Data Protection Act 2018

Limits on fees that may be charged by controllers

17A

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

17B

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

17C

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

National security and defence exemption

74A

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

74B

• (1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

• (2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

• (3) The Secretary of State must, on an ongoing basis, monitor developments in third countries and international organisations that could affect decisions to make regulations giving approval under section 74AA or to amend or revoke such regulations.

• (4) Where the Secretary of State becomes aware that the data protection test is no longer met in relation to transfers approved, or of a description approved, in regulations under section 74AA, the Secretary of State must, to the extent necessary, amend or revoke the regulations.

• (5) Where regulations under section 74AA are amended or revoked in accordance with subsection (4), the Secretary of State must enter into consultations with the third country or international organisation concerned with a view to improving the protection provided to data subjects with regard to the processing of personal data in the country or by the organisation.

• (6) The Secretary of State must publish—

• (a) a list of the third countries ... and international organisations, and the descriptions of such countries ... and organisations, which are for the time being approved by regulations under section 74AA as places or persons to which personal data may be transferred, and

• (b) a list of the third countries ... and international organisations, and the descriptions of such countries ... and organisations, which have been but are no longer approved by such regulations.

• (7) In the case of regulations under section 74AA which approve only certain transfers to a third country or international organisation that are specified or described in the regulations (in accordance with section 74AA(4)(b))—

• (a) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

• (b) the lists published under subsection (6) must specify or describe the relevant transfers.

119A

• (1) The Commissioner may issue a document specifying standard data protection clauses which the Commissioner considers are capable of securing that the data protection test set out in Article 46 of the UK GDPR or section 75 of this Act (or both) is met in relation to transfers of personal data.

• (2) The Commissioner may issue a document that amends or withdraws a document issued under subsection (1).

• (3) A document issued under this section—

• (a) must specify when it comes into force,

• (aa) may make provision generally or in relation to types of transfer described in the document,

• (b) may make different provision for different purposes, and

• (c) may include transitional provision or savings.

• (4) Before issuing a document under this section, the Commissioner must consult the Secretary of State and such of the following as the Commissioner considers appropriate—

• (a) trade associations;

• (b) data subjects;

• (c) persons who appear to the Commissioner to represent the interests of data subjects.

• (5) After a document is issued under this section—

• (a) the Commissioner must send a copy to the Secretary of State, and

• (b) the Secretary of State must lay it before Parliament.

• (6) If, within the 40-day period, either House of Parliament resolves not to approve the document then, with effect from the end of the day on which the resolution is passed, the document is to be treated as not having been issued under this section (so that the document, and any amendment or withdrawal made by the document, is to be disregarded for the purposes of Article 46(2)(d) of the UK GDPR).

• (7) Nothing in subsection (6)—

• (a) affects any transfer of personal data previously made in reliance on the document, or

• (b) prevents a further document being laid before Parliament.

• (8) The Commissioner must publish—

• (a) a document issued under this section, and

• (b) a notice identifying any document which, under subsection (6), is treated as not having been issued under this section.

• (9) The Commissioner must keep under review the clauses specified in a document issued under this section for the time being in force.

• (10) In this section, “the 40-day period” means—

• (a) if the document is laid before both Houses of Parliament on the same day, the period of 40 days beginning with that day, or

• (b) if the document is laid before the Houses of Parliament on different days, the period of 40 days beginning with the later of those days.

• (11) In calculating the 40-day period, no account is to be taken of any whole days that fall within a period during which Parliament is dissolved or prorogued or during which both Houses of Parliament are adjourned for more than 4 days.

• (12) In this section, “trade association” includes a body representing controllers or processors.

SCHEDULE 21

Part 1 — Interpretation

Merger of the directly applicable GDPR and the applied GDPR

1

In this Schedule, “the applied GDPR” means the EU GDPR as applied by Chapter 3 of Part 2 before IP completion day.

Part 2 — Continuation of existing acts etc

2

• (1) On and after IP completion day, references in an enactment to the UK GDPR (including the reference in the definition of “the data protection legislation” in section 3(9)) include—

• (a) the EU GDPR as it was directly applicable to the United Kingdom before IP completion day, read with Chapter 2 of Part 2 of this Act as it had effect before IP completion day, and

• (b) the applied GDPR, read with Chapter 3 of Part 2 of this Act as it had effect before IP completion day.

