heading introduces the full text of the bilateral agreement between the UK and India regarding social security contributions.

PREAMBLE

The Government of the United Kingdom of Great Britain and Northern Ireland and the Government of the Republic of India,

DETERMINED to cooperate in the field of social welfare,

DESIROUS of promoting the welfare of people moving between their respective territories or working there,

HAVE AGREED:

The Preamble states the mutual commitment of the UK and Indian Governments to cooperate on social welfare and to promote the welfare of individuals who travel or work between their territories.

(1) For the purposes of this Agreement:

'activity as an employed person' means any activity or equivalent situation treated as such for the purposes of the legislation of the State in which such activity or equivalent situation exists, and the words 'employed activity', and 'employment' shall be construed accordingly;

'Government employee' means a person who is in the service of the Government, or considered to be such or treated as such by the State to which the administration employing them is subject;

'competent authority' means, in relation to the United Kingdom, the Commissioners for His Majesty's Revenue and Customs or an authorised representative, the Treasury of the Isle of Man, or the Revenue Service of Guernsey, as appropriate, and in relation to India, the Ministry of External Affairs;

'competent institution' means, in relation to the United Kingdom, the Commissioners for His Majesty's Revenue and Customs or an authorised representative, the Treasury of the Isle of Man, or the Revenue Service of Guernsey, as appropriate, and in relation to India, including for establishments that are exempted or excluded under the legislation of India, the Employees' Provident Fund Organisation;

'excluded establishment' means an establishment to which section 20 of the Code on Social Security, 2020, or any equivalent provision of Indian legislation, applies;

'exempted establishment' means an establishment to which section 21 of the Code on Social Security, 2020, or any equivalent provision of Indian legislation, applies;

'home base' means the place from where the crew member normally starts and ends a duty period or a series of duty periods, and where, under normal conditions, the operator/airline is not responsible for the accommodation of the crew member concerned;

This clause provides definitions for key terms used throughout the Agreement.

It defines 'activity as an employed person,' clarifies who counts as a 'Government employee,' and specifies the 'competent authority' and 'competent institution' for both the UK (including Isle of Man and Guernsey contacts) and India.

It also defines 'excluded' and 'exempted establishments' under Indian law and specifies the 'home base' for flight crew.

PART I

GENERAL PROVISIONS

ARTICLE 1

Definitions

'India' means the Republic of India;

'legislation' means the laws, regulations and provisions on contributions of the Social Security schemes indicated under Article 2 of this Agreement;

'State' and collectively 'States' means the United Kingdom or India, or both;

'registered office or place of business' means the registered office or place of business where the essential decisions of the undertaking are adopted and where the functions of its central administration are carried out;

'residence' means the place where a person habitually resides, and the words 'reside', and 'resident' shall be construed accordingly;

'United Kingdom' means the United Kingdom of Great Britain and Northern Ireland and where required shall also include the Isle of Man, and Guernsey. Where Guernsey means the islands of Guernsey, Alderney, Herm and Jethou.

(2) Unless the context otherwise requires, in the application of this Agreement to a State, expressions in this Agreement shall have the same meaning as in the United Kingdom or Indian legislation referred to in this Agreement.

Article 1 defines terms specific to the Agreement, such as 'India,' 'legislation' scope, 'State,' 'registered office,' and 'residence.' Crucially, it defines the 'United Kingdom' for the purpose of the Agreement to include the Isle of Man and Guernsey.

It further stipulates that terms used in the Agreement will generally carry the same meaning as defined in the specific social security legislation of the State being referenced.

ARTICLE 2

Scope of Legislation

(1) The Agreement shall apply, in relation to the territory of:

(a) the United Kingdom, to:
(i) the Social Security Administration Act 1992, the Social Security Contributions and Benefits Act 1992, the Social Security Contributions (Transfer of Functions, etc.) Act 1999;
(ii) the Social Security Administration (Northern Ireland) Act 1992, the Social Security Contributions and Benefits (Northern Ireland) Act 1992, the Social Security Contributions (Transfer of Functions, etc.) (Northern Ireland) Order 1999;
(iii) the Social Security Administration Act 1992, the Social Security Contributions and Benefits Act 1992, and the Social Security (Consequential Provisions) Act 1992 (Acts of Parliament), as those Acts apply to the Isle of Man by virtue of Orders made, or having effect as if made, under the Social Security Act 2000 (An Act of Tynwald)
(iv) the Social Insurance (Guernsey) Law, 1978
(b) India, to all legislation concerning:
(i) Old-age and survivors pension
(ii) Permanent total disability Pension

(2) Subject to paragraph (3), this Agreement shall apply also to any legislation which supersedes, replaces, amends, supplements or consolidates the legislation specified in paragraph (1).

(3) Nothing in this Agreement shall be construed as requiring either State to act in a manner inconsistent with its obligations under social security agreements with another country or an international organisation.

Article 2 specifies which local social security contribution laws in the UK (including those for England/Wales/Scotland, Northern Ireland, Isle of Man, and Guernsey) and India (covering old-age/survivor pensions and permanent total disability pensions) are covered by the Agreement.

The coverage automatically extends to future legislation that replaces or amends these listed laws, unless the Agreement conflicts with pre-existing obligations the state has with a third country or international body.

ARTICLE 3

Territorial Scope

(1) The provisions of this Agreement shall apply:

(a) on the one hand, to the United Kingdom, which includes:
(i) subject to paragraph (2), the territory of the United Kingdom;
(ii) any area outside the territorial sea of the United Kingdom which in accordance with international law has been designated, under the laws of the United Kingdom concerning the continental shelf, as an area within which the rights of the United Kingdom with respect to the seabed and subsoil and their natural resources may be exercised;
(b) and, on the other hand, to India, which includes the territory of the Republic of India, including its territorial sea, and the airspace above it; and other maritime zones including the Exclusive Economic Zone and continental shelf over which the Republic of India has sovereignty, sovereign rights, or exclusive jurisdiction, in accordance with both its laws and regulations in force and international law, including the United Nations Convention on the Law of the Sea, 1982.

(2) At the time of entry into force of this Agreement, or any time thereafter, this Agreement may be extended to the Isle of Man and/or Guernsey, territories for whose international relations the United Kingdom is responsible. An extension pursuant to this paragraph shall take effect the day after both States have agreed the extension in writing.

Article 3 defines the geographical reach of the Agreement.

For the UK, it covers its territory, its territorial sea, and designated continental shelf areas.

For India, it covers its territory, territorial sea, airspace, and maritime zones like the EEZ and continental shelf, according to international and Indian law.

The Article also notes that the Agreement can be extended to the Isle of Man and Guernsey post-entry into force if both states formally agree to the extension in writing.

