← Current text · History

Data Protection Act 2018

Current text a fecha 2026-04-07

PART 1 — Preliminary

Overview

1

(1) This Act makes provision about the processing of personal data.

(2) Most processing of personal data is subject to the UK GDPR.

(3) Part 2 supplements the UK GDPR.

(4) Part 3 makes provision about the processing of personal data by competent authorities for law enforcement purposes ....

(5) Part 4 makes provision about the processing of personal data by the intelligence services (and certain processing carried out by competent authorities jointly with the intelligence services).

(6) Part 5 makes provision about the Information Commissioner.

(7) Part 6 makes provision about the enforcement of the data protection legislation.

(8) Part 7 makes supplementary provision, including provision about the application of this Act to the Crown and to Parliament.

Protection of personal data

2

(1) The UK GDPR and this Act protect individuals with regard to the processing of personal data, in particular by—

(a) requiring personal data to be processed lawfully and fairly, on the basis of the data subject's consent or another specified basis,

(b) conferring rights on the data subject to obtain information about the processing of personal data and to require inaccurate personal data to be rectified, and

(c) conferring functions on the Commissioner, giving the holder of that office responsibility for monitoring and enforcing their provisions.

(2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Terms relating to the processing of personal data

3

(1) This section defines some terms used in this Act.

(2) “Personal data” means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).

(3) “Identifiable living individual” means a living individual who can be identified, directly or indirectly, in particular by reference to—

(a) an identifier such as a name, an identification number, location data or an online identifier, or

(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.

(4) “Processing”, in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as—

(a) collection, recording, organisation, structuring or storage,

(b) adaptation or alteration,

(d) disclosure by transmission, dissemination or otherwise making available,

(e) alignment or combination, or

(f) restriction, erasure or destruction,

(subject to subsection (14)(c) and sections 5(7), 29(2) and 82(3), which make provision about references to processing in the different Parts of this Act).

(5) “Data subject” means the identified or identifiable living individual to whom personal data relates.

(6) “Controller” and “processor”, in relation to the processing of personal data to which ... Part 2, Part 3 or Part 4 applies, have the same meaning as in that ... Part (see sections 5, 6, 32 and 83 and see also subsection (14)(d)).

(7) “Filing system” means any structured set of personal data which is accessible according to specific criteria, whether held by automated means or manually and whether centralised, decentralised or dispersed on a functional or geographical basis.

(8) “The Commissioner” means the Information Commissioner (see section 114).

(8A) “The Commission” means the Information Commission (see section 114A).

(9) “The data protection legislation” means—

(a) the UK GDPR,

(b) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(d) regulations made under this Act or the UK GDPR, ...

(e) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(10) “The UK GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation), as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (and see section 205(4)).

(10A) “The EU GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) as it has effect in EU law.

(11) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(12) “The Law Enforcement Directive” means Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA.

(13) “The Data Protection Convention” means the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data which was opened for signature on 28 January 1981, as amended up to the day on which this Act is passed.

(14) In Parts 5 to 7, except where otherwise provided—

(a) references to the UK GDPR are to the UK GDPR read with Part 2;

(b) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(c) references to personal data, and the processing of personal data, are to personal data and processing to which ... Part 2, Part 3 or Part 4 applies;

(d) references to a controller or processor are to a controller or processor in relation to the processing of personal data to which ... Part 2, Part 3 or Part 4 applies.

(15) There is an index of defined expressions in section 206.

PART 2 — General processing

CHAPTER 1 — Scope and definitions

Processing to which this Part applies

4

(1) This Part is relevant to most processing of personal data.

(2) This Part—

(a) applies to the types of processing of personal data to which the UK GDPR applies by virtue of Article 2 of the UK GDPR, and

(b) supplements, and must be read with, the UK GDPR.

(3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Definitions

5

(1) Terms used in ... this Part and in the UK GDPR have the same meaning in this Part as they have in the UK GDPR.

(2) In subsection (1), the reference to a term's meaning in the UK GDPR is to its meaning in the UK GDPR read with any provision of this Part which modifies the term's meaning for the purposes of the UK GDPR.

(3) Subsection (1) is subject to any provision in this Part which provides expressly for the term to have a different meaning and to section 204.

(4) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(5) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(6) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(7) A reference in ... this Part to the processing of personal data is to processing to which this Part applies.

(8) Sections 3 and 205 include definitions of other expressions used in this Part.

CHAPTER 2 — The UK GDPR

Meaning of certain terms used in the UK GDPR

Meaning of “controller”

6

(1) The definition of “controller” in Article 4(1)(7) of the UK GDPR has effect subject to—

(a) subsection (2),

(b) section 209, and

(2) For the purposes of the UK GDPR, where personal data is processed only—

(a) for purposes for which it is required by an enactment to be processed, and

(b) by means by which it is required by an enactment to be processed,

the person on whom the obligation to process the data is imposed by the enactment (or, if different, one of the enactments) is the controller.

Meaning of “public authority” and “public body”

7

(1) For the purposes of the UK GDPR, the following (and only the following) are “public authorities” and “public bodies” ...—

(a) a public authority as defined by the Freedom of Information Act 2000,

(b) a Scottish public authority as defined by the Freedom of Information (Scotland) Act 2002 (asp 13),

(ba) the Advanced Research and Invention Agency, and

subject to subsections (2), (3) and (4).

(2) An authority or body that falls within subsection (1) is only a “public authority” or “public body” for the purposes of the UK GDPR when performing a task carried out in the public interest or in the exercise of official authority vested in it.

(3) The references in subsection (1)(a) and (b) to public authorities and Scottish public authorities as defined by the Freedom of Information Act 2000 and the Freedom of Information (Scotland) Act 2002 (asp 13) do not include any of the following that fall within those definitions—

(a) a parish council in England;

(b) a community council in Wales;

(d) a parish meeting constituted under section 13 of the Local Government Act 1972;

(e) a community meeting constituted under section 27 of that Act;

(f) charter trustees constituted—

(i) under section 246 of that Act,

(ii) under Part 1 of the Local Government and Public Involvement in Health Act 2007, or

(iii) by the Charter Trustees Regulations 1996 (S.I. 1996/263).

(4) The Secretary of State may by regulations provide that a person specified or described in the regulations that is a public authority described or mentioned in subsection (1)(a), (b) or (ba) is not a “public authority” or “public body” for the purposes of the UK GDPR.

(5) Regulations under this section are subject to the affirmative resolution procedure.

Lawfulness of processing

Lawfulness of processing: public interest etc

8

In Article 6(1) of the UK GDPR (lawfulness of processing), the reference in point (e) to processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of ... official authority includes processing of personal data that is necessary for—

(a) the administration of justice,

(b) the exercise of a function of either House of Parliament,

(d) the exercise of a function of the Crown, a Minister of the Crown or a government department, or

(e) an activity that supports or promotes democratic engagement.

Child’s consent in relation to information society services

9

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Special categories of personal data

Special categories of personal data and criminal convictions etc data

10

(1) Subsections (2) and (3) make provision about the processing of personal data described in Article 9(1) of the UK GDPR (prohibition on processing of special categories of personal data) in reliance on an exception in one of the following points of Article 9(2)—

(a) point (b) (employment, social security and social protection);

(b) point (g) (substantial public interest);

(d) point (i) (public health);

(e) point (j) (archiving, research and statistics).

(2) The processing meets the requirement in point (b), (h), (i) or (j) of Article 9(2) of the UK GDPR for authorisation by, or a basis in, the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 1 of Schedule 1.

(3) The processing meets the requirement in point (g) of Article 9(2) of the UK GDPR for a basis in the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 2 of Schedule 1.

(4) Subsection (5) makes provision about the processing of personal data relating to criminal convictions and offences or related security measures that is not carried out under the control of official authority.

(5) The processing meets the requirement in Article 10(1) of the UK GDPR for authorisation by the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 1, 2 or 3 of Schedule 1.

(6) The Secretary of State may by regulations—

(a) amend Schedule 1—

(i) by adding or varying conditions or safeguards, and

(ii) by omitting conditions or safeguards added by regulations under this section, and

(b) consequentially amend this section.

(7) Regulations under this section are subject to the affirmative resolution procedure.

Special categories of personal data etc: supplementary

11

(1) For the purposes of Article 9(2)(h) of the UK GDPR (processing for health or social care purposes etc), the circumstances in which the processing of personal data is carried out subject to the conditions and safeguards referred to in Article 9(3) of the UK GDPR (obligation of secrecy) include circumstances in which it is carried out—

(a) by or under the responsibility of a health professional or a social work professional, or

(b) by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law.

(2) In Article 10 of the UK GDPR and section 10, references to personal data relating to criminal convictions and offences or related security measures include personal data relating to—

(a) the alleged commission of offences by the data subject, or

(b) proceedings for an offence committed or alleged to have been committed by the data subject or the disposal of such proceedings, including sentencing.

Rights of the data subject

Limits on fees that may be charged by controllers

12

(1) The Secretary of State may by regulations specify limits on the fees that a controller may charge in reliance on—

(a) Article 12(5) of the UK GDPR (reasonable fees when responding to manifestly unfounded or excessive requests), or

(b) Article 15(3) of the UK GDPR (reasonable fees for provision of further copies).

(2) The Secretary of State may by regulations—

(a) require controllers of a description specified in the regulations to produce and publish guidance about the fees that they charge in reliance on those provisions, and

(b) specify what the guidance must include.

(3) Regulations under this section are subject to the negative resolution procedure.

Obligations of credit reference agencies

13

(1) This section applies where a controller is a credit reference agency (within the meaning of section 145(8) of the Consumer Credit Act 1974).

(2) The controller's obligations under Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) are taken to apply only to personal data relating to the data subject's financial standing, unless the data subject has indicated a contrary intention.

(3) Where the controller discloses personal data in pursuance of Article 15(1) to (3) of the UK GDPR, the disclosure must be accompanied by a statement informing the data subject of the data subject's rights under section 159 of the Consumer Credit Act 1974 (correction of wrong information).

Automated decision-making authorised by law: safeguards

14

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Exemptions etc

15

(1) Schedules 2, 3 and 4 make provision for exemptions from, and restrictions and adaptations of the application of, rules of the UK GDPR.