• (2) On and after IP completion day, references in an enactment to, or to a provision of, Chapter 2 of Part 2 of this Act (including general references to this Act or to Part 2 of this Act) include that Chapter or that provision as applied by Chapter 3 of Part 2 of this Act as it had effect before IP completion day.

• (3) Sub-paragraphs (1) and (2) have effect—

• (a) in relation to references in this Act, except as otherwise provided;

• (b) in relation to references in other enactments, unless the context otherwise requires.

3

• (1) Anything done in connection with the EU GDPR as it was directly applicable to the United Kingdom before IP completion day, the applied GDPR or this Act—

• (a) if in force or effective immediately before IP completion day, continues to be in force or effective on and after IP completion day, and

• (b) if in the process of being done immediately before IP completion day, continues to be done on and after IP completion day.

• (2) References in this paragraph to anything done include references to anything omitted to be done.

Part 3 — Transfers to third countries and international organisations

4

• (1) On and after IP completion day, for the purposes of the UK GDPR and Part 2 of this Act, a transfer of personal data to a third country or an international organisation is to be treated as approved by regulations made under Article 45A of the UK GDPR if, at the time of the transfer, paragraph 5 specifies, or specifies a description which includes—

• (a) in the case of a third country, the country or a relevant territory or sector within the country, or

• (b) in the case of an international organisation, the organisation.

• (2) Sub-paragraph (1) has effect subject to provision in paragraph 5 providing that only particular transfers to the country, territory, sector or organisation may rely on a particular provision of paragraph 5 for the purposes of sub-paragraph (1).

• (3) The Secretary of State may by regulations—

• (a) repeal sub-paragraphs (1) and (2) and paragraph 5;

• (b) amend paragraph 5 so as to omit a third country, territory, sector or international organisation specified, or of a description specified, in that paragraph;

• (c) amend paragraph 5 so as to replace a reference to, or description of, a third country, territory, sector or organisation with a narrower reference or description, including by specifying or describing particular transfers of personal data and making provision described in sub-paragraph (2).

• (4) Regulations under this paragraph may, among other things——

• (a) identify a transfer of personal data by any means, including by reference to the controller or processor, the recipient, the personal data transferred or the means by which the transfer is made or by reference to relevant legislation, schemes, lists or other arrangements or documents, as they have effect from time to time;

• (b) confer a discretion on a person.

• (5) Regulations under this paragraph are subject to the negative resolution procedure.

• (6) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

5

• (1) The following are specified for the purposes of paragraph 4(1)—

• (a) an EEA state;

• (b) Gibraltar;

• (c) a Union institution, body, office or agency set up by, or on the basis of, the Treaty on the European Union, the Treaty on the Functioning of the European Union or the Euratom Treaty;

• (d) an equivalent institution, body, office or agency set up by, or on the basis of, the Treaties establishing the European Economic Area;

• (e) a third country which is the subject of a decision listed in sub-paragraph (2), other than a decision that, immediately before IP completion day, had been repealed or was suspended;

• (f) a third country, territory or sector within a third country or international organisation which is the subject of an adequacy decision made by the European Commission before IP completion day on the basis of Article 45(3) of the EU GDPR, other than a decision that, immediately before IP completion day, had been repealed or was suspended.

• (2) The decisions mentioned in sub-paragraph (1)(e) are the following—

• (a) Commission Decision 2000/518/EC of 26th July 2000 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided in Switzerland;

• (b) Commission Decision 2002/2/EC of 20th December 2001 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided by the Canadian Personal Information Protection and Electronic Documents Act;

• (c) Commission Decision 2003/490/EC of 30th June 2003 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Argentina;

• (d) Commission Decision 2003/821/EC of 21st November 2003 on the adequate protection of personal data in Guernsey;

• (e) Commission Decision 2004/411/EC of 28th April 2004 on the adequate protection of personal data in the Isle of Man;

• (f) Commission Decision 2008/393/EC of 8th May 2008 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Jersey;

• (g) Commission Decision 2010/146/EU of 5th March 2010 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection provided by the Faeroese Act on processing of personal data;

• (h) Commission Decision 2010/625/EU of 19th October 2010 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Andorra;

• (i) Commission Decision 2011/61/EU of 31st January 2011 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by the State of Israel with regard to automated processing of personal data;

• (j) Commission Implementing Decision 2012/484/EU of 21st August 2012 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by the Eastern Republic of Uruguay with regard to automated processing of personal data;

• (k) Commission Implementing Decision 2013/65/EU of 19th December 2012 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by New Zealand;

• (m) Commission Implementing Decision (EU) 2019/419 of 23rd January 2019 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by Japan under the Act on the Protection of Personal Information.