ARTICLE 4

Persons Covered

This Agreement shall apply to a person carrying out an employed activity who is, or has been, subject to the legislation of either or both States.

The Agreement applies to any individual performing work as an employed person who falls under the social security legislation of either the UK or India, or both.

ARTICLE 5

Equality of Treatment

Unless otherwise provided for by this Agreement, a person who is subject to the legislation of a State shall enjoy the same rights and be subject to the same obligations under that legislation as the nationals of that State.

Unless this specific Agreement states otherwise, an individual subject to one country's legislation receives the same treatment, rights, and obligations under that legislation as a national of that country.

ARTICLE 6

Cross-border Situations

This Agreement shall not apply to a person whose situation is confined in all respects within either State.

The Agreement is only relevant for situations involving cross-border elements; it does not apply if a person's employment situation remains entirely within the UK or entirely within India.

PART II

DETERMINATION OF THE LEGISLATION APPLICABLE

ARTICLE 7

General Provisions

(1) A person carrying out an employed activity shall be subject to the legislation of a single State, which shall be determined in accordance with this Part.

(2) Subject to Articles 8 to 12 of this Agreement, a person pursuing an activity as an employed person in one State shall be subject to the legislation of that State.

(3) Where a person is subject to the legislation of a State in accordance with this Agreement, such legislation shall apply as if they were resident and ordinarily resident in that State, for the purposes of the legislation of that State.

Part II establishes the core rules for deciding which country's social security contribution rules apply.

Article 7 mandates that everyone is subject to only one state's legislation, determined by the subsequent articles.

Generally, a person working in one State is subject to that State's rules, and for contribution purposes, they are treated as if they reside there.

ARTICLE 8

Detached Workers

(1) A person who pursues an activity as an employed person in one State on behalf of an employer which normally carries out its activities there, and who is sent by that employer to the other State to perform work on that employer's behalf, shall continue to be subject to the legislation of the State in which the activities are normally carried out, provided that the anticipated duration of such work does not exceed 36 months.

(2) For the purposes of the application of paragraph (1), a person whose 'anticipated duration of such work does not exceed 36 months' shall include a person whose anticipated period of employment in the other State was 36 months or less at the point they started working in that State, but which subsequently increased up to or beyond 36 months. Such a person shall remain included until their period of employed activity in that State (i) ends, or (ii) reaches 36 months from the time they started working in that State, whichever is sooner.

(3) For the purposes of the application of paragraph (1), a 'person who pursues an activity as an employed person in one State' is someone who pays, or is liable to pay, contributions under the relevant State's legislation specified in Article 2.

(4) For the purposes of the application of paragraph (1), a 'person who pursues an activity as an employed person in one State on behalf of an employer which normally carries out its activities there, and who is sent by that employer to the other State to perform work on that employer's behalf' shall:

(a) include a person who is sent from the territory of a third country not party to this Agreement so long as the person pays, or is liable to pay, contributions under the legislation specified in Article 2 for the State in which their employer is established immediately before they are sent; and
(b) include a person who pursues an employed activity in the other State for reasons of personal choice so long as this activity is carried out with the agreement of their employer.

(5) For the purposes of the application of paragraph (1), a person who completed a period of employed activity in the other State whilst subject to the legislation of the State in which their employer is established shall not be eligible to commence a new period under paragraph (1) until a period of six months ('waiting period') has expired since the end of the previous period. Where the previous period under paragraph (1) is of less than six months, the waiting period will be the same length as that period.

(6) Where, in accordance with paragraph (1), a person who carries out an employed activity in India is subject to the legislation of the United Kingdom, that legislation shall apply as if they were carrying out all of their employed activity in the United Kingdom and they, and their employer, shall pay contributions on the total remuneration and profits derived from the employment as prescribed in that legislation.

(7) Where, in accordance with paragraph (1), a person who carries out an employed activity in the United Kingdom is subject to the legislation of India, they, and their employer, shall pay contributions on the total of their wages as defined in section 2(88) of the Code on Social Security,

2020, or any other social security legislation of India in scope of this agreement under Article 2(1) (b) of this Agreement, whichever is applicable.

Article 8 deals with 'detached workers'—employees sent by their employer from one State to work temporarily in the other.

They remain covered by the original State's social security legislation, provided the posting is not expected to exceed 36 months.

This 36-month limit remains if the initial expectation is later exceeded, but coverage stops at 36 months or the end of employment, whichever is sooner.

Definitions of who qualifies as an employed person and specifics regarding third-country postings or personal choice postings are provided.

There is a six-month 'waiting period' before a new detached period can start after a previous one ends (unless the previous period was shorter than six months).

Finally, clauses (6) and (7) specify how contributions are calculated: UK legislation applies in India mandates contributions on total remuneration; Indian legislation applies in the UK mandates contributions on total wages as defined by Indian law.

ARTICLE 9

Mariners

(1) Subject to paragraph (2), a person carrying out an activity as an employed person normally pursued on board a vessel at sea flying the flag of a State shall be deemed to be carrying out an activity pursued in that State.

(2) A person employed on board a vessel flying the flag of a State and remunerated for such activity by an undertaking or a person whose registered office or place of business is in the other State shall be deemed to be carrying out an activity pursued in that State if that person resides in that State. The undertaking or person paying the remuneration shall be considered as the employer for the purposes of the legislation that is applicable.

Article 9 addresses mariners working on vessels.

Normally, a person working on a ship flying a specific flag is subject to that ship's flag state's legislation.

However, if the remuneration is paid by an employer in the other State, the mariner is subject to the legislation of the State where they reside.

ARTICLE 10

Aircraft Crew

A person carrying out an employed activity as a flight crew or cabin crew member performing air passenger or freight services shall be deemed to be carrying out that activity in the State where the home base is located.

For flight and cabin crew engaged in air passenger or freight services, their employment activity for contribution purposes is determined by the location of their 'home base'.

ARTICLE 11

Government Employees and Armed Forces

(1) This Agreement shall not affect the provisions of the Vienna Convention on Diplomatic Relations of 18 April 1961, or the Vienna Convention on Consular Relations of 24 April 1963.
(2) Subject to paragraph (1), a Government employee shall be subject to the legislation of the State to which the administration employing them is subject, and that legislation shall apply as if they were carrying out their activity as a Government employee in its territory.
(3) A serving employed member of the armed forces shall be subject to the legislation of the State to which the force belongs, and that legislation shall apply as if they were carrying out their employed activity in its territory.

Article 11 maintains that international diplomatic and consular conventions take precedence.

A government employee remains subject to the social security legislation of the employing government's State, as if they were physically working there.

Similarly, serving armed forces personnel remain subject to the legislation of the state to which their military force belongs.

ARTICLE 12

Exceptions

The competent institutions of the States or the bodies designated by these institutions may by common agreement provide for exceptions to Articles 7 to 11 of this Agreement in the interest of certain persons or categories of persons.