(2) In Schedule 2—

(a) Part 1 makes provision adapting or restricting the application of rules contained in Articles 13 to 21 and 34 of the UK GDPR in specified circumstances (of a kind described in Article 6(3) and Article 23(1) of the UK GDPR);

(b) Part 2 makes provision restricting the application of rules contained in Articles 13 to 21 and 34 of the UK GDPR in specified circumstances (of a kind described in Article 23(1) of the UK GDPR);

(c) Part 3 makes provision restricting the application of Article 15 of the UK GDPR where this is necessary to protect the rights of others (of a kind described in Article 23(1) of the UK GDPR);

(d) Part 4 makes provision restricting the application of rules contained in Articles 13 to 15 of the UK GDPR in specified circumstances (of a kind described in Article 23(1) of the UK GDPR);

(e) Part 5 makes provision containing exemptions or derogations from Chapters II, III, IV and V of the UK GDPR for reasons relating to freedom of expression (of a kind described in Article 85(2) of the UK GDPR);

(f) Part 6 makes provision containing derogations from rights contained in Articles 15, 16, 18, 19, 20 and 21 of the UK GDPR for scientific or historical research purposes, statistical purposes and archiving purposes ....

(3) Schedule 3 makes provision restricting the application of rules contained in Articles 13 to 21 of the UK GDPR to health, social work, education and child abuse data (of a kind described in Article 23(1) of the UK GDPR).

(4) Schedule 4 makes provision restricting the application of rules contained in Articles 13 to 21 of the UK GDPR to information the disclosure of which is prohibited or restricted by an enactment (of a kind described in Article 23(1) of the UK GDPR).

(4A) In connection with the manual unstructured processing of personal data held by an FOI public authority, see Chapter 3 of this Part (sections 21, 24 and 25).

(5) In connection with the safeguarding of national security and with defence, see Chapter 3 of this Part (sections 26 to 28).

Power to make further exemptions etc by regulations

16

(1) The following powers to make provision altering the application of the UK GDPR may be exercised by way of regulations made by the Secretary of State under this section—

(a) the power in Article 6(3) ... to lay down a legal basis containing specific provisions to adapt the application of rules of the UK GDPR where processing is necessary for compliance with a legal obligation, for the performance of a task in the public interest or in the exercise of official authority;

(b) the power in Article 23(1) to make provision restricting the scope of the obligations and rights mentioned in that Article where necessary and proportionate to safeguard certain objectives of general public interest;

(c) the power in Article 85(2) to provide for exemptions or derogations from certain Chapters of the UK GDPR where necessary to reconcile the protection of personal data with the freedom of expression and information.

(2) Regulations under this section may—

(a) amend Schedules 2 to 4—

(i) by adding or varying provisions, and

(ii) by omitting provisions added by regulations under this section, ...

(b) consequentially amend section 15 , and

(c) consequentially amend the UK GDPR by adding, varying or omitting a reference to section 15, Schedule 2, 3 or 4, this section or regulations under this section.

(3) Regulations under this section are subject to the affirmative resolution procedure.

Certification

Accreditation of certification providers

17

(1) Accreditation of a person as a certification provider is only valid when carried out by—

(a) the Commissioner, or

(b) the UK national accreditation body.

(2) The Commissioner may only accredit a person as a certification provider where the Commissioner—

(a) has published a statement that the Commissioner will carry out such accreditation, and

(b) has not published a notice withdrawing that statement.

(3) The UK national accreditation body may only accredit a person as a certification provider where the Commissioner—

(a) has published a statement that the body may carry out such accreditation, and

(b) has not published a notice withdrawing that statement.

(4) The publication of a notice under subsection (2)(b) or (3)(b) does not affect the validity of any accreditation carried out before its publication.

(5) Schedule 5 makes provision about reviews of, and appeals from, a decision relating to accreditation of a person as a certification provider.

(6) The UK national accreditation body may charge a reasonable fee in connection with, or incidental to, the carrying out of the body's functions under this section, Schedule 5 and Article 43 of the UK GDPR.

(7) The UK national accreditation body must provide the Secretary of State with such information relating to its functions under this section, Schedule 5 and Article 43 of the UK GDPR as the Secretary of State may reasonably require.

(8) In this section—

“certification provider” means a person who issues certification for the purposes of Article 42 of the UK GDPR;

“the UK national accreditation body” means the UK national accreditation body for the purposes of Article 4(1) of Regulation (EC) No 765/2008 of the European Parliament and of the Council of 9 July 2008 setting out the requirements for accreditation and market surveillance relating to the marketing of products and repealing Regulation (EEC) No 339/93.

...

Transfers of personal data to third countries etc

18

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

...

Processing for archiving, research and statistical purposes: safeguards

19

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Minor definition

Meaning of “court”

20

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

CHAPTER 3 — Exemptions for manual unstructured processing and for national security and defence purposes

Definitions

Processing to which this Chapter applies

21

(1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(4) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(5) In this Chapter, “FOI public authority” means—

(a) a public authority as defined in the Freedom of Information Act 2000, ...

(b) a Scottish public authority as defined in the Freedom of Information (Scotland) Act 2002 (asp 13) , or

(6) References in this Chapter to personal data “held” by an FOI public authority are to be interpreted—

(a) in relation to England and Wales and Northern Ireland, in accordance with section 3(2) of the Freedom of Information Act 2000, and

(b) in relation to Scotland, in accordance with section 3(2), (4) and (5) of the Freedom of Information (Scotland) Act 2002 (asp 13),

but such references do not include information held by an intelligence service (as defined in section 82) on behalf of an FOI public authority.

(7) But personal data is not to be treated as “held” by an FOI public authority for the purposes of this Chapter, where—

(a) section 7 of the Freedom of Information Act 2000 prevents Parts 1 to 5 of that Act from applying to the personal data, or

(b) section 7(1) of the Freedom of Information (Scotland) Act 2002 (asp 13) prevents that Act from applying to the personal data.

(8) In relation to the Advanced Research and Invention Agency—

(a) for the purposes of subsection (6)(a)—

(i) section 3(2) of the Freedom of Information Act 2000 is to be read as if “public authority” included that Agency, and

(ii) section 3(2) of the Freedom of Information (Scotland) Act 2002 (asp 13) is to be read as if “authority” included that Agency, and

(b) subsection (7) does not apply.

...

Application of the GDPR to processing to which this Chapter applies

22

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Power to make provision in consequence of regulations related to the GDPR

23

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Exemptions etc

Manual unstructured data held by FOI public authorities

24

(1) The provisions of the UK GDPR and this Act listed in subsection (2) do not apply to personal data to which the UK GDPR applies by virtue of Article 2(1A) (manual unstructured personal data held by FOI public authorities).

(2) Those provisions are—

(a) in Chapter II of the UK GDPR (principles)—

(i) Article 5(1)(a) to (c), (e) and (f) (principles relating to processing, other than the accuracy principle),

(ii) Article 6 (lawfulness),

(iii) Article 7 (conditions for consent),

(iv) Article 8(1) and (2) (child's consent),

(v) Article 9 (processing of special categories of personal data),

(vi) Article 10 (data relating to criminal convictions etc), and

(vii) Article 11(2) (processing not requiring identification);

(b) in Chapter III of the UK GDPR (rights of the data subject)—

(i) Article 13(1) to (3) (personal data collected from data subject: information to be provided),

(ii) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided),

(iii) Article 20 (right to data portability), and

(iv) Article 21(1) (objections to processing);

(c) in Chapter V of the UK GDPR, Articles 44A to 49A (transfers of personal data to third countries or international organisations);

(ca) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(cb) in Part 5 of this Act, section 119A (standard clauses for transfers to third countries);

(d) in Part 7 of this Act, sections 170 and 171 (offences relating to personal data).

(see also paragraph 1(2) of Schedule 18).

(3) In addition, the provisions of the UK GDPR listed in subsection (4) do not apply to personal data to which the UK GDPR applies by virtue of Article 2(1A) where the personal data relates to appointments, removals, pay, discipline, superannuation or other personnel matters in relation to—

(a) service in any of the armed forces of the Crown;

(b) service in any office or employment under the Crown or under any public authority;

(c) service in any office or employment, or under any contract for services, in respect of which power to take action, or to determine or approve the action taken, in such matters is vested in—

(i) Her Majesty,

(ii) a Minister of the Crown,

(iii) the National Assembly for Wales,

(iv) the Welsh Ministers,

(v) a Northern Ireland Minister (within the meaning of the Freedom of Information Act 2000), or

(vi) an FOI public authority.

(4) Those provisions are—

(a) the remaining provisions of Chapters II and III (principles and rights of the data subject);

(b) Chapter IV (controller and processor);

(ba) Chapter 8A (safeguards for processing for research, archiving or statistical purposes);

(5) A controller is not obliged to comply with Article 15(1) to (3) of the UK GDPR (right of access by the data subject) in relation to personal data to which the UK GDPR applies by virtue of Article 2(1A) if—

(a) the request under Article 15 does not contain a description of the personal data, or

(b) the controller estimates that the cost of complying with the request so far as relating to the personal data would exceed the appropriate maximum.

(6) Subsection (5)(b) does not remove the controller's obligation to confirm whether or not personal data concerning the data subject is being processed unless the estimated cost of complying with that obligation alone in relation to the personal data would exceed the appropriate maximum.

(7) An estimate for the purposes of this section must be made in accordance with regulations under section 12(5) of the Freedom of Information Act 2000.

(8) In subsections (5) and (6), “the appropriate maximum” means the maximum amount specified by the Secretary of State by regulations.

(9) Regulations under subsection (8) are subject to the negative resolution procedure.

Manual unstructured data used in longstanding historical research

25

(1) The provisions of the UK GDPR listed in subsection (2) do not apply to personal data to which the UK GDPR applies by virtue of Article 2(1A) (manual unstructured personal data held by FOI public authorities) at any time when—

(a) the personal data—

(i) is subject to processing which was already underway immediately before 24 October 1998, and

(ii) is processed only for the purposes of historical research, and

(b) the processing is not carried out—

(i) for the purposes of measures or decisions with respect to a particular data subject, or

(ii) in a way that causes, or is likely to cause, substantial damage or substantial distress to a data subject.

(2) Those provisions are—

(a) in Chapter II ...(principles), Article 5(1)(d) (the accuracy principle), and

(b) in Chapter III ... (rights of the data subject)—

(i) Article 16 (right to rectification), and

(ii) Article 17(1) and (2) (right to erasure).

(3) The exemptions in this section apply in addition to the exemptions in section 24.