• (3) Where a decision described in sub-paragraph (1)(e) or (f) states that an adequate level of protection of personal data is ensured only for a transfer specified or described in the decision, only such a transfer may rely on that provision and that decision for the purposes of paragraph 4(1).

• (4) The references to a decision in sub-paragraphs (1)(e) and (f) and (2) are to the decision as it had effect in EU law immediately before IP completion day, subject to sub-paragraphs (5) and (6).

• (5) For the purposes of this paragraph, where a reference to legislation, a list or another document in a decision described in sub-paragraph (1)(e) or (f) is a reference to the legislation, list or document as it has effect from time to time, it is to be treated as a reference to the legislation, list or other document as it has effect at the time of the transfer.

• (6) For the purposes of this paragraph, where a decision described in sub-paragraph (1)(e) or (f) relates to—

• (a) transfers from the European Union (or the European Community) or the European Economic Area, or

• (b) transfers to which the EU GDPR applies,

it is to be treated as relating to equivalent transfers to or from the United Kingdom or transfers to which the UK GDPR applies (as appropriate).

6

• (1) In the provisions listed in sub-paragraph (2)—

• (a) references to regulations made under Article 45A of the UK GDPR (other than references to making such regulations) include the provision made in paragraph 5;

• (b) references to the revocation of such regulations include the repeal of all or part of paragraph 5.

• (2) Those provisions are Articles 13(1)(f), 14(1)(f), 45C, 49(1) and 49A(1) of the UK GDPR.

• (3) In its application to transfers treated as approved by virtue of paragraph 1, Article 45C(5) of the UK GDPR (transfers approved by regulations: monitoring) has effect as if the reference to Article 45A(4)(b) were omitted.

7

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

8

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

9

• (1) The requirement for safeguards to be provided under Article 46(1A)(a)(i) of the UK GDPR may be satisfied on and after IP completion day as described in sub-paragraphs (2) to (4), subject to sub-paragraph (5).

• (2) The safeguards may be provided for by any binding corporate rules authorised by the Commissioner which, immediately before IP completion day, provided for the appropriate safeguards referred to in Article 46(1) of the EU GDPR by virtue of Article 46(5) of the EU GDPR.

• (3) The safeguards may be provided for by a version of binding corporate rules described in sub-paragraph (2) incorporating changes where—

• (a) all of the changes are made in consequence of the withdrawal of the United Kingdom from the EU , of provision made by regulations under section 8 or 23 of the European Union (Withdrawal) Act 2018 or of the amendment of Chapter 5 of the UK GDPR by the Data (Use and Access) Act 2025, and

• (b) none of the changes alters the effect of the rules.

• (4) The following changes are to be treated as falling within sub-paragraph (3)(a) and (b)—

• (a) changing references to adequacy decisions made by the European Commission into references to equivalent provision made by regulations under section 17A or by or under paragraphs 4 to 6 of this Schedule;

• (aa) changing references to provision made by regulations under section 17A into references to provision made by regulations made under Article 45A of the UK GDPR;

• (b) changing references to transferring personal data outside the European Union or the European Economic Area into references to transferring personal data outside the United Kingdom.

• (5) Sub-paragraphs (2) to (4) cease to apply in relation to binding corporate rules if, on or after IP completion day, the Commissioner withdraws the authorisation of the rules (or, where sub-paragraph (3) is relied on, the authorisation of the rules mentioned in sub-paragraph (2)).

• (5A) For the purposes of sub-paragraph (2), binding corporate rules which, immediately before IP completion day, provided for the appropriate safeguards referred to in Article 46(1) of the EU GDPR by virtue of Article 46(5) of the EU GDPR but which were authorised other than by the Commissioner are to be treated as authorised by the Commissioner where—

• (a) a valid notification of the rules has been made to the Commissioner,

• (b) the Commissioner has approved them, and

• (c) that approval has not been withdrawn.