The competent institutions in both the UK and India can jointly agree to create exceptions to the rules set out in Articles 7 through 11 if it is deemed to be in the interest of specific individuals or groups.

ARTICLE 13

Voluntary Contributions

A person who is subject to the legislation of one State according to Articles 7 to 12 of this Agreement shall not be entitled to pay voluntary contributions in the other State for any corresponding period.

If an individual is compulsorily subject to one State's social security legislation under the rules of this Agreement, that person cannot opt to pay voluntary contributions under the other State's corresponding scheme for the same period.

PART III

ADMINISTRATIVE PROVISIONS

ARTICLE 14

Cooperation

(1) The competent institutions of the States shall communicate to each other, as soon as possible, all information about the measures taken by them for the application of this Agreement and about changes in their national legislation insofar as these changes affect the application of this Agreement.

(2) The competent institutions of the States shall assist one another on any matter relating to the application of this Agreement as if the matter were one affecting the application of their own legislation. This assistance shall be free of charge.

(3) The relevant competent institutions of the States may, for the purposes of this Agreement, communicate directly with one another, with the persons covered by this Agreement or their employer.

(4) The competent institutions shall have a duty of mutual cooperation to ensure the correct application of this Agreement. The competent institutions, in accordance with the principle of good administration, shall respond to all queries within a reasonable period of time and shall in this connection provide the persons concerned with any information required for exercising the rights conferred on them by this Agreement.

Part III covers administrative aspects, starting with cooperation under Article 14.

Competent institutions must promptly share information on how the Agreement is applied and on any relevant changes to their national laws.

They must assist each other free of charge, treating matters under the Agreement as if they were applying their own domestic rules.

Direct communication between institutions, affected persons, or employers is permitted, and institutions must respond to queries efficiently and provide necessary information to exercise rights under the Agreement.

ARTICLE 15

Arrangements for Administration

(1) The States shall establish the administrative arrangements necessary for the application of this Agreement and shall comply with those arrangements.

(2) The States shall without delay provide or exchange all information necessary for establishing and determining the rights and obligations of persons under this Agreement and for the administration or enforcement of the Agreement.

(3) The States may agree procedures other than or in addition to those provided by this Agreement, provided that such procedures do not adversely affect the rights or obligations of any person or persons concerned.

(4) Where the legislation of one State provides that any certificate or other document which is submitted under the legislation of that State shall be exempt, wholly, or partly, from any legal dues or administrative charges, that exemption shall apply to any equivalent certificate or other document which is submitted under the legislation of the other State or in accordance with this Agreement.

(5) A competent institution of one State shall not reject a certificate, document or statement of any kind written in an official language of the other State on the grounds that it is written in a language which is not an official language of that State.

(6) The competent institution of the State whose legislation is applicable to a person in accordance with Articles 7 to 12 of this Agreement, shall issue to the person, or their employer or an authorised agent, on application, a certificate showing that the person is subject to their legislation. Such an application shall be made by the employee if their employed activity is carried out in the State that

is not the State whose legislation is applicable under Part II of this Agreement. An employer may make the application on the behalf of an employee with the consent of that employee.

Article 15 requires both States to establish and adhere to necessary administrative arrangements and swiftly exchange information needed for enforcing the Agreement.

States can agree on extra procedures if rights are unaffected.

Crucially, exemptions from administrative fees granted to documents in one State must extend to equivalent documents from the other.

Institutions cannot reject documents solely because they are in the other State's official language.

The applicable competent institution must issue a certificate proving an individual's coverage under its legislation upon request, which the employee or their employer (with consent) can apply for if the work is done outside the jurisdiction applying the relevant law.

ARTICLE 16

Forms, Documents and methods of exchanging Information

(1) The structure, content and format of forms and documents issued on behalf of the States for the purposes of implementing this Agreement shall be agreed by the competent institutions of the States.

(2) Subject to Article 18 of the Agreement, the transmission of information between the competent institutions will be carried out electronically. To the extent the forms and documents referred to in paragraph (1) are exchanged electronically, they shall respect the rules applicable to that system.

(3) Where the transmission of information between competent institutions is not carried out electronically, the competent institutions shall use the arrangements appropriate to each case, and favour the use of electronic means as far as possible.

(4) In their communications with the persons concerned, the competent institutions shall use the arrangements appropriate to each case, and favour the use of electronic means as far as possible.

Article 16 mandates that the format of necessary forms and documents will be mutually agreed upon by the competent institutions.

Information exchange between institutions should primarily be electronic, complying with system rules, unless that is not feasible, in which case electronic means should still be favoured.

Communication used when dealing directly with affected persons should also prioritize electronic methods.

ARTICLE 17

Legal value of documents and supporting evidence issued in the other State

(1) Documents issued by the competent institution of one State showing the position of a person for the purposes of the application of this Agreement and supporting evidence on the basis of which such documents have been issued shall be accepted by the competent institution of the other State for as long as they have not been withdrawn or declared to be invalid by the State in which they were issued.

(2) Where there is doubt about the validity of a document or the accuracy of the facts on which the particulars contained therein are based, the competent institution of the State that receives the document shall ask the issuing competent institution for the necessary clarification and, where appropriate, the withdrawal of that document. The issuing competent institution shall reconsider the grounds for issuing the document and, if necessary, withdraw it.

(3) Pursuant to paragraph (2), where there is doubt about the information provided by the persons concerned, the validity of a document or supporting evidence or the accuracy of the facts on which the particulars contained therein are based, the competent institution of the place of stay or residence shall, insofar as this is possible, at the request of the competent institution, proceed to the necessary verification of this information or document.

(4) Where a document determining that a State's legislation is applicable has been withdrawn or declared to be invalid by a State because it has been determined that in fact the other State's legislation is applicable, that latter State's legislation shall be applicable as if the document had not existed. This is subject to any further documents issued by the competent institution of either State.

(5) If necessary and where appropriate, where a document has been withdrawn or declared to be invalid the States shall between themselves settle the financial situation of the person concerned as regards contributions received.

Article 17 determines the acceptance of official documents.

Documents issued by one State's authority must be accepted by the other until they are officially withdrawn or invalidated by the issuing State.

Should a receiving institution doubt a document's validity or facts, it must request clarification from the issuing institution, which must then review and potentially withdraw the document.

If the doubt concerns information provided by the individual, the receiving institution may conduct verification checks.

If a document is invalidated because the other State's legislation was actually applicable, the legislation of the correct State applies retroactively, and the States must settle any resulting financial discrepancy concerning contributions paid.

ARTICLE 18

Interim provisions for forms and documents

(1) For an interim period, the end date of which will be no later than 24 July 2028, the transmission of information between the competent authorities will be carried out using paper forms and documents.