National security and defence exemption

26

(1) A provision of the UK GDPR or this Act mentioned in subsection (2) does not apply to personal data to which the UK GDPR applies if exemption from the provision is required for—

(a) the purpose of safeguarding national security, or

(b) defence purposes.

(2) The provisions are—

(a) Chapter II of the UK GDPR (principles) except for—

(i) Article 5(1)(a) (lawful, fair and transparent processing), so far as it requires processing of personal data to be lawful;

(ii) Article 6 (lawfulness of processing);

(iii) Article 9 (processing of special categories of personal data);

(b) Chapter III of the UK GDPR (rights of data subjects);

(i) Article 33 (notification of personal data breach to the Commissioner);

(ii) Article 34 (communication of personal data breach to the data subject);

(d) Chapter V of the UK GDPR (transfers of personal data to third countries or international organisations);

(e) in Chapter VI of the UK GDPR—

(i) Article 57(1)(a) and (h) (Commissioner's duties to monitor and enforce the UK GDPR and to conduct investigations);

(ii) Article 58 (investigative, corrective, authorisation and advisory powers of Commissioner);

(f) Chapter VIII of the UK GDPR (remedies, liabilities and penalties) except for—

(ai) Article 77 (right to lodge a complaint with the Commissioner);

(i) Article 83 (general conditions for imposing administrative fines);

(ii) Article 84 (penalties);

(fa) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(g) in Part 5 of this Act—

(i) in section 115 (general functions of the Commissioner), subsections (3) and (8);

(ii) in section 115, subsection (9), so far as it relates to Article 58(2)(i) of the UK GDPR;

(iii) section 119 (inspection in accordance with international obligations);

(iv) section 119A (standard clauses for transfers to third countries);

(h) in Part 6 of this Act—

(i) sections 142 to 154 and Schedule 15 (Commissioner's notices and powers of entry and inspection);

(ii) sections 170 to 173 (offences relating to personal data);

(i) in Part 7 of this Act, section 187 (representation of data subjects).

National security: certificate

27

(1) Subject to subsection (3), a certificate signed by a Minister of the Crown certifying that exemption from all or any of the provisions listed in section 26(2) is, or at any time was, required in relation to any personal data for the purpose of safeguarding national security is conclusive evidence of that fact.

(2) A certificate under subsection (1)—

(a) may identify the personal data to which it applies by means of a general description, and

(b) may be expressed to have prospective effect.

(3) Any person directly affected by a certificate under subsection (1) may appeal to the Tribunal against the certificate.

(4) If, on an appeal under subsection (3), the Tribunal finds that, applying the principles applied by a court on an application for judicial review, the Minister did not have reasonable grounds for issuing a certificate, the Tribunal may—

(a) allow the appeal, and

(b) quash the certificate.

(5) Where, in any proceedings under or by virtue of the UK GDPR or this Act, it is claimed by a controller that a certificate under subsection (1) which identifies the personal data to which it applies by means of a general description applies to any personal data, another party to the proceedings may appeal to the Tribunal on the ground that the certificate does not apply to the personal data in question.

(6) But, subject to any determination under subsection (7), the certificate is to be conclusively presumed so to apply.

(7) On an appeal under subsection (5), the Tribunal may determine that the certificate does not so apply.

(8) A document purporting to be a certificate under subsection (1) is to be—

(a) received in evidence, and

(b) deemed to be such a certificate unless the contrary is proved.

(9) A document which purports to be certified by or on behalf of a Minister of the Crown as a true copy of a certificate issued by that Minister under subsection (1) is—

(a) in any legal proceedings, evidence of that certificate;

(b) in any legal proceedings in Scotland, sufficient evidence of that certificate.

(10) The power conferred by subsection (1) on a Minister of the Crown is exercisable only by—

(a) a Minister who is a member of the Cabinet, or

(b) the Attorney General or the Advocate General for Scotland.

National security and defence: modifications to Articles 9 and 32 of the applied GDPR

28

(1) Article 9(1) of the UK GDPR (prohibition on processing of special categories of personal data) does not prohibit the processing of personal data to which the UK GDPR applies to the extent that the processing is carried out—

(a) for the purpose of safeguarding national security or for defence purposes, and

(b) with appropriate safeguards for the rights and freedoms of data subjects.

(2) Article 32 of the UK GDPR (security of processing) does not apply to a controller or processor to the extent that the controller or the processor (as the case may be) is processing personal data to which the UK GDPR applies for—

(a) the purpose of safeguarding national security, or

(b) defence purposes.

(3) Where Article 32 of the UK GDPR does not apply, the controller or the processor must implement security measures appropriate to the risks arising from the processing of the personal data.

(4) For the purposes of subsection (3), where the processing of personal data is carried out wholly or partly by automated means, the controller or the processor must, following an evaluation of the risks, implement measures designed to—

(a) prevent unauthorised processing or unauthorised interference with the systems used in connection with the processing,

(b) ensure that it is possible to establish the precise details of any processing that takes place,

(c) ensure that any systems used in connection with the processing function properly and may, in the case of interruption, be restored, and

(d) ensure that stored personal data cannot be corrupted if a system used in connection with the processing malfunctions.

(5) The functions conferred on the Commissioner in relation to the UK GDPR by Articles 57(1)(a), (d), (e), (h) and (u) and 58(1)(d) and (2)(a) to (d) of the UK GDPR (which are subject to safeguards set out in section 115) include functions in relation to subsection (3).

PART 3 — Law enforcement processing

CHAPTER 1 — Scope and definitions

Scope

Processing to which this Part applies

29

(1) This Part applies to—

(a) the processing by a competent authority of personal data wholly or partly by automated means, and

(b) the processing by a competent authority otherwise than by automated means of personal data which forms part of a filing system or is intended to form part of a filing system.

(1A) This Part does not apply to processing to which Part 4 applies by virtue of a designation notice (see section 82A).

(2) Any reference in this Part to the processing of personal data is to processing to which this Part applies.

(3) For the meaning of “competent authority”, see section 30.

Definitions

Meaning of “competent authority”

30

(1) In this Part, “competent authority” means—

(a) a person specified or described in Schedule 7, and

(b) any other person if and to the extent that the person has statutory functions for any of the law enforcement purposes.

(2) But an intelligence service is not a competent authority within the meaning of this Part.

(3) The Secretary of State may by regulations amend Schedule 7—

(a) so as to add or remove a person or description of person;

(b) so as to reflect any change in the name of a person specified in the Schedule.

(4) Regulations under subsection (3) which make provision of the kind described in subsection (3)(a) may also make consequential amendments of section 73(4)(b).

(5) Regulations under subsection (3) which make provision of the kind described in subsection (3)(a), or which make provision of that kind and of the kind described in subsection (3)(b), are subject to the affirmative resolution procedure.

(6) Regulations under subsection (3) which make provision only of the kind described in subsection (3)(b) are subject to the negative resolution procedure.

(7) In this section—

“intelligence service” means—the Security Service;the Secret Intelligence Service;the Government Communications Headquarters;

“statutory function” means a function under or by virtue of an enactment.

“The law enforcement purposes”

31

For the purposes of this Part, “the law enforcement purposes” are the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.

Meaning of “controller” and “processor”

32

(1) In this Part, “controller” means the competent authority which, alone or jointly with others—

(a) determines the purposes and means of the processing of personal data, or

(b) is the controller by virtue of subsection (2).

(2) Where personal data is processed only—

(a) for purposes for which it is required by an enactment to be processed, and

(b) by means by which it is required by an enactment to be processed,

the competent authority on which the obligation to process the data is imposed by the enactment (or, if different, one of the enactments) is the controller.

(3) In this Part, “processor” means any person who processes personal data on behalf of the controller (other than a person who is an employee of the controller).

Other definitions

33

(1) This section defines certain other expressions used in this Part.

(2) “Employee”, in relation to any person, includes an individual who holds a position (whether paid or unpaid) under the direction and control of that person.

(3) “Personal data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

(4) “Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to an individual, in particular to analyse or predict aspects concerning that individual's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

(5) “Recipient”, in relation to any personal data, means any person to whom the data is disclosed, whether a third party or not, but it does not include a public authority to whom disclosure is or may be made in the framework of a particular inquiry in accordance with the law.

(6) “Restriction of processing” means the marking of stored personal data with the aim of limiting its processing for the future.

(6A) “Sensitive processing” has the meaning given in section 35(8).

(7) “Third country” means a country or territory outside the United Kingdom.

(8) Sections 3 and 205 include definitions of other expressions used in this Part.

CHAPTER 2 — Principles

Overview and general duty of controller

34

(1) This Chapter sets out the six data protection principles as follows—

(a) section 35(1) sets out the first data protection principle (requirement that processing be lawful and fair);

(b) section 36(1) sets out the second data protection principle (requirement that purposes of processing be specified, explicit and legitimate);

(c) section 37 sets out the third data protection principle (requirement that personal data be adequate, relevant and not excessive);

(d) section 38(1) sets out the fourth data protection principle (requirement that personal data be accurate and kept up to date);

(e) section 39(1) sets out the fifth data protection principle (requirement that personal data be kept for no longer than is necessary);

(f) section 40 sets out the sixth data protection principle (requirement that personal data be processed in a secure manner).

(2) In addition—

(a) each of sections 35, 36, 38 and 39 makes provision to supplement the principle to which it relates, and

(b) sections 41 and 42 make provision about the safeguards that apply in relation to certain types of processing.

(3) The controller in relation to personal data is responsible for, and must be able to demonstrate, compliance with this Chapter.

The first data protection principle

35

(1) The first data protection principle is that the processing of personal data for any of the law enforcement purposes must be lawful and fair.

(2) The processing of personal data for any of the law enforcement purposes is lawful only if and to the extent that it is based on law and either—

(a) the data subject has given consent to the processing for that purpose, or

(b) the processing is necessary for the performance of a task carried out for that purpose by a competent authority.

(3) In addition, where the processing for any of the law enforcement purposes is sensitive processing, the processing is permitted only in the two cases set out in subsections (4) and (5).

(4) The first case is where—

(a) the data subject has given consent to the processing for the law enforcement purpose as mentioned in subsection (2)(a), and

(b) at the time when the processing is carried out, the controller has an appropriate policy document in place (see section 42).

(5) The second case is where—

(a) the processing is strictly necessary for the law enforcement purpose,

(b) the processing meets at least one of the conditions in Schedule 8, and

(c) at the time when the processing is carried out, the controller has an appropriate policy document in place (see section 42).