• (5B) A notification is valid if it—

• (a) is made by a controller or processor established in the United Kingdom,

• (b) is made to the Commissioner before the end of the period of 6 months beginning with IP completion day, and

• (c) includes—

• (i) the name and contact details of the data protection officer or other contact point for the controller or processor, and

• (ii) such other information as the Commissioner may reasonably require.

• (5C) Where a valid notification is made the Commissioner must, without undue delay—

• (a) decide whether or not to approve the rules, and

• (b) notify the controller or processor of that decision.

• (6) The Commissioner must keep the operation of this paragraph under review.

• (7) In this paragraph—

• “adequacy decision” means a decision made on the basis of—Article 45(3) of the EU GDPR, orArticle 25(6) of Directive 95/46/EC of the European Parliament and of the Council of 24th October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data;

• “binding corporate rules” has the meaning given in Article 4(20) of the UK GDPR.

• (8) This paragraph has effect in addition to Article 46(2) and (3) of the UK GDPR.

10

• (1) On and after IP completion day, for the purposes of Part 3 of this Act, a transfer of personal data to a third country or an international organisation is to be treated as approved by regulations made under section 74AA if, at the time of the transfer, paragraph 11 specifies, or specifies a description which includes—

• (a) in the case of a third country, the country or a relevant territory or sector within the country, or

• (b) in the case of an international organisation, the organisation.

• (2) Sub-paragraph (1) has effect subject to provision in paragraph 11 providing that only particular transfers to the country, territory, sector or organisation may rely on a particular provision of paragraph 11 for the purposes of sub-paragraph (1).

• (3) The Secretary of State may by regulations—

• (a) repeal sub-paragraphs (1) and (2) and paragraph 11;

• (b) amend paragraph 11 so as to omit a third country, territory, sector or international organisation specified, or of a description specified, in that paragraph;

• (c) amend paragraph 11 so as to replace a reference to, or description of, a third country, territory, sector or organisation with a narrower reference or description, including by specifying or describing particular transfers of personal data and by making provision described in sub-paragraph (2).

• (4) Regulations under this paragraph may, among other things—

• (a) identify a transfer of personal data by any means, including by reference to the controller or processor, the recipient, the personal data transferred or the means by which the transfer is made or by reference to relevant legislation, schemes, lists or other arrangements or documents, as they have effect from time to time;

• (b) confer a discretion on a person.

• (5) Regulations under this paragraph are subject to the negative resolution procedure.

• (6) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

11

• (1) The following are specified for the purposes of paragraph 10(1)—

• (a) an EEA state;

• (aa) Switzerland;

• (b) Gibraltar;

• (c) a third country, a territory or sector within a third country or an international organisation which is the subject of an adequacy decision made by the European Commission before IP completion day on the basis of Article 36(3) of the Law Enforcement Directive, other than a decision that, immediately before IP completion day, had been repealed or was suspended.

• (2) Where a decision described in sub-paragraph (1)(c) states that an adequate level of protection of personal data is ensured only for a transfer specified or described in the decision, only such a transfer may rely on that provision and that decision for the purposes of paragraph 10(1).

• (3) The reference to a decision in sub-paragraph (1)(c) is to the decision as it had effect in EU law immediately before IP completion day, subject to sub-paragraphs (4) and (5).

• (4) For the purposes of this paragraph, where a reference to legislation, a list or another document in a decision described in sub-paragraph (1)(c) is a reference to the legislation, list or document as it has effect from time to time, it is to be treated as a reference to the legislation, list or other document as it has effect at the time of the transfer.

• (5) For the purposes of this paragraph, where a decision described in sub-paragraph (1)(c) relates to—

• (a) transfers from the European Union (or the European Community) or the European Economic Area, or

• (b) transfers to which the Law Enforcement Directive applies,

it is to be treated as relating to equivalent transfers from the United Kingdom or transfers to which Part 3 of this Act applies (as appropriate).

12

• (1) In sections 74B and 76(A1)—

• (a) references to regulations made under section 74AA (other than references to making such regulations) include the provision made in paragraph 11;

• (b) references to the revocation of such regulations include the repeal of all or part of paragraph 11.