(2) The interim period in paragraph (1) for a transmission of information that involves the competent institution of the Isle of Man or Guernsey, shall continue for each of those competent institutions until such date as agreed between the States.

(3) The structure, content and format of the paper forms and documents issued on behalf of the States for the purposes of implementing this Agreement in paragraph (1) shall be agreed by the competent institutions of the States.

Article 18 sets an interim arrangement, stipulating that paper forms and documents can be used for transmitting information until July 24th, 2028, at the latest.

This interim period may last longer for information involving the Isle of Man or Guernsey if the respective competent institutions agree to a later date.

The format and content of these temporary paper forms must be mutually agreed upon.

ARTICLE 19

Confidentiality and Protection of Information

(1) Any information, including any personal data (as defined in the Annex to the Agreement), exchanged pursuant to this Agreement shall be covered by an obligation of confidentiality and shall be protected in accordance with the domestic law of the receiving State, and shall be used only for the purpose of implementing this Agreement and the legislation to which this Agreement applies.

(2) Where one of the States wishes to use information or personal data obtained under the Agreement for purposes other than implementing the Agreement, it shall obtain, in conformity with the domestic law of the State which provided the information, the prior written consent of its competent institution. Such use shall be subject to any restrictions laid down by that Authority.

(3) The transfer of personal data shall take place in accordance with the laws and regulations of the transferring State on international transfer of personal data. To enable the transfer of personal data, each State shall use the provisions set out in the Annex to this Agreement.

(4) The provisions set out in the Annex, shall be regularly reviewed by the competent institutions and shall be updated, if required, due to changes in the law of either State or changes to the transfer of the personal data. The States shall consult with each other on all practical measures and arrangements necessary for the implementation of this paragraph.

(5) Paragraph (1) shall not impede the use of information obtained in accordance with this Agreement in administrative or appeal proceedings instituted in respect of the recovery of social security contributions. Therefore, the States may in their records of evidence, reports and testimonies in such proceedings use as evidence information obtained in accordance with the provisions of this Agreement. Where practical, the competent institution which supplied that information shall be notified of such use.

(6) Notwithstanding paragraph (1) of this Article, unless otherwise notified by the competent institution providing the information, the competent institution receiving the information may provide the information pursuant to this Agreement to the relevant national labour enforcement, regulatory or administrative authorities of the State. These authorities may only use this information for the correct application of social security law and shall be subject to the conditions set out in this Article.

(7) This Article shall not preclude the use or disclosure of information to the extent that there is an obligation to do so under the laws and regulations of the State of the competent institution that received it. Such competent institution shall give wherever possible notice of such disclosure to the institution which provided the information. The relevant institution that received the information shall, unless otherwise agreed by the competent institution which provided the information, use all available measures under the applicable laws and regulations of the State of the former competent institution to protect the confidentiality of information and to protect personal data as regards applications by a third party or other authorities for disclosure of the information concerned.

Article 19 imposes strict confidentiality requirements on all exchanged information, particularly personal data, which must be protected according to the receiving State's domestic law and used only for implementing the Agreement.

Any other use requires prior written consent from the providing State's competent institution.

Data transfers must follow the Annex provisions and applicable international data transfer laws.

The Annex provisions are subject to regular review and updates.

Information can be used as evidence in contribution recovery proceedings, with notification where practical.

Furthermore, information may be shared with national enforcement/regulatory bodies for the purpose of applying social security law, subject to the article's conditions.

Finally, disclosure required by the receiving State's general law is permissible, provided as much notice as possible is given to the providing institution, taking measures to maintain confidentiality otherwise.

ARTICLE 20

Electronic Transmission of Information

(1) Subject to Article 18, the States shall use a system of electronic exchange for the exchange, access and processing of the information required to apply this Agreement.

(2) Each State shall be responsible for managing its own part of any system of electronic exchange of information.

(3) An electronic document sent or issued by an institution in conformity with this Agreement may not be rejected by any authority or institution of the other State on the grounds that it was received by electronic means, once the receiving institution has declared that it can receive electronic documents. Reproduction and recording of such documents shall be presumed to be a correct and accurate reproduction of the original document or representation of the information it relates to, unless there is proof to the contrary.

(4) An electronic document shall be considered valid if the computer system on which the document is recorded contains the safeguards necessary in order to prevent any alteration, disclosure, or unauthorised access to the recording. It shall at any time be possible to reproduce the recorded information in an immediately readable form.

Article 20 mandates the use of electronic exchange systems for information processing, except during the paper-based interim period specified in Article 18.

Each State manages its own electronic system component.

Once an institution accepts electronic documents, it cannot reject them based on electronic transmission.

Electronic records are presumed accurate unless proven otherwise, provided they have the necessary security safeguards against alteration or unauthorized access, and they must be reproducible in a readable format.

ARTICLE 21

Declarations or Appeals

(1) Any declaration, request for review or reconsideration of a decision (including information or documents relating to any of those), which is submitted by a person to the competent institution of one State, when it should have been submitted to the competent institution of the other State, should be forwarded to the correct State and should be treated as if it had been submitted to the correct competent institution and the person should be notified.

(2) Subject to paragraph (3), the date on which such a declaration, request for review or reconsideration of a decision was first submitted to the competent institution of the first State shall be considered as the date of submission to the competent institution of the other State.

(3) If a person who is carrying out an activity as an employed person or resides in one State does not, despite having been asked to do so, notify the fact that they have been carrying out the activity as an employed person, or have resided in the other State, the date on which the person provides this information or submits a new declaration for missing periods of activity as an employed person and/or residence in a State shall be considered as the date of submission of the claim to that State, subject to more favourable provisions of that legislation.

Article 21 deals with misdirected claims or appeals.

If a submission intended for one State's institution is sent to the other, it must be forwarded and treated as if correctly submitted, and the person notified.

The original submission date is preserved unless the claimant failed to notify the other State about their activity/residence there despite being asked; in that case, the date the correct information is eventually provided becomes the effective submission date, subject to more favorable domestic rules.

ARTICLE 22

Establishment and role of the Administrative Committee

(1) The competent authorities of the States shall establish a joint committee to be called the Administrative Committee. The Administrative Committee shall comprise representatives of the competent authorities and institutions. It shall be co-chaired by a representative of a competent authority from each State. Representatives from the competent authorities and institutions of the Isle of Man and/or Guernsey may be invited to attend.

(2) The Administrative Committee may:
(a) monitor and review the interpretation, implementation and application of this Agreement and make recommendations in respect thereof;
(b) agree administrative arrangements necessary for the application of this Agreement;
(c) provide a forum for the competent institutions to exchange information, and discuss best practices and technical issues;
(d) provide a forum for the competent authorities to seek to resolve disputes in accordance with Article 24.