(6) The Secretary of State may by regulations amend Schedule 8—

(a) by adding conditions;

(b) by varying or omitting conditions added by regulations under paragraph (a).

(7) Regulations under subsection (6) are subject to the affirmative resolution procedure.

(8) In this Part, “sensitive processing” means—

(a) the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership;

(b) the processing of genetic data, or of biometric data, for the purpose of uniquely identifying an individual;

(d) the processing of data concerning an individual's sex life or sexual orientation.

The second data protection principle

36

(1) The second data protection principle is that—

(a) the law enforcement purpose for which personal data is collected (whether from the data subject or otherwise) must be specified, explicit and legitimate, and

(b) personal data so collected must not be processed by or on behalf of a controller in a manner that is incompatible with the purpose for which the controller collected it.

(2) Paragraph (b) of the second data protection principle is subject to subsections (3) and (4).

(3) Personal data collected for a law enforcement purpose may be processed for any other law enforcement purpose (whether by the controller that collected the data or by another controller) provided that—

(a) the controller is authorised by law to process the data for the other purpose, and

(b) the processing is necessary and proportionate to that other purpose.

(4) Personal data collected for any of the law enforcement purposes may not be processed for a purpose that is not a law enforcement purpose unless the processing is authorised by law.

The third data protection principle

37

The third data protection principle is that personal data processed for any of the law enforcement purposes must be adequate, relevant and not excessive in relation to the purpose for which it is processed.

The fourth data protection principle

38

(1) The fourth data protection principle is that—

(a) personal data processed for any of the law enforcement purposes must be accurate and, where necessary, kept up to date, and

(b) every reasonable step must be taken to ensure that personal data that is inaccurate, having regard to the law enforcement purpose for which it is processed, is erased or rectified without delay.

(2) In processing personal data for any of the law enforcement purposes, personal data based on facts must, so far as possible, be distinguished from personal data based on personal assessments.

(3) In processing personal data for any of the law enforcement purposes, a clear distinction must, where relevant and as far as possible, be made between personal data relating to different categories of data subject, such as—

(a) persons suspected of having committed or being about to commit a criminal offence;

(b) persons convicted of a criminal offence;

(d) witnesses or other persons with information about offences.

(4) All reasonable steps must be taken to ensure that personal data which is inaccurate, incomplete or no longer up to date is not transmitted or made available for any of the law enforcement purposes.

(5) For that purpose—

(a) the quality of personal data must be verified before it is transmitted or made available,

(b) in all transmissions of personal data, the necessary information enabling the recipient to assess the degree of accuracy, completeness and reliability of the data and the extent to which it is up to date must be included, and

(c) if, after personal data has been transmitted, it emerges that the data was incorrect or that the transmission was unlawful, the recipient must be notified without delay.

The fifth data protection principle

39

(1) The fifth data protection principle is that personal data processed for any of the law enforcement purposes must be kept for no longer than is necessary for the purpose for which it is processed.

(2) Appropriate time limits must be established for the periodic review of the need for the continued storage of personal data for any of the law enforcement purposes.

The sixth data protection principle

40

The sixth data protection principle is that personal data processed for any of the law enforcement purposes must be so processed in a manner that ensures appropriate security of the personal data, using appropriate technical or organisational measures (and, in this principle, “appropriate security” includes protection against unauthorised or unlawful processing and against accidental loss, destruction or damage).

Safeguards: archiving

41

(1) This section applies in relation to the processing of personal data for a law enforcement purpose where the processing is carried out—

(a) for archiving purposes in the public interest,

(b) for scientific or historical research purposes, or

(2) The processing is not permitted if—

(a) it is carried out for the purposes of, or in connection with, measures or decisions with respect to a particular data subject, or

(b) it is likely to cause substantial damage or substantial distress to a data subject.

Safeguards: sensitive processing

42

(1) This section applies for the purposes of section 35(4) and (5) (which require a controller to have an appropriate policy document in place when carrying out sensitive processing in reliance on the consent of the data subject or, as the case may be, in reliance on a condition specified in Schedule 8).

(2) The controller has an appropriate policy document in place in relation to the sensitive processing if the controller has produced a document which—

(a) explains the controller's procedures for securing compliance with the data protection principles (see section 34(1)) in connection with sensitive processing in reliance on the consent of the data subject or (as the case may be) in reliance on the condition in question, and

(b) explains the controller's policies as regards the retention and erasure of personal data processed in reliance on the consent of the data subject or (as the case may be) in reliance on the condition in question, giving an indication of how long such personal data is likely to be retained.

(3) Where personal data is processed on the basis that an appropriate policy document is in place, the controller must during the relevant period—

(a) retain the appropriate policy document,

(b) review and (if appropriate) update it from time to time, and

(4) The record maintained by the controller under section 61(1) and, where the sensitive processing is carried out by a processor on behalf of the controller, the record maintained by the processor under section 61(3) must include the following information—

(a) whether the sensitive processing is carried out in reliance on the consent of the data subject or, if not, which condition in Schedule 8 is relied on,

(b) how the processing satisfies section 35 (lawfulness of processing), and

(c) whether the personal data is retained and erased in accordance with the policies described in subsection (2)(b) and, if it is not, the reasons for not following those policies.

(5) In this section, “relevant period”, in relation to sensitive processing in reliance on the consent of the data subject or in reliance on a condition specified in Schedule 8, means a period which—

(a) begins when the controller starts to carry out the sensitive processing in reliance on the data subject's consent or (as the case may be) in reliance on that condition, and

(b) ends at the end of the period of 6 months beginning when the controller ceases to carry out the processing.

CHAPTER 3 — Rights of the data subject

Overview and scope

43

(1) This Chapter—

(a) imposes general duties on the controller to make information available (see sections 44 and 45A);

(b) confers a right of access by the data subject (see sections 45 and 45A);

(c) confers rights on the data subject with respect to the rectification of personal data and the erasure of personal data or the restriction of its processing (see sections 46 to 48);

(d) regulates automated decision-making (see sections 50A to 50D);

(e) makes supplementary provision (see sections 51 to 54).

(2) This Chapter applies only in relation to the processing of personal data for a law enforcement purpose.

(3) But sections 44 to 48 do not apply in relation to the processing of relevant personal data in the course of a criminal investigation or criminal proceedings, including proceedings for the purpose of executing a criminal penalty.

(4) In subsection (3), “relevant personal data” means personal data contained in a judicial decision or in other documents relating to the investigation or proceedings which are created by or on behalf of a court or other judicial authority.

(5) In this Chapter, “the controller”, in relation to a data subject, means the controller in relation to personal data relating to the data subject.

Data subject’s rights to information

Information: controller’s general duties

44

(1) The controller must make available to data subjects the following information (whether by making the information generally available to the public or in any other way)—

(a) the identity and the contact details of the controller;

(b) where applicable, the contact details of the data protection officer (see sections 69 to 71);

(d) the existence of the rights of data subjects to request from the controller—

(i) access to personal data (see section 45),

(ii) rectification of personal data (see section 46), and

(iii) erasure of personal data or the restriction of its processing (see section 47);

(e) the existence of the right to lodge a complaint with the Commissioner and the contact details of the Commissioner.

(2) The controller must also, in specific cases for the purpose of enabling the exercise of a data subject's rights under this Part, give the data subject the following—

(a) information about the legal basis for the processing;

(b) information about the period for which the personal data will be stored or, where that is not possible, about the criteria used to determine that period;

(c) where applicable, information about the categories of recipients of the personal data (including recipients in third countries or international organisations);

(d) such further information as is necessary to enable the exercise of the data subject's rights under this Part.

(3) An example of where further information may be necessary as mentioned in subsection (2)(d) is where the personal data being processed was collected without the knowledge of the data subject.

(4) The controller may restrict, wholly or partly, the provision of information to the data subject under subsection (2) to the extent that and for so long as the restriction is, having regard to the fundamental rights and legitimate interests of the data subject, a necessary and proportionate measure to—

(a) avoid obstructing an official or legal inquiry, investigation or procedure;

(b) avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;

(d) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(e) protect the rights and freedoms of others.

(5) Where the provision of information to a data subject under subsection (2) is restricted under subsection (4), wholly or partly, the controller must inform the data subject in writing without undue delay—

(a) that the provision of information has been restricted,

(b) of the reasons for the restriction,

(d) of the data subject's right to lodge a complaint with the Commissioner, and

(e) of the data subject's right to apply to a court under section 167.

(6) Subsection (5)(a) and (b) do not apply to the extent that complying with them would undermine the purpose of the restriction.

(7) The controller must—

(a) record the reasons for a decision to restrict (whether wholly or partly) the provision of information to a data subject under subsection (2) in reliance on subsection (4), and

(b) if requested to do so by the Commissioner, make the record available to the Commissioner.

...

Right of access by the data subject

45

(1) A data subject is entitled to obtain from the controller—

(a) confirmation as to whether or not personal data concerning him or her is being processed, and

(b) where that is the case, access to the personal data and the information set out in subsection (2).

(2) That information is—

(a) the purposes of and legal basis for the processing;

(b) the categories of personal data concerned;

(c) the recipients or categories of recipients to whom the personal data has been disclosed (including recipients or categories of recipients in third countries or international organisations);

(d) the period for which it is envisaged that the personal data will be stored or, where that is not possible, the criteria used to determine that period;

(e) the existence of the data subject's rights to request from the controller—

(i) rectification of personal data (see section 46), and

(ii) erasure of personal data or the restriction of its processing (see section 47);

(f) the existence of the data subject's right to lodge a complaint with the Commissioner and the contact details of the Commissioner;

(g) communication of the personal data undergoing processing and of any available information as to its origin.

(2A) Under subsection (1), the data subject is only entitled to such confirmation, personal data and other information as the controller is able to provide based on a reasonable and proportionate search for the personal data and other information described in that subsection.

(3) Where a data subject makes a request under subsection (1), the information to which the data subject is entitled must be provided in writing —

(a) without undue delay, and

(b) in any event, before the end of the applicable time period (as to which see section 54).

(4) The controller may restrict, wholly or partly, the rights conferred by subsection (1) to the extent that and for so long as the restriction is, having regard to the fundamental rights and legitimate interests of the data subject, a necessary and proportionate measure to—

(a) avoid obstructing an official or legal inquiry, investigation or procedure;

(b) avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;

(d) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(e) protect the rights and freedoms of others.