• (2) In its application to transfers treated as approved by virtue of paragraph 10, section 74B(7) (transfers approved by regulations: monitoring) has effect as if the reference to section 74AA(4)(b) were omitted.

Part 4 — Repeal of provisions in Chapter 3 of Part 2

13

• (1) Regulations made under section 23 before IP completion day continue in force until they are revoked, despite the repeal of that section by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019.

• (2) The provisions listed in section 186(3) include regulations made under section 23 before IP completion day (and not revoked).

• (3) Sub-paragraphs (1) and (2) do not have effect so far as otherwise provided by the law of England and Wales, Scotland or Northern Ireland.

14

• (1) This paragraph applies to a certificate issued under section 27 of this Act which has effect immediately before IP completion day.

• (2) A reference in the certificate to a provision of the applied GDPR has effect, on and after IP completion day, as it if were a reference to the corresponding provision of the UK GDPR or this Act.

Part 5 — The Information Commissioner

15

The repeal of section 132(2)(d) by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 has effect only in relation to a disclosure of information made on or after IP completion day.

Part 6 — Enforcement

16

In relation to an infringement, before IP completion day, of a provision of the EU GDPR (as it was directly applicable to the United Kingdom) or the applied GDPR—

• (a) Article 83(5) and (6) of the UK GDPR and section 157(5)(a) and (b) of this Act have effect as if for “£17,500,000” there were substituted “ 20 million Euros ”;

• (b) Article 83(4) of the UK GDPR and section 157(6)(a) and (b) of this Act have effect as if for “£8,700,000” there were substituted “ 10 million Euros ”;

• (c) the maximum amount of a penalty in sterling must be determined by applying the spot rate of exchange set by the Bank of England on the day on which the penalty notice is given under section 155 of this Act.

The applied GPDR

17

• (1) This paragraph applies where—

• (a) proceedings are brought against a decision made by the Commissioner before IP completion day, and

• (b) the Commissioner's decision was preceded by an opinion or decision of the European Data Protection Board in accordance with the consistency mechanism referred to in Article 63 of the EU GDPR.

• (2) The Commissioner must forward the Board's opinion or decision to the court or tribunal dealing with the proceedings.

Immigration: safeguards: immigration exemption decisions

4A

• (1) A decision under paragraph 4(1) as to whether, and the extent to which, the application of the relevant UK GDPR provisions would be likely to prejudice any of the matters mentioned in paragraph 4(1)(a) and (b) (referred to in this paragraph as “an immigration exemption decision”) must be made in accordance with this paragraph.

• (2) An immigration exemption decision must be made—

• (a) on a case by case basis,

• (b) separately in respect of each of the relevant UK GDPR provisions mentioned in paragraph 4(2)(a) to (f) which relates to the data subject, and

• (c) afresh on each occasion on which the Secretary of State considers disapplying or restricting the application of any of the relevant UK GDPR provisions mentioned in paragraph 4(2)(a) to (f) in relation to the data subject.

• (3) When making an immigration exemption decision, the Secretary of State must take into account all the circumstances of the case, including at least the following—

• (a) any potential vulnerability of the data subject that is relevant to the decision,

• (b) all the rights and freedoms of the data subject including the data subject’s Convention rights, and

• (c) any relevant duties or obligations of the United Kingdom, the Secretary of State or any other person, including—

• (i) the United Kingdom’s obligations under the Refugee Convention and the Trafficking Convention,

• (ii) any duty under section 55 of the Borders, Citizenship and Immigration Act 2009 (duty regarding the welfare of children), and

• (iii) the need to ensure compliance with the UK GDPR.

• (4) A decision that the application of a particular relevant UK GDPR provision mentioned in paragraph 4(2)(a) to (f) (or that provision in combination with the provision mentioned in paragraph 4(2)(g), so far as it applies) would be likely to prejudice any of the matters mentioned in paragraph 4(1)(a) and (b) may be made only if—

• (a) the application of that provision or those provisions would give rise to a substantial risk of prejudice to any of the matters mentioned in paragraph 4(1)(a) and (b),

• (b) that risk outweighs the risk of prejudice to the interests of the data subject concerned that would arise if the exemption in paragraph 4(1) were to apply in relation to that provision or those provisions, and

• (c) the application of the exemption in relation to that provision or those provisions is necessary and proportionate to the risks in the particular case.