(3) The Administrative Committee shall meet at the request of either State, and, in any event, at least once a year for the first three years following this Agreement entering into force. The co-chairs shall set the Administrative Committee's meeting schedule and agenda by mutual consent.

(4) The co-chairs may agree rules of procedure for the Administrative Committee.

Article 22 establishes a joint Administrative Committee composed of representatives from both States' competent bodies, potentially including the Isle of Man and Guernsey.

The Committee's functions include monitoring the Agreement's application, agreeing on administrative arrangements, facilitating information exchange and best practice discussion among institutions, and serving as a forum for resolving disputes (referencing Article 24).

The Committee must meet at least annually for the first three years, with the schedule and agenda determined by mutual consent of the co-chairs.

ARTICLE 23

Amendments

The States may amend this Agreement by mutual consent in writing through diplomatic channels. Any such amendment shall take effect on the date agreed by the States.

Amendments to the Agreement must be made mutually in writing via diplomatic channels, and they only become effective on a date agreed upon by both signatory States.

ARTICLE 24

Resolution of Disputes

(1) In the event of a dispute regarding the interpretation or application of this Agreement, the competent authorities of the two States shall make all reasonable efforts to resolve the dispute.
(2) If the dispute referred to in paragraph (1) cannot be resolved, the relevant authorities shall endeavour to settle the issue through negotiation, mediation, or other mutually agreed procedure.

Article 24 outlines the dispute resolution process.

Initially, the competent authorities must try to resolve any disagreements regarding interpretation or application through reasonable efforts.

If this fails, the authorities should pursue resolution via negotiation, mediation, or another procedure they mutually agree upon.

PART IV

MISCELLANEOUS AND FINAL PROVISIONS

ARTICLE 25

The Annex

The Annex shall form an integral part of this Agreement.

Part IV addresses final matters.

Article 25 confirms that the detailed Annex dealing with personal data safeguards is an inseparable part of the overall Agreement.

ARTICLE 26

Entry into Force

This Agreement shall enter into force on the day after both States have exchanged written notifications that they have complied with all statutory and constitutional requirements for the entry into force of this Agreement.

Article 26 reiterates the condition for the Agreement coming into legal effect: it activates the day following the mutual exchange of written confirmation that all necessary domestic legal and constitutional steps have been completed by both the UK and India.

ARTICLE 27

Duration of this Agreement

This Agreement shall remain in force for an indefinite period of time. Subject to Article 28, either State may terminate it on the first day of the twelfth month following the date on which they give written notice through diplomatic channels to the other State.

The Agreement is intended to remain valid indefinitely.

However, either State can terminate it by sending written notice through diplomatic channels, with the termination taking effect on the first day of the 12th month following that notice (subject to Article 28 provisions).

ARTICLE 28

Post-termination Arrangements

In the event that this Agreement is terminated in accordance with Article 27, the competent authorities shall commence discussions prior to the expiry of the period referred to in that Article on the settlement of any outstanding questions arising from this Agreement, including with respect to persons undertaking a period of detachment under Article 8.

Article 28 ensures that if the Agreement is terminated, the competent authorities must start discussions before the termination date arrives.

These discussions must focus on settling any remaining issues stemming from the Agreement, specifically mentioning outstanding matters related to detached workers covered under Article 8.

IN WITNESS WHEREOF, the undersigned, duly authorised by their respective Governments, have signed this Agreement.

Done in duplicate at New Delhi on the 10th day of February 2026, in the English and Hindi languages, each text being authentic. In case of divergence in interpretation, the English version of the Agreement shall prevail.

| For the United Kingdom of | For the Republic of India: | |-------------------------------------|------------------------------| | Great Britain and Northern Ireland: | Vikram Misri | | Lindy Cameron | |

This concluding section confirms the signing of the Agreement in New Delhi on February 10th, 2026, in both English and Hindi, with the English text taking precedence in case of interpretive differences.

The signatories listed are Lindy Cameron for the UK and Vikram Misri for India.

ANNEX

SAFEGUARDS FOR HANDLING PERSONAL DATA SHARED UNDER THIS AGREEMENT

Article A1

Definitions

(1) For the purposes of this Annex:

(a) 'data fiduciary' (also known as 'data controller' in the United Kingdom) means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data;
(b) 'data principal' (also known as 'data subject' in the United Kingdom) means a natural living individual identified or identifiable by the personal data processed under this Agreement;
(c) 'personal data' means any information relating to a data principal, including, and predominantly comprising, the information contained in the forms and documents agreed under Article 16 of the Agreement and transferred from the transferring competent institution to the receiving competent institution in accordance with this Agreement;

(d) 'personal data breach' means any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data;
(e) 'process', 'processed' or 'processing' means any operation or set of operations which are performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
(f) 'profiling' means automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a data principal;
(g) 'receiving competent institution' means the competent institution receiving the requested information pursuant to this Agreement;
(h) 'receiving State' means the State receiving the requested information pursuant to this Agreement;
(i) 'transferring competent institution' means the competent institution sending the requested information pursuant to this Agreement;
(j) 'transferring State' means the State sending the requested information pursuant to this Agreement.

(2) Unless a different definition is provided in paragraph (1), the definitions in Article 1 of the Agreement will also apply to this Annex.

The Annex begins by defining data protection terms.

It aligns UK terms like 'data controller' with 'data fiduciary' and 'data subject' with 'data principal.' 'Personal data' covers information shared under the Agreement via agreed forms.

It also defines 'personal data breach,' 'processing,' 'profiling,' and identifies the roles of the transferring and receiving institutions and States.

Unless defined here, Article 1 definitions apply.

Article A2

Personal data in scope of this Annex

(1) This Annex shall have an application limited only and exclusively to personal data that is transferred between the competent institutions of the States (excluding any personal data collected directly from the data principal by each competent institution), in accordance with the Agreement.

(2) The competent institutions shall ensure that appropriate technical and organisational measures in this Annex are in place for the general processing of personal data and protecting the personal data consistent with the laws, regulations and internal policies and procedures applicable to each State.

(3) The transfer of personal data between the States will be deemed to be a data fiduciary to data fiduciary transfer, for the purposes of the transferring competent institution's data protection laws and regulations.

Article A2 specifies that the Annex governs only personal data transferred directly between the competent institutions, excluding data gathered by an institution directly from the individual.

Both institutions must implement the Annex's technical and organizational security measures, ensuring consistency with their own domestic data protection laws.

For the transferring institution, the cross-border transfer falls under the category of a 'data fiduciary to data fiduciary transfer' under its domestic rules.

Article A3

Non-Discrimination

Consistent with their respective domestic laws, each State shall ensure that, in the implementation of this Annex, its data protection laws and regulations are applied fairly.