(5) Where the rights of a data subject under subsection (1) are restricted under subsection (4), wholly or partly, the controller must inform the data subject in writing without undue delay and in any event before the end of the applicable time period (as to which see section 54)—

(a) that the rights of the data subject have been restricted,

(b) of the reasons for the restriction,

(d) of the data subject's right to lodge a complaint with the Commissioner, and

(e) of the data subject's right to apply to a court under section 167.

(6) Subsection (5)(a) and (b) do not apply to the extent that the provision of the information would undermine the purpose of the restriction.

(7) The controller must—

(a) record the reasons for a decision to restrict (whether wholly or partly) the rights of a data subject under subsection (1) in reliance on subsection (4), and

(b) if requested to do so by the Commissioner, make the record available to the Commissioner.

Data subject's rights to rectification or erasure etc

Right to rectification

46

(1) The controller must, if so requested by a data subject, rectify without undue delay inaccurate personal data relating to the data subject.

(2) Where personal data is inaccurate because it is incomplete, the controller must, if so requested by a data subject, complete it.

(3) The duty under subsection (2) may, in appropriate cases, be fulfilled by the provision of a supplementary statement.

(4) Where the controller would be required to rectify personal data under this section but the personal data must be maintained for the purposes of evidence, the controller must (instead of rectifying the personal data) restrict its processing.

Right to erasure or restriction of processing

47

(1) The controller must erase personal data without undue delay where—

(a) the processing of the personal data would infringe section 35, 36(1) to (3), 37, 38(1), 39(1), 40, 41 or 42, or

(b) the controller has a legal obligation to erase the data.

(2) Where the controller would be required to erase personal data under subsection (1) but the personal data must be maintained for the purposes of evidence, the controller must (instead of erasing the personal data) restrict its processing.

(3) Where a data subject contests the accuracy of personal data (whether in making a request under this section or section 46 or in any other way), but it is not possible to ascertain whether it is accurate or not, the controller must restrict its processing.

(4) A data subject may request the controller to erase personal data or to restrict its processing (but the duties of the controller under this section apply whether or not such a request is made).

Rights under section 46 or 47: supplementary

48

(1) Where a data subject requests the rectification or erasure of personal data or the restriction of its processing, the controller must inform the data subject in writing—

(a) whether the request has been granted, and

(b) if it has been refused—

(i) of the reasons for the refusal,

(ii) of the data subject's right to make a request to the Commissioner under section 51,

(iii) of the data subject's right to lodge a complaint with the Commissioner, and

(iv) of the data subject's right to apply to a court under section 167.

(2) The controller must comply with the duty under subsection (1)—

(a) without undue delay, and

(b) in any event, before the end of the applicable time period (see section 54).

(3) The controller may restrict, wholly or partly, the provision of information to the data subject under subsection (1)(b)(i) to the extent that and for so long as the restriction is, having regard to the fundamental rights and legitimate interests of the data subject, a necessary and proportionate measure to—

(a) avoid obstructing an official or legal inquiry, investigation or procedure;

(b) avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;

(d) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(e) protect the rights and freedoms of others.

(4) Where the rights of a data subject under subsection (1)(b)(i) are restricted under subsection (3), wholly or partly, the controller must inform the data subject in writing without undue delay—

(a) that the rights of the data subject have been restricted,

(b) of the reasons for the restriction,

(d) of the data subject's right to apply to a court under section 167.

(5) Subsection (4)(a) and (b) do not apply to the extent that the provision of the information would undermine the purpose of the restriction.

(6) The controller must—

(a) record the reasons for a decision to restrict (whether wholly or partly) the provision of information to a data subject under subsection (1)(b)(i) in reliance on subsection (3), and

(b) if requested to do so by the Commissioner, make the record available to the Commissioner.

(7) Where the controller rectifies personal data, it must notify the competent authority (if any) from which the inaccurate personal data originated.

(8) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(9) Where the controller rectifies, erases or restricts the processing of personal data which has been disclosed by the controller—

(a) the controller must notify the recipients, and

(b) the recipients must similarly rectify, erase or restrict the processing of the personal data (so far as they retain responsibility for it).

(10) Where processing is restricted in accordance with section 47(3), the controller must inform the data subject before lifting the restriction.

Automated individual decision-making

Right not to be subject to automated decision-making

49

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Automated decision-making authorised by law: safeguards

50

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Supplementary

Exercise of rights through the Commissioner

51

(1) This section applies where a controller—

(a) restricts under section 44(4) the information provided to the data subject under section 44(2) (duty of the controller to give the data subject additional information),

(b) restricts under section 45(4) the data subject's rights under section 45(1) (right of access),

(ba) relies on the exemption from sections 44(2) and 45(1) in section 45A (legal professional privilege), or

(c) refuses a request by the data subject for rectification under section 46 or for erasure or restriction of processing under section 47.

(2) The data subject may—

(a) where subsection (1)(a) or (b) applies, request the Commissioner to check that the restriction imposed by the controller was lawful;

(aa) where subsection (1)(ba) applies, request the Commissioner to check that the controller was entitled to rely on the exemption;

(b) where subsection (1)(c) applies, request the Commissioner to check that the refusal of the data subject's request was lawful.

(3) The Commissioner must take such steps as appear to the Commissioner to be appropriate to respond to a request under subsection (2) (which may include the exercise of any of the powers conferred by sections 142 and 146).

(4) After taking those steps, the Commissioner must inform the data subject—

(a) where subsection (1)(a) or (b) applies, whether the Commissioner is satisfied that the restriction imposed by the controller was lawful;

(aa) where subsection (1)(ba) applies, whether the Commissioner is satisfied that the controller was entitled to rely on the exemption;

(b) where subsection (1)(c) applies, whether the Commissioner is satisfied that the controller's refusal of the data subject's request was lawful.

(5) The Commissioner must also inform the data subject of the data subject's right to apply to a court under section 167.

(6) Where the Commissioner is not satisfied as mentioned in subsection (4)(a) , (aa) or (b), the Commissioner may also inform the data subject of any further steps that the Commissioner is considering taking under Part 6 .

Form of provision of information etc

52

(1) The controller must take reasonable steps to ensure that any information that is required by or under this Chapter to be provided to the data subject is provided in a concise, intelligible and easily accessible form, using clear and plain language.

(2) Subject to subsection (3), the information may be provided in any form, including electronic form.

(3) Where information is provided in response to a request made by the data subject under or by virtue of any of sections 45, 46, 47, 50C or 50D, the controller must provide the information in the same form as the request where it is practicable to do so.

(4) Where the controller has reasonable doubts about the identity of an individual making a request under or by virtue of any of sections 45, 46, 47, 50C or 50D, the controller may—

(a) request the provision of additional information to enable the controller to confirm the identity, and

(b) delay dealing with the request until the identity is confirmed.

(5) Subject to section 53, any information that is required by or under this Chapter to be provided to the data subject must be provided free of charge.

(6) The controller must facilitate the exercise of the rights of the data subject arising under or by virtue of sections 45 to 50D.

Manifestly unfounded or excessive requests by the data subject

53

(1) Where a request made by a data subject under or by virtue of any of sections 45, 46, 47, 50C or 50D is manifestly unfounded or excessive, the controller may—

(a) charge a reasonable fee for dealing with the request, or

(b) refuse to act on the request.

(2) An example of a request that may be excessive is one that merely repeats the substance of previous requests.

(3) In any proceedings where there is an issue as to whether a request described in subsection (1) is manifestly unfounded or excessive, it is for the controller to show that it is.

(4) The Secretary of State may by regulations specify limits on the fees that a controller may charge in accordance with subsection (1)(a).

(4A) The Secretary of State may by regulations—

(a) require controllers of a description specified in the regulations to produce and publish guidance about the fees that they charge in accordance with subsection (1)(a), and

(b) specify what the guidance must include.

(5) Regulations under this section are subject to the negative resolution procedure.

(6) If, in reliance on subsection (1)(b), the controller does not take action on the request, the controller must inform the data subject of—

(a) the reasons for not doing so, and

(b) the data subject’s right to lodge a complaint with the Commissioner.

(7) The controller must comply with subsection (6)—

(a) without undue delay, and

(b) in any event, before the end of the applicable time period (as to which see section 54).

Meaning of “applicable time period”

54

(1) This section defines “the applicable time period” for the purposes of sections 45(3)(b) and (5) , 48(2)(b) and 53(7).

(2) “The applicable time period” means the period of one month beginning with the relevant time , subject to subsection (3A).

(3) “The relevant time” means the latest of the following—

(a) when the controller receives the request in question;

(b) when the controller receives the information (if any) requested in connection with a request under section 52(4);

(3A) The controller may, by giving notice to the data subject, extend the applicable time period by two further months where that is necessary by reason of—

(a) the complexity of requests made by the data subject, or

(b) the number of such requests.

(3B) A notice under subsection (3A) must—

(a) be given before the end of the period of one month beginning with the relevant time, and

(b) state the reasons for the delay.

(3C) Where the controller reasonably requires further information in order to identify the information or processing activities to which a request under section 45(1) relates—

(a) the controller may ask the data subject to provide the further information, and

(b) the period beginning with the day on which the controller makes the request and ending with the day on which the controller receives the information does not count towards—

(i) the applicable time period, or

(ii) the period described in subsection (3B)(a).

(3D) An example of a case in which a controller may reasonably require further information is where the controller processes a large amount of information concerning the data subject.

(4) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(5) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(6) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

CHAPTER 4 — Controller and processor

Overview and scope

55

(1) This Chapter—

(a) sets out the general obligations of controllers and processors (see sections 56 to 65);

(b) sets out specific obligations of controllers and processors with respect to security (see section 66);

(c) sets out specific obligations of controllers and processors with respect to personal data breaches (see sections 67 and 68);

(d) makes provision for the designation, position and tasks of data protection officers (see sections 69 to 71);

(e) makes provision about codes of conduct (see section 71A).

(2) This Chapter applies only in relation to the processing of personal data for a law enforcement purpose.

(3) Where a controller is required by any provision of this Chapter to implement appropriate technical and organisational measures, the controller must (in deciding what measures are appropriate) take into account—

(a) the latest developments in technology,

(b) the cost of implementation,

(d) the risks for the rights and freedoms of individuals arising from the processing.

General obligations

General obligations of the controller

56

(1) Each controller must implement appropriate technical and organisational measures to ensure, and to be able to demonstrate, that the processing of personal data complies with the requirements of this Part.