• (5) In this paragraph—

• “Convention rights” has the same meaning as in the Human Rights Act 1998 (see section 1(1) of that Act);

• “the Refugee Convention” means the Convention relating to the Status of Refugees, done at Geneva on 28 July 1951, and its Protocol;

• “the Trafficking Convention” means the Council of Europe Convention on Action against Trafficking in Human Beings, done at Warsaw on 16 May 2005.

Immigration: safeguard: record of decision that exemption applies

4B

• (1) Where the Secretary of State makes a decision mentioned in paragraph 4A(4), the Secretary of State must keep a record of it and the reasons for it.

• (2) Where sub-paragraph (1) applies, the Secretary of State must also inform the data subject of the decision unless, in the particular circumstances of the case, the Secretary of State considers that doing so may be prejudicial to any of the matters mentioned in paragraph 4(1)(a) and (b).

15A

The Provost Marshal for serious crime.

18A

The Service Police Complaints Commissioner.

The applied GPDR

GDPR: right to an effective remedy against the Commissioner

GDPR: right to an effective remedy against the Commissioner

183B

• (1) This section is about the relationship between—

• (a) a pre-commencement enactment which imposes a duty, or confers a power, to process personal data, and

• (b) a provision of the main data protection legislation containing a requirement relating to the processing of personal data.

• (2) The relationship is not changed by section 5(A1) of the European Union (Withdrawal) Act 2018 (removal of the principle of supremacy of EU law) (or the repeal of section 5(1) to (3) of that Act).

• (3) Where the provision described in subsection (1)(b) is a provision of, or made under, the UK GDPR, section 5(A2) of the European Union (Withdrawal) Act 2018 (assimilated direct legislation subject to domestic enactments) does not apply to the relationship.

• (4) Nothing is to be implied about a relationship described in subsection (1) merely due to the fact that express provision with similar effect to section 183A(1) (or applying that provision) is made in connection with one such relationship but not another.

• (5) In this section—

• (a) “the main data protection legislation” and “requirement” have the same meaning as in section 183A, and

• (b) “pre-commencement enactment” means an enactment so far as passed or made before 20th August 2025.

• (6) Section 183A(5) applies for the purposes of subsection (1)(a) of this section as it applies for the purposes of section 183A(1).

186A

• (1) This section is about the relationship between—

• (a) a pre-commencement enactment which prohibits or restricts the disclosure of information or authorises the withholding of information, and

• (b) a provision of the UK GDPR or this Act listed in section 186(2).

• (2) The relationship is not changed by section 5(A1) of the European Union (Withdrawal) Act 2018 (removal of the principle of supremacy of EU law) (or the repeal of section 5(1) to (3) of that Act).

• (3) Subsection (1) of section 186 does not apply to the relationship so far as there is a contrary intention, whether express or implied (taking account of, among other things, subsection (2) of this section).

• (4) Nothing is to be implied about a relationship described in subsection (1) merely due to the fact that express provision stating that section 186(1) applies (or with similar effect) is made in connection with one such relationship but not another.

• (5) In this section, “pre-commencement enactment” means an enactment so far as passed or made before 20th August 2025, other than an enactment contained in, or made under, a provision listed in section 186(2) or (3).

Protection of personal data

Relevant international law

9A

• (1) Processing of personal data meets the requirement in Article 6(3), 8A(3)(e), 9(2)(g) or 10(1) of the UK GDPR for a basis in, or authorisation by, relevant international law only if it meets a condition in Schedule A1.

• (2) A condition in Schedule A1 may be relied on for the purposes of any of those provisions, unless that Schedule provides otherwise.

• (3) The Secretary of State may by regulations amend Schedule A1 by adding, varying or omitting—

• (a) conditions,

• (b) provision about the purposes for which a condition may be relied on, and

• (c) safeguards in connection with processing carried out in reliance on a condition in the Schedule.

• (4) Regulations under this section may only add a condition relating entirely or partly to a treaty ratified by the United Kingdom.

• (5) Regulations under this section are subject to the affirmative resolution procedure.

• (6) In this section, “treaty” and “ratified” have the same meaning as in Part 2 of the Constitutional Reform and Governance Act 2010 (see section 25 of that Act).

Limits on fees that may be charged by controllers

National security and defence exemption

42A

• (1) The Secretary of State may by regulations—