Article A3 requires both States to ensure, in line with their national laws, that the implementation of this Annex treats personal data protection matters fairly.

Article A4

Purpose and Use Limitation

(1) Subject to paragraph (2), the transfer of personal data shall solely be for the specified purposes authorised by this Agreement, including this Annex. The receiving State shall not further process the

relevant personal data in a manner that is incompatible with the purpose for which it was transferred. Compatible processing includes processing pursuant to the terms of this Agreement including this Annex, and any supplementary instruments established by this Agreement.

(2) The receiving competent institution shall not process the relevant personal data for purposes other than those set out in paragraph (1) or in accordance with Article 19 of the Agreement.

(3) This Article shall not prejudice the ability of the transferring competent institution to impose additional conditions to a specific case to the extent permitted by the applicable legal requirements for transfer.

Article A4 strictly limits the use of transferred data exclusively to the purposes authorised by the Agreement.

The receiving State cannot use this data in a way inconsistent with the original purpose of transfer, though processing aligned with the Agreement's terms is compatible.

Processing for any other purpose requires adherence to Article 19 (seeking consent) or is prohibited.

The State sending the data may impose extra conditions on specific transfers if its national law permits.

Article A5

Data Accuracy and Minimisation

(1) The transferring competent institution shall only transfer personal data that is adequate, relevant and limited to what is necessary in relation to the purpose of processing.

(2) Each competent institution shall take reasonable steps to ensure that the personal data is accurate and kept up to date to the extent necessary, having regard to the purpose of processing. The transferring competent institution shall ensure that, to the best of its knowledge, the personal data it transfers is accurate and up to date.

(3) If the competent institution becomes aware that the personal data it has transferred or received is incorrect, incomplete, or has become outdated, it shall inform the other competent institution without undue delay. Such competent institution shall take reasonable steps to ensure that incorrect, incomplete, or outdated personal data is corrected, completed or updated, in a timely manner, having regard to the purpose of processing.

Article A5 mandates data minimization, meaning the transferring institution may only send data that is adequate, relevant, and limited to what is necessary.

Both institutions must take reasonable steps to keep data accurate and current for the purpose it serves.

If an institution discovers transferred or received data is inaccurate or outdated, it must immediately notify the other institution, which then must take timely steps to correct or update the data.

Article A6

Storage Limitation

The receiving competent institution shall retain the personal data for no longer than necessary and appropriate for the purpose for which it is processed. The receiving competent institution shall put in place appropriate technical and organisational measures to ensure compliance with this obligation.

Article A6 requires the receiving institution to limit the retention period for personal data to only as long as it remains necessary and appropriate for the agreed processing purpose, enforcing this limit through appropriate technical and organizational measures.

Article A7

Security of Personal Data

(1) The transferring competent institution during the transmission of the personal data and the receiving competent institution upon receipt of the personal data, shall implement appropriate technical and organisational measures to ensure the security of the personal data, including protection against accidental or unlawful destruction, loss, or alteration, and protection against unauthorised disclosure or access.

(2) Subject to paragraph (3), in the event of a personal data breach concerning personal data processed by the competent institutions pursuant to this Agreement, the relevant competent institution shall notify the other competent institution as soon as possible but no later than 24 hours from the time of becoming aware of the personal data breach. The notification may include appropriate restrictions as to the further transmission of the personal data.

(3) In the event of a personal data breach, the relevant competent institution may, where necessary, only delay notification for a reasonable period where providing such notification would prejudice the security of the State or the conduct of public security operations.

(4) In the event of a personal data breach, the relevant competent institution shall use reasonable and appropriate means to remedy the personal data breach, including measures to minimise and mitigate possible adverse effects and prevent such a breach from taking place again.

(5) In the event of a personal data breach, the relevant competent institution shall document, report, investigate and keep records of the personal data breach, including its effects and any remedial action taken. The other competent institution may request information on the outcome of the investigation, relating to transfers of personal data in accordance with this Agreement including this Annex.

Article A7 obligates both the transferring and receiving institutions to implement technical and organizational security measures against unauthorized access, loss, or modification of personal data.

Following a data breach, the affected institution must notify the other within 24 hours, unless notification must be delayed for state security reasons.

The responsible institution must remedy the breach, document the incident, and investigate; the other institution may request follow-up information on the investigation regarding transferred data.

Article A8

Access

(1) Each competent institution shall ensure it has appropriate measures in place to respond, without undue delay, to any enquiries and requests it receives from data principals in such a form and manner as may be required under the domestic data protection laws applicable to that competent institution relating to the processing of their personal data in accordance with this Agreement including this Annex, subject to the restrictions in Article A11 (Restrictions). Each competent institution shall ensure that information provided to data principals is in an intelligible and easily accessible form, using clear and plain language.

(2) In particular, upon request by a data principal, the relevant competent institution shall provide the following:

(a) a copy of the personal data processed, and a description of the processing operations applied to it;
(b) confirmation as to whether the personal data concerned is complete, accurate and, if applicable, up to date;
(c) the identities of any entities to which such personal data has been disclosed, accompanied by a description of the personal data so disclosed;
(d) the information contained in Article A12 (Publication of Processing Statement);
(e) information concerning the right to lodge a complaint with the competent institution or with the relevant judicial authority; and
(f) any additional information relating to the personal data and its processing as may be required under the domestic data protection laws and regulations applicable to that competent institution.

(3) Each competent institution shall provide that the information set out in paragraph (2) is provided free of charge within the time limits set out in Article A13 (Time Limits).

(4) If the provision of such information is denied or restricted, the competent institution shall, inform the data principal in writing without undue delay, setting out the basis for the denial or restriction.

Article A8 grants data principals the right to access their shared data.

Competent institutions must respond without delay, adhering to their domestic data protection laws, subject to Article A11 restrictions.

Information must be clear and understandable.

Data principals can request a copy of their processed data, confirmation of its accuracy, details of disclosures, details from the public processing statement (A12), information on complaint rights, and any other information required by national law, all provided free of charge within specific time limits.

If access is denied or limited, the data principal must be promptly informed in writing specifying the legal basis.

Article A9

Rectification or Correction

(1) Each competent institution shall ensure that data principals are able to seek the correction or rectification of their personal data if they assert that it is inaccurate, no longer necessary for the purposes for which it was collected or processed, or has not been processed in accordance with the applicable legal requirements or requirements of this Annex. Correction or rectification may include supplementation, erasure, blocking, or other measures or methods for addressing inaccuracies or improper processing.

(2) Upon receiving a request from a data principal for the correction or rectification of their personal data, submitted in such form and manner as may be required under the domestic data protection laws applicable to that competent institution, the competent institution that received the request shall inform the data principal, without undue delay, whether the data has been corrected or rectified, or whether the request has been refused, and provide the reasons for any such refusal.