(2) Where proportionate in relation to the processing, the measures implemented to comply with the duty under subsection (1) must include appropriate data protection policies.

(3) The technical and organisational measures implemented under subsection (1) must be reviewed and updated where necessary.

(4) Adherence to a code of conduct approved under section 71A may be used by a controller as a means of demonstrating compliance with the requirements of this Part.

Data protection by design and default

57

(1) Each controller must implement appropriate technical and organisational measures which are designed—

(a) to implement the data protection principles in an effective manner, and

(b) to integrate into the processing itself the safeguards necessary for that purpose.

(2) The duty under subsection (1) applies both at the time of the determination of the means of processing the data and at the time of the processing itself.

(3) Each controller must implement appropriate technical and organisational measures for ensuring that, by default, only personal data which is necessary for each specific purpose of the processing is processed.

(4) The duty under subsection (3) applies to—

(a) the amount of personal data collected,

(b) the extent of its processing,

(d) its accessibility.

(5) In particular, the measures implemented to comply with the duty under subsection (3) must ensure that, by default, personal data is not made accessible to an indefinite number of people without an individual's intervention.

Joint controllers

58

(1) Where two or more competent authorities jointly determine the purposes and means of processing personal data, they are joint controllers for the purposes of this Part.

(2) Joint controllers must, in a transparent manner, determine their respective responsibilities for compliance with this Part by means of an arrangement between them, except to the extent that those responsibilities are determined under or by virtue of an enactment.

(3) The arrangement must designate the controller which is to be the contact point for data subjects.

Processors

59

(1) This section applies to the use by a controller of a processor to carry out processing of personal data on behalf of the controller.

(2) The controller may use only a processor who provides guarantees to implement appropriate technical and organisational measures that are sufficient to secure that the processing will—

(a) meet the requirements of this Part, and

(b) ensure the protection of the rights of the data subject.

(3) The processor used by the controller may not engage another processor (“a sub-processor”) without the prior written authorisation of the controller, which may be specific or general.

(4) Where the controller gives a general written authorisation to a processor, the processor must inform the controller if the processor proposes to add to the number of sub-processors engaged by it or to replace any of them (so that the controller has the opportunity to object to the proposal).

(5) The processing by the processor must be governed by a contract in writing between the controller and the processor setting out the following—

(a) the subject-matter and duration of the processing;

(b) the nature and purpose of the processing;

(d) the obligations and rights of the controller and processor.

(6) The contract must, in particular, provide that the processor must—

(a) act only on instructions from the controller,

(b) ensure that the persons authorised to process personal data are subject to an appropriate duty of confidentiality,

(c) assist the controller by any appropriate means to ensure compliance with the rights of the data subject under this Part,

(d) at the end of the provision of services by the processor to the controller—

(i) either delete or return to the controller (at the choice of the controller) the personal data to which the services relate, and

(ii) delete copies of the personal data unless subject to a legal obligation to store the copies,

(e) make available to the controller all information necessary to demonstrate compliance with this section, and

(f) comply with the requirements of this section for engaging sub-processors.

(7) The terms included in the contract in accordance with subsection (6)(a) must provide that the processor may transfer personal data to a third country or international organisation only if instructed by the controller to make the particular transfer.

(7A) Adherence to a code of conduct approved under section 71A may be used by a processor as a means of demonstrating sufficient guarantees as described in subsection (2).

(8) If a processor determines, in breach of this Part, the purposes and means of processing, the processor is to be treated for the purposes of this Part as a controller in respect of that processing.

Processing under the authority of the controller or processor

60

A processor, and any person acting under the authority of a controller or processor, who has access to personal data may not process the data except—

(a) on instructions from the controller, or

(b) to comply with a legal obligation.

Records of processing activities

61

(1) Each controller must maintain a record of all categories of processing activities for which the controller is responsible.

(2) The controller's record must contain the following information—

(a) the name and contact details of the controller;

(b) where applicable, the name and contact details of the joint controller;

(d) the purposes of the processing;

(e) the categories of recipients to whom personal data has been or will be disclosed (including recipients in third countries or international organisations);

(f) a description of the categories of—

(i) data subject, and

(ii) personal data;

(g) where applicable, details of the use of profiling;

(h) where applicable, the categories of transfers of personal data to a third country or an international organisation;

(i) an indication of the legal basis for the processing operations, including transfers, for which the personal data is intended;

(j) where possible, the envisaged time limits for erasure of the different categories of personal data;

(k) where possible, a general description of the technical and organisational security measures referred to in section 66.

(3) Each processor must maintain a record of all categories of processing activities carried out on behalf of a controller.

(4) The processor's record must contain the following information—

(a) the name and contact details of the processor and of any other processors engaged by the processor in accordance with section 59(3);

(b) the name and contact details of the controller on behalf of which the processor is acting;

(d) the categories of processing carried out on behalf of the controller;

(e) where applicable, details of transfers of personal data to a third country or an international organisation where explicitly instructed to do so by the controller, including the identification of that third country or international organisation;

(f) where possible, a general description of the technical and organisational security measures referred to in section 66.

(5) The controller and the processor must make the records kept under this section available to the Commissioner on request.

Logging

62

(1) A controller (or, where personal data is processed on behalf of the controller by a processor, the processor) must keep logs for at least the following processing operations in automated processing systems—

(a) collection;

(b) alteration;

(d) disclosure (including transfers);

(e) combination;

(f) erasure.

(2) The logs of consultation must make it possible to establish—

(a) the justification for, and date and time of, the consultation, and

(b) so far as possible, the identity of the person who consulted the data.

(3) The logs of disclosure must make it possible to establish—

(a) the justification for, and date and time of, the disclosure, and

(b) so far as possible—

(i) the identity of the person who disclosed the data, and

(ii) the identity of the recipients of the data.

(4) The logs kept under subsection (1) may be used only for one or more of the following purposes—

(a) to verify the lawfulness of processing;

(b) to assist with self-monitoring by the controller or (as the case may be) the processor, including the conduct of internal disciplinary proceedings;

(d) the purposes of criminal proceedings.

(5) The controller or (as the case may be) the processor must make the logs available to the Commissioner on request.

Co-operation with the Commissioner

63

Each controller and each processor must co-operate, on request, with the Commissioner in the performance of the Commissioner's tasks.

Data protection impact assessment

64

(1) Where a type of processing is likely to result in a high risk to the rights and freedoms of individuals, the controller must, prior to the processing, carry out a data protection impact assessment.

(2) A data protection impact assessment is an assessment of the impact of the envisaged processing operations on the protection of personal data.

(3) A data protection impact assessment must include the following—

(a) a general description of the envisaged processing operations;

(b) an assessment of the risks to the rights and freedoms of data subjects;

(d) safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this Part, taking into account the rights and legitimate interests of the data subjects and other persons concerned.

(4) In deciding whether a type of processing is likely to result in a high risk to the rights and freedoms of individuals, the controller must take into account the nature, scope, context and purposes of the processing.

Prior consultation with the Commissioner

65

(1) This section applies where a controller intends to create a filing system and process personal data forming part of it.

(2) The controller must consult the Commissioner prior to the processing if a data protection impact assessment prepared under section 64 indicates that the processing of the data would result in a high risk to the rights and freedoms of individuals (in the absence of measures to mitigate the risk).

(3) Where the controller is required to consult the Commissioner under subsection (2), the controller must give the Commissioner—

(a) the data protection impact assessment prepared under section 64, and

(b) any other information requested by the Commissioner to enable the Commissioner to make an assessment of the compliance of the processing with the requirements of this Part.

(4) Where the Commissioner is of the opinion that the intended processing referred to in subsection (1) would infringe any provision of this Part, the Commissioner must provide written advice to the controller and, where the controller is using a processor, to the processor.

(5) The written advice must be provided before the end of the period of 6 weeks beginning with receipt of the request for consultation by the controller or the processor.

(6) The Commissioner may extend the period of 6 weeks by a further period of 1 month, taking into account the complexity of the intended processing.

(7) If the Commissioner extends the period of 6 weeks, the Commissioner must—

(a) inform the controller and, where applicable, the processor of any such extension before the end of the period of 1 month beginning with receipt of the request for consultation, and

(b) provide reasons for the delay.

Obligations relating to security

Security of processing

66

(1) Each controller and each processor must implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks arising from the processing of personal data.

(2) In the case of automated processing, each controller and each processor must, following an evaluation of the risks, implement measures designed to—

(a) prevent unauthorised processing or unauthorised interference with the systems used in connection with it,

(b) ensure that it is possible to establish the precise details of any processing that takes place,

(c) ensure that any systems used in connection with the processing function properly and may, in the case of interruption, be restored, and

(d) ensure that stored personal data cannot be corrupted if a system used in connection with the processing malfunctions.

(3) Adherence to a code of conduct approved under section 71A may be used by a controller or processor as a means of demonstrating compliance with subsection (1).

Obligations relating to personal data breaches

Notification of a personal data breach to the Commissioner

67

(1) If a controller becomes aware of a personal data breach in relation to personal data for which the controller is responsible, the controller must notify the breach to the Commissioner—

(a) without undue delay, and

(b) where feasible, not later than 72 hours after becoming aware of it.

(2) Subsection (1) does not apply if the personal data breach is unlikely to result in a risk to the rights and freedoms of individuals.

(3) Where the notification to the Commissioner is not made within 72 hours, the notification must be accompanied by reasons for the delay.

(4) Subject to subsection (5), the notification must include—

(a) a description of the nature of the personal data breach including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;

(b) the name and contact details of the data protection officer or other contact point from whom more information can be obtained;

(d) a description of the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

(5) Where and to the extent that it is not possible to provide all the information mentioned in subsection (4) at the same time, the information may be provided in phases without undue further delay.

(6) The controller must record the following information in relation to a personal data breach—

(a) the facts relating to the breach,

(b) its effects, and

(7) The information mentioned in subsection (6) must be recorded in such a way as to enable the Commissioner to verify compliance with this section.

(8) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(9) If a processor becomes aware of a personal data breach (in relation to personal data processed by the processor), the processor must notify the controller without undue delay.

Communication of a personal data breach to the data subject

68

(1) Where a personal data breach is likely to result in a high risk to the rights and freedoms of individuals, the controller must inform the data subject of the breach without undue delay.