(3) If the competent institution concludes that personal data it has received under the Agreement is inaccurate, has been improperly processed, or has been kept longer than necessary following a request by a data principal under Article A8 (Access), or through its own investigation or inquiry, it shall take measures of supplementation, erasure, blocking or other correction or rectification measures set out in paragraph (1), as appropriate.

(4) The correction or rectification request by the data principal in a particular case may be subject to reasonable restrictions as set out in Article A11 (Restrictions). If correction or rectification is denied or restricted, the competent authority that received the request shall, without undue delay, inform the data principal in writing as to the basis for the denial or restriction, exemption of correction or rectification.

Article A9 ensures data principals can request correction or rectification of data they believe is inaccurate, no longer necessary, or improperly processed.

This correction may involve supplementing, erasing, or blocking data.

The competent institution must promptly confirm success or provide reasons for refusal.

If the institution confirms data is inaccurate—either following a request or its own review—it must implement necessary corrective measures.

Any denial or restriction of rectification is subject to Article A11 restrictions, and the data principal must be informed in writing of the reasons without delay.

Article A10

Automated Decisions

(1) The relevant competent institution may use automated means in relation to the processing of personal data in accordance with this Agreement. Unless authorised by law, the receiving competent institution shall not take any decisions which are likely to produce an adverse legal or other consequence concerning a relevant data principal based solely on automated processing of the relevant personal data, including profiling, without human involvement. If the receiving competent institution uses solely automated decision making, it must ensure it has suitable measures in place to inform the relevant data principal about the reasons underlying the automated decision.

(2) If solely automated decision making is used to process the personal data shared or disclosed under this Agreement, additional safeguards must be agreed with the other competent institution to allow data principals to challenge such decisions and seek a decision made with human involvement.

(3) If personal data shared or disclosed under this Agreement is processed through automated decision-making that produces a decision relating to a data principal, the competent institution responsible for such processing shall ensure full compliance with Article A5(1) and (2) concerning data minimisation and accuracy.

Article A10 addresses automated decision-making.

Institutions must avoid making decisions based solely on automated data processing (including profiling) if that decision could have an adverse legal or significant consequence for the data principal, unless domestic law explicitly allows it.

If solely automated decisions are used, the data principal must be informed of the reasoning, and extra safeguards must be agreed upon to allow the principal to challenge the decision and request human review.

Compliance with data minimization and accuracy rules (Article A5) is mandatory for automated processing.

Article A11

Restrictions

(1) Each competent institution shall provide that the measures set out in Articles A8 (Access) and A9 (Rectification) contained in this Annex are subject to the State's legal obligation not to disclose confidential information pursuant to any other legal obligations.

(2) Each competent institution may restrict disclosure to prevent prejudice or harm to supervisory or enforcement functions of an authority of the State acting in the exercise of the official authority vested in it.

(3) Each competent institution shall provide that provisions restricting disclosure shall only be relied on, if necessary, if permitted by law and in accordance with this Annex. Each competent institution shall provide that reliance continues only for as long as the reason for the restriction on disclosure exists.

(4) The receiving competent institution shall ensure that the relevant data principal is informed in writing about the restriction applied, without undue delay in accordance with its applicable domestic law, unless doing so would prejudice the reasons for the restriction.

Article A11 details legitimate grounds for restricting the rights of access (A8) and rectification (A9).

Restrictions can be based on mandatory domestic legal obligations to maintain confidentiality or where disclosure would prejudice the supervisory or enforcement functions of a state authority.

Any restrictions must be necessary, legally permissible, and only remain in place as long as the basis for the restriction exists.

The affected data principal must generally be informed in writing about any restriction without undue delay, unless this notification itself undermines the reason for the restriction.

Article A12

Publication of a Processing Statement

(1) Each competent institution shall make a processing statement available to data principals setting out:

(a) how and why it may process the personal data as either the transferring or receiving competent institution;
(b) the details of any other countries or authorities involved in the transfer;
(c) the reliance on this Annex as a tool for the transfer of personal data;
(d) the rights available to the data principals pursuant to this Annex and any relevant legal requirements, including how to exercise those rights;
(e) information about any applicable delay or restrictions on the exercise of such measures, including restrictions that apply in the case of transfers of personal data;
(f) mechanisms for submitting a dispute/complaint or claim, including contact details for submitting a dispute/complaint or claim;
(g) the time periods that each competent institution may retain personal data for;
(h) circumstances where personal data received under this Agreement may be used for automated decision making by the relevant competent institution;
(i) circumstances where personal data received under the Agreement may be shared with third parties by the receiving competent institution, including where personal data is sent to another country;
(j) the security procedures in place within each competent institution that will ensure personal data collected under the Agreement will be kept secure; and
(k) circumstances where the competent institution may apply restrictions set out in Article A11 (Restrictions).

(2) Each competent institution shall ensure that the processing statement is accessible to all data principals by publishing the notice on an official government website with a copy of this Annex.

Article A12 requires each competent institution to publish a data processing statement accessible via an official government website alongside the Annex.

This statement must clearly detail the reasons for processing data (as sender or receiver), involvement of other authorities/countries, reliance on the Annex, data principals' rights (and how to exercise them), details on potential delays or restrictions, dispute resolution mechanisms, data retention periods, conditions for automated decision-making, third-party sharing circumstances, and the security procedures implemented.

Article A13

Time Limits

(1) Subject to paragraph 2, the relevant competent institution shall address and respond to a request from a data principal made in accordance with Article A8 (Access) or A9 (Rectification) relating to the processing of their personal data in accordance with this Agreement no later than 30 days from the date it receives the request.

(2) The relevant competent institution may extend the period to respond to a request made pursuant to Article A8 (Access) by a further 60 days, taking into account the complexity and number of requests. Each competent institution shall notify the relevant data principal of the extended response period within 30 days of the request.

Article A13 sets deadlines for responding to data principal requests regarding access or rectification.

Generally, a response must be provided within 30 days of receiving the request.

If the request is complex or numerous, the competent institution may extend this response period by an additional 60 days, but it must notify the data principal of this extension within the initial 30-day window.

Article A14

Onward Disclosure and Transfer of Personal Data

The receiving competent institution shall ensure that any personal data received pursuant to this Agreement is disclosed or transferred only to another national labour-enforcement, regulatory, or administrative institution within its State, and solely where the prior consent of the transferring competent institution has been obtained for such disclosure or transfer. The receiving competent institution shall further ensure that any institution to which the personal data is disclosed or transferred complies with the safeguards and obligations set out in this Annex.

Article A14 strictly controls the onward disclosure or transfer of received personal data.

The receiving institution may only share data with other national enforcement, regulatory, or administrative bodies within its own state if it has obtained explicit prior consent from the transferring institution for that specific disclosure.