(2) The information given to the data subject must include the following—

(a) a description of the nature of the breach;

(b) the name and contact details of the data protection officer or other contact point from whom more information can be obtained;

(d) a description of the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

(3) The duty under subsection (1) does not apply where—

(a) the controller has implemented appropriate technological and organisational protection measures which were applied to the personal data affected by the breach,

(b) the controller has taken subsequent measures which ensure that the high risk to the rights and freedoms of data subjects referred to in subsection (1) is no longer likely to materialise, or

(4) An example of a case which may fall within subsection (3)(a) is where measures that render personal data unintelligible to any person not authorised to access the data have been applied, such as encryption.

(5) In a case falling within subsection (3)(c) (but not within subsection (3)(a) or (b)), the information mentioned in subsection (2) must be made available to the data subject in another equally effective way, for example, by means of a public communication.

(6) Where the controller has not informed the data subject of the breach the Commissioner, on being notified under section 67 and after considering the likelihood of the breach resulting in a high risk, may—

(a) require the controller to notify the data subject of the breach, or

(b) decide that the controller is not required to do so because any of paragraphs (a) to (c) of subsection (3) applies.

(7) The controller may restrict, wholly or partly, the provision of information to the data subject under subsection (1) to the extent that and for so long as the restriction is, having regard to the fundamental rights and legitimate interests of the data subject, a necessary and proportionate measure to—

(a) avoid obstructing an official or legal inquiry, investigation or procedure;

(b) avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;

(d) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(e) protect the rights and freedoms of others.

(8) Subsection (6) does not apply where the controller's decision not to inform the data subject of the breach was made in reliance on subsection (7).

(9) The duties in section 52(1) and (2) apply in relation to information that the controller is required to provide to the data subject under this section as they apply in relation to information that the controller is required to provide to the data subject under Chapter 3 .

Data protection officers

Designation of a data protection officer

69

(1) The controller must designate a data protection officer, unless the controller is a court, or other judicial authority, acting in its judicial capacity.

(2) When designating a data protection officer, the controller must have regard to the professional qualities of the proposed officer, in particular—

(a) the proposed officer's expert knowledge of data protection law and practice, and

(b) the ability of the proposed officer to perform the tasks mentioned in section 71.

(3) The same person may be designated as a data protection officer by several controllers, taking account of their organisational structure and size.

(4) The controller must publish the contact details of the data protection officer and communicate these to the Commissioner.

Position of data protection officer

70

(1) The controller must ensure that the data protection officer is involved, properly and in a timely manner, in all issues which relate to the protection of personal data.

(2) The controller must provide the data protection officer with the necessary resources and access to personal data and processing operations to enable the data protection officer to—

(a) perform the tasks mentioned in section 71, and

(b) maintain his or her expert knowledge of data protection law and practice.

(3) The controller—

(a) must ensure that the data protection officer does not receive any instructions regarding the performance of the tasks mentioned in section 71;

(b) must ensure that the data protection officer does not perform a task or fulfil a duty other than those mentioned in this Part where such task or duty would result in a conflict of interests;

(4) A data subject may contact the data protection officer with regard to all issues relating to—

(a) the processing of that data subject's personal data, or

(b) the exercise of that data subject's rights under this Part.

(5) The data protection officer, in the performance of this role, must report to the highest management level of the controller.

Tasks of data protection officer

71

(1) The controller must entrust the data protection officer with at least the following tasks—

(a) informing and advising the controller, any processor engaged by the controller, and any employee of the controller who carries out processing of personal data, of that person's obligations under this Part,

(b) providing advice on the carrying out of a data protection impact assessment under section 64 and monitoring compliance with that section,

(d) acting as the contact point for the Commissioner on issues relating to processing, including in relation to the consultation mentioned in section 65, and consulting with the Commissioner, where appropriate, in relation to any other matter,

(e) monitoring compliance with policies of the controller in relation to the protection of personal data, and

(f) monitoring compliance by the controller with this Part.

(2) In relation to the policies mentioned in subsection (1)(e), the data protection officer's tasks include—

(a) assigning responsibilities under those policies,

(b) raising awareness of those policies,

(d) conducting audits required under those policies.

(3) In performing the tasks set out in subsections (1) and (2), the data protection officer must have regard to the risks associated with processing operations, taking into account the nature, scope, context and purposes of processing.

CHAPTER 5 — Transfers of personal data to third countries etc

Overview and interpretation

72

(1) This Chapter deals with the transfer of personal data to third countries or international organisations, as follows—

(a) sections 73 to 76 set out the general conditions that apply;

(b) section 77 sets out additional conditions that apply in certain cases where the intended recipient of personal data is not a relevant authority in a third country or an international organisation (see section 73(4)(b));

(2) In this Chapter, “relevant authority”, in relation to a third country, means any person based in a third country that has (in that country) functions comparable to those of a competent authority.

General principles for transfers

General principles for transfers of personal data

73

(A1) This section applies in relation to a transfer of personal data to a third country or international organisation for a law enforcement purpose.

(1) The controller in relation to the transfer must secure that the transfer takes place only if—

(a) the three conditions set out in subsections (2) to (4) are met, ...

(b) in a case where the personal data was originally transmitted or otherwise made available to the controller or another competent authority by a member State ..., that member State, or any person based in that member State which is a competent authority for the purposes of the Law Enforcement Directive, has authorised the transfer in accordance with the law of the member State , and—

(2) Condition 1 is that the transfer is necessary for any of the law enforcement purposes.

(3) Condition 2 is that the transfer—

(a) is approved by regulations under section 74AA that are in force at the time of the transfer,

(b) is made subject to appropriate safeguards (see section 75), or

(4) Condition 3 is that—

(a) the intended recipient is a relevant authority in a third country or an international organisation that is a relevant international organisation,

(aa) the intended recipient is a person in a third country who—

(i) is not a person described in paragraph (a), but

(ii) is a processor whose processing, on behalf of the controller, of the personal data transferred is governed by, or authorised in accordance with, a contract with the controller that complies with section 59, or

(b) in a case where the controller is a competent authority specified in any of paragraphs 5 to 17, 21, 24 to 28, 34 to 51, 54 and 56 of Schedule 7—

(i) the intended recipient is a person in a third country who is not a person described in paragraph (a) or (aa), and

(ii) the additional conditions in section 77 are met.

(5) Authorisation is not required as mentioned in subsection (1)(b) if—

(a) the transfer is necessary for the prevention of an immediate and serious threat to the public security, national security or essential interests of a third country or the United Kingdom, and

(b) the authorisation cannot be obtained in good time.

(6) Where a transfer is made without the authorisation mentioned in subsection (1)(b), the authority in the member State which would have been responsible for deciding whether to authorise the transfer must be informed without delay.

(7) In this section, “relevant international organisation” means an international organisation that carries out functions for any of the law enforcement purposes.

Transfers on the basis of an adequacy decision

74

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Transfers on the basis of appropriate safeguards

75

(1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(1A) A transfer of personal data to a third country or an international organisation is made subject to appropriate safeguards only if—

(a) an appropriate legal instrument binds the intended recipient of the data (see subsection (4)), or

(b) the controller, acting reasonably and proportionately, considers that the data protection test is met in relation to the transfer or that type of transfer (see subsection (5)).

(2) The controller must inform the Commissioner about the categories of data transfers that take place in reliance on subsection (1A)(b) but not in reliance on section 73(4)(aa) (transfer to processor).

(3) Where a transfer of data takes place in reliance on this section but not in reliance on section 73(4)(aa) (transfer to processor)—

(a) the transfer must be documented,

(b) the documentation must be provided to the Commissioner on request, and

(i) the date and time of the transfer,

(ii) the name of and any other pertinent information about the recipient,

(iii) the justification for the transfer, and

(iv) a description of the personal data transferred.

(4) For the purposes of this section, a legal instrument is “appropriate”, in relation to a transfer of personal data, if—

(a) the instrument is intended to be relied on in connection with the transfer or that type of transfer,

(b) at least one competent authority is a party to the instrument, and

(c) each competent authority that is a party to the instrument, acting reasonably and proportionately, considers that the data protection test is met in relation to the transfers, or types of transfer, intended to be made in reliance on the instrument (see subsection (5)).

(5) For the purposes of this section, the data protection test is met in relation to a transfer, or a type of transfer, of personal data if, after the transfer, the standard of the protection provided for the data subject with regard to that personal data, whether by a binding legal instrument or by other means, would not be materially lower than the standard of the protection provided for the data subject with regard to the personal data by or under—

(a) this Part, and

(b) Parts 5 to 7, so far as they relate to processing by a competent authority for any of the law enforcement purposes.

(6) For the purposes of subsections (1A)(b) and (4)(c), what is reasonable and proportionate is to be determined by reference to all the circumstances, or likely circumstances, of the transfer or type of transfer, including the nature and volume of the personal data transferred.

(7) In this section, references to the protection provided for the data subject are to that protection taken as a whole.

(8) For provision about standard data protection clauses which the Commissioner considers are capable of securing that the data protection test in this section is met, see section 119A.

Transfers on the basis of special circumstances

76

(A1) A transfer of personal data to a third country or international organisation is based on special circumstances where—

(a) it is made in the absence of approval by regulations under section 74AA and of compliance with section 75 (appropriate safeguards), and

(b) it is necessary for a special purpose.

(1) A transfer of personal data is necessary for a special purpose if it is necessary—

(a) to protect the vital interests of the data subject or another person,

(b) to safeguard the legitimate interests of the data subject,

(c) for the prevention of an immediate and serious threat to the public security or national security of ... a third country or the United Kingdom,

(d) in particular circumstances, for any of the law enforcement purposes, or

(e) in particular circumstances, for a legal purpose.

(2) But a transfer of personal data is not necessary for a special purpose by virtue of subsection (1)(d) or (e) if the controller determines that fundamental rights and freedoms of the data subject override the public interest in the transfer.

(2A) In accordance with the third data protection principle, the amount of personal data transferred in reliance on this section must not be excessive in relation to the special purpose relied on.

(3) Where a transfer of data takes place in reliance on this section—

(a) the transfer must be documented,

(b) the documentation must be provided to the Commissioner on request, and

(i) the date and time of the transfer,

(ii) the name of and any other pertinent information about the recipient,

(iii) the justification for the transfer, and

(iv) a description of the personal data transferred.

(4) For the purposes of this section, a transfer is necessary for a legal purpose if—

(a) it is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings) relating to any of the law enforcement purposes,

(b) it is necessary for the purpose of obtaining legal advice in relation to any of the law enforcement purposes, or

(c) it is otherwise necessary for the purposes of establishing, exercising or defending legal rights in relation to any of the law enforcement purposes.