Any recipient institution must also adhere to the security safeguards detailed in this Annex.

Article A15

Complaint Resolution

(1) Each State shall ensure that a data principal is entitled to administrative redress where the data principal believes that a request made in accordance with Article A8 (Access) or A9 (Rectification) of this Annex has been improperly denied.

(2) Each State shall provide that a designated authority or person ('reviewer') reviews and, if appropriate, scrutinises any complaint raised by a data principal with a view to determining whether the processing of that data principal's personal data by the State constitutes an infringement of that State's laws and regulations or any of the requirements set out in this Annex.

(3) Each State shall provide that the reviewer may, where considered appropriate, inform the relevant data principal about the progress of their complaint. The reviewer shall formally respond to the complaint within 30 days of its receipt, or in exceptional cases, within 45 days.

(4) Each State shall provide that a formal written response setting out its determination and any recommendations relating to the matters raised includes details of the complaint escalation process, including judicial redress pursuant to Article A16 (Judicial Redress), that the relevant data principal may pursue if they are not satisfied with the outcome of the handling by the reviewer.

Article A15 grants data principals the right to administrative redress if their requests under A8 (Access) or A9 (Rectification) are wrongly refused.

A designated 'reviewer' in each State must scrutinize complaints to determine if data processing violated national law or the Annex requirements.

The reviewer must respond formally within 30 days (or 45 in exceptional cases) and include details on the further escalation path, including judicial redress under Article A16, if the data principal remains dissatisfied.

Article A16

Judicial Redress

(1) Each State shall ensure that if a data principal believes that that State has failed to comply with the obligations set out in Articles A8 (Access), A9 (Rectification) or A15 (Complaint Resolution) of this Annex, or believes that their personal data has been subject to a personal data breach, that data principal can seek judicial redress against that State following that State's domestic appeal and dispute resolution process as part of the data protection laws and regulations, as appropriate.

(2) In the event of a dispute between a data principal and a State, that State shall inform the other State of the dispute. If appropriate, the other State shall cooperate in resolving the dispute.

(3) Paragraphs (1) and (2) are without prejudice to any other judicial redress available with respect to the processing of a data principal's personal data under the law of the State in which redress is required.

Article A16 establishes judicial rights.

If a data principal believes a State failed to meet its obligations under Articles A8, A9, or A15, or suffered a data breach, they can seek judicial redress through that State's standard domestic procedures.

If a dispute arises between a principal and a State, that State informs the other State, which may cooperate if appropriate.

These provisions do not prevent the data principal from seeking any other judicial remedy available under the domestic law of the State where the remedy is sought.

Article A17

Joint Review

If there is any change to policies or procedures that will impact the Agreement, or if any policies or procedures relating to the Agreement are found to be ineffective in the context of a periodic review, each State should promptly inform the other State. Upon reasonable request by the transferring State, the receiving State will review its personal data processing policies and procedures to ascertain and confirm that the safeguards in the Agreement and Annex are being implemented effectively. The results of the review will be communicated to the transferring State.

Article A17 mandates proactive communication.

If policies impacting the Agreement change, or if periodic reviews find existing safeguards ineffective, each State must promptly inform the other.

Upon the transferring State's reasonable request, the receiving State must review its data processing practices to confirm the Annex safeguards are effectively implemented and report the findings back.

Article A18

Suspension

(1) In the event of a material breach of this Annex, a State may suspend, in whole or in part, the transfer of personal data pursuant to the Agreement by written notification to the other State through diplomatic channels.
(2) A State may only make a written notification as described in paragraph (1) after the States have engaged in a reasonable period of consultation through the competent institutions without reaching a resolution.
(3) The suspension shall take effect 20 days from the date of notification. Such suspension may be lifted by the transferring State by written notification to the receiving State. The suspension shall be lifted immediately on receipt of such notification.
(4) Notwithstanding paragraphs (1) to (3), in the event of a personal data breach, the transferring State may suspend transfers of personal data with immediate effect, taking into account the nature of the breach and risks to individuals.
(5) Notwithstanding any suspension of personal data transfers, personal data falling within the scope of this Annex and transferred prior to its suspension shall continue to be processed in accordance with this Annex.

Article A18 allows for the suspension of personal data transfers following a material breach, provided the States have failed to resolve the issue after a reasonable consultation period.

The suspension takes effect 20 days after diplomatic notification and can be lifted immediately upon notification.

However, if a personal data breach occurs, the transferring State may suspend transfers immediately, considering the breach's severity.

Any data already transferred before the suspension remains subject to the Annex's safeguards.

Article A19

Notification

Each State shall make reasonable efforts to notify the other State regarding the adoption of laws or regulations that may materially affect the implementation of this Annex, where possible, before they become effective.

Article A19 requires each State to make reasonable efforts to notify the other State about any new laws or regulations that could significantly alter how the Annex is implemented, ideally before those laws take effect.

EXPLANATORY NOTE

(This note is not part of the Order)

This Order makes provision for the modification of the Social Security Administration Act 1992, the Social Security Contributions and Benefits Act 1992, the Social Security Contributions (Transfer of Functions, etc.) Act 1999 and the Social Security Contributions (Transfer of Functions, etc.) (Northern Ireland) Order 1999 in order to give effect to the Agreement on Social Security relating to Social Security Contributions between the Government of the United Kingdom of Great Britain and Northern Ireland and the Government of the Republic of India ('the Agreement').

The Agreement provides for reciprocal arrangements on the liability of employees and their employers for social security contributions.

The Agreement will enter into force in accordance with Article 26 on the day after the States exchange written notifications confirming that their statutory and constitutional procedures, including any necessary legislation, have been completed.

A Tax Information and Impact Note has not been prepared for this instrument as it is secondary legislation giving effect to a Treaty preventing the double payment of social security contributions.

The Explanatory Note confirms that the Order legally modifies key UK social security statutes listed to implement the bilateral Agreement with India concerning reciprocal arrangements on social security contribution liability for employees and employers.

It reiterates that the Agreement starts only after both nations formally confirm completion of their constitutional procedures.

A Tax Information and Impact Note was deemed unnecessary as the legislation merely implements a Treaty aimed at preventing double payment of contributions.

View Source

Latest Legislation

The Merchant Shipping (General Lighthouse Authorities) (Increase of Borrowing Limit) Order 2026

12th Mar 26

The Digital Markets, Competition and Consumers Act 2024 (Alternative Dispute Resolution) (Consequential Amendments) Regulations 2026

12th Mar 26

The Online Safety Act 2023 (Commencement No. 7) Regulations 2026

12th Mar 26

The Surrey (Structural Changes) Order 2026

12th Mar 26

The Firefighters’ Pension Scheme (England) (Amendment) Order 2026

11th Mar 26