Additional conditions

Transfers of personal data to persons other than relevant authorities

77

(1) The additional conditions referred to in section 73(4)(b)(ii) are the following four conditions.

(2) Condition 1 is that the transfer is strictly necessary in a specific case for the performance of a task of the transferring controller as provided by law for any of the law enforcement purposes.

(3) Condition 2 is that the transferring controller has determined that there are no fundamental rights and freedoms of the data subject concerned that override the public interest necessitating the transfer.

(4) Condition 3 is that the transferring controller considers that the transfer of the personal data to a relevant authority in the third country would be ineffective or inappropriate (for example, where the transfer could not be made in sufficient time to enable its purpose to be fulfilled).

(5) Condition 4 is that the transferring controller informs the intended recipient of the specific purpose or purposes for which the personal data may, so far as necessary, be processed.

(6) Where personal data is transferred to a person in a third country in reliance on section 73(4)(b), the transferring controller must inform a relevant authority in that third country without undue delay of the transfer, unless this would be ineffective or inappropriate.

(7) The transferring controller must—

(a) document any transfer to a recipient in a third country that takes place in reliance on section 73(4)(b), and

(b) inform the Commissioner about the transfer.

(8) This section does not affect the operation of any international agreement in force between the United Kingdom and third countries in the field of judicial co-operation in criminal matters and police co-operation.

Subsequent transfers

78

(A1) Subsections (1) to (6) apply where a transfer to which section 73 applies takes place otherwise than in reliance on section 73(4)(aa) (transfer to processor).

(1) ... The transferring controller must make it a condition of the transfer —

(a) that the personal data is not to be further transferred to a third country or international organisation without the authorisation of the transferring controller or another competent authority (the “UK authoriser”), or

(b) that—

(i) the personal data is not to be so transferred without such authorisation except where subsection (1A) applies, and

(ii) where a transfer is made without such authorisation, the UK authoriser must be informed without delay.

(1A) This subsection applies if—

(a) the transfer is necessary for the prevention of an immediate and serious threat to the public security or national security of a third country or the United Kingdom, and

(b) authorisation from the UK authoriser cannot be obtained in good time.

(2) The UK authoriser may give an authorisation for the purposes of a condition described in subsection (1) only where the further transfer is necessary for a law enforcement purpose.

(3) In deciding whether to give the authorisation, the UK authoriser must take into account (among any other relevant factors)—

(a) the seriousness of the circumstances leading to the request for authorisation,

(b) the purpose for which the personal data was originally transferred, and

(c) the standards for the protection of personal data that apply in the third country or international organisation to which the personal data would be transferred.

(4) In a case where the personal data was originally transmitted or otherwise made available to the transferring controller or another competent authority by a member State ..., the UK authoriser may not give an authorisation for the purposes of a condition described in subsection (1) unless that member State, or any person based in that member State which is a competent authority for the purposes of the Law Enforcement Directive, has authorised the transfer in accordance with the law of the member State.

(5) Authorisation is not required as mentioned in subsection (4) if—

(a) the transfer is necessary for the prevention of an immediate and serious threat to the public security, national security or essential interests of a third country or the United Kingdom, and

(b) the authorisation cannot be obtained in good time.

(6) Where a transfer is made in a case described in subsection (4) without the authorisation mentioned in that subsection (whether made with or without authorisation from the UK authoriser), the UK authoriser must, without delay, inform, the authority in the member State which would have been responsible for deciding whether to authorise the transfer ....

(7) Where a transfer takes place in reliance on section 73(4)(aa) (transfer to processor), the transferring controller must make it a condition of the transfer that the data is only to be further transferred to a third country or international organisation where—

(a) the terms of any relevant contract entered into, or authorisation given, by the transferring controller in accordance with section 59 are complied with, and

(b) the further transfer satisfies the requirements in section 73(1).

CHAPTER 6 — Supplementary

National security: certificate

79

(1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(3A) Subject to subsection (5), a certificate signed by a Minister of the Crown certifying that exemption from all or any of the provisions listed in section 78A(2) is, or at any time was, required in relation to any personal data for the purposes of safeguarding national security is conclusive evidence of that fact.

(4) A certificate issued under subsection (3A)—

(a) may identify the personal data to which it applies by means of a general description, and

(b) may be expressed to have prospective effect.

(5) Any person directly affected by the issuing of a certificate under subsection (3A) may appeal to the Tribunal against the certificate.

(6) If, on an appeal under subsection (5), the Tribunal finds that, applying the principles applied by a court on an application for judicial review, the Minister did not have reasonable grounds for issuing the certificate, the Tribunal may —

(a) allow the appeal, and

(b) quash the certificate.

(7) Where in any proceedings under or by virtue of this Act, it is claimed by a controller that a certificate under subsection (3A) which identifies the personal data to which it applies by means of a general description applies to any personal data, any other party to the proceedings may appeal to the Tribunal on the ground that the certificate does not apply to the personal data in question.

(8) But, subject to any determination under subsection (9), the certificate is to be conclusively presumed so to apply.

(9) On an appeal under subsection (7), the Tribunal may determine that the certificate does not so apply.

(10) A document purporting to be a certificate under subsection (3A) is to be—

(a) received in evidence, and

(b) deemed to be such a certificate unless the contrary is proved.

(11) A document which purports to be certified by or on behalf of a Minister of the Crown as a true copy of a certificate issued by that Minister under subsection (3A) is—

(a) in any legal proceedings, evidence of that certificate, and

(b) in any legal proceedings in Scotland, sufficient evidence of that certificate.

(12) The power conferred by subsection (3A) on a Minister of the Crown is exercisable only by—

(a) a Minister who is a member of the Cabinet, or

(b) the Attorney General or the Advocate General for Scotland.

(13) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Special processing restrictions

80

(1) Subsections (3) and (4) apply where, for a law enforcement purpose, a controller transmits or otherwise makes available personal data to a non-UK recipient.

(2) In this section—

“non-UK recipient” means—a recipient in a third country, oran international organisation.

(3) The controller must consider whether, if the personal data had instead been transmitted or otherwise made available within the United Kingdom to another competent authority, processing of the data by the other competent authority would have been subject to any restrictions by virtue of any enactment or rule of law.

(4) Where that would be the case, the controller must inform the non-UK recipient that the data is transmitted or otherwise made available subject to compliance by that person with the same restrictions (which must be set out in the information given to that person).

(5) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(6) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(7) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Reporting of infringements

81

(1) Each controller must implement effective mechanisms to encourage the reporting of an infringement of this Part.

(2) The mechanisms implemented under subsection (1) must provide that an infringement may be reported to any of the following persons—

(a) the controller;

(b) the Commissioner.

(3) The mechanisms implemented under subsection (1) must include—

(a) raising awareness of the protections provided by Part 4A of the Employment Rights Act 1996 and Part 5A of the Employment Rights (Northern Ireland) Order 1996 (S.I. 1996/1919 (N.I. 16)), and

(b) such other protections for a person who reports an infringement of this Part as the controller considers appropriate.

(4) A person who reports an infringement of this Part does not breach—

(a) an obligation of confidence owed by the person, or

(b) any other restriction on the disclosure of information (however imposed).

(5) Subsection (4) does not apply if or to the extent that the report includes a disclosure which is prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.

(6) Until the repeal of Part 1 of the Regulation of Investigatory Powers Act 2000 by paragraphs 45 and 54 of Schedule 10 to the Investigatory Powers Act 2016 is fully in force, subsection (5) has effect as if it included a reference to that Part.

PART 4 — Intelligence services processing

CHAPTER 1 — Scope and definitions

Scope

Processing to which this Part applies

82

(A1) This Part—

(a) applies to processing of personal data by an intelligence service, and

(b) applies to processing of personal data by a qualifying competent authority where the processing is the subject of a designation notice that is for the time being in force (see sections 82A to 82E).

(1) This Part applies only to—

(a) processing of personal data wholly or partly by automated means, and

(b) processing otherwise than by automated means of personal data which forms part of a filing system or is intended to form part of a filing system.

(2) In this Part, “intelligence service” means—

(a) the Security Service;

(b) the Secret Intelligence Service;

(2A) In this Part—

“competent authority” has the same meaning as in Part 3;

“qualifying competent authority” means a competent authority specified or described in regulations made by the Secretary of State.

(3) A reference in this Part to the processing of personal data is to processing to which this Part applies.

(4) Regulations under this section are subject to the affirmative resolution procedure.

Definitions

Meaning of “controller” and “processor”

83

(A1) For the purposes of this Part—

(a) an intelligence service is the “controller” in relation to the processing of personal data if it satisfies subsection (1) alone or jointly with others, and

(b) a qualifying competent authority is the “controller” in relation to the processing of personal data that is the subject of a designation notice that is for the time being in force if the authority satisfies subsection (1) jointly with others.

(1) This subsection is satisfied by a person who—

(a) determines the purposes and means of the processing of personal data, or

(b) is the controller by virtue of subsection (2).

(2) Where personal data is processed only—

(a) for purposes for which it is required by an enactment to be processed, and

(b) by means by which it is required by an enactment to be processed,

the person on whom the obligation to process the data is imposed by the enactment (or, if different, one of the enactments) is the controller.

(3) In this Part, “processor” means any person who processes personal data on behalf of the controller (other than a person who is an employee of the controller).

Other definitions

84

(1) This section defines other expressions used in this Part.

(2) “Consent”, in relation to the processing of personal data relating to an individual, means a freely given, specific, informed and unambiguous indication of the individual's wishes by which the individual, by a statement or by a clear affirmative action, signifies agreement to the processing of the personal data.

(2A) “Designation notice” has the meaning given in section 82A.

(3) “Employee”, in relation to any person, includes an individual who holds a position (whether paid or unpaid) under the direction and control of that person.

(4) “Personal data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

(5) “Recipient”, in relation to any personal data, means any person to whom the data is disclosed, whether a third party or not, but it does not include a person to whom disclosure is or may be made in the framework of a particular inquiry in accordance with the law.

(6) “Restriction of processing” means the marking of stored personal data with the aim of limiting its processing for the future.

(6A) “Sensitive processing” has the meaning given in section 86(7).

(6B) “Withdrawal notice” has the meaning given in section 82C.

(7) Sections 3 and 205 include definitions of other expressions used in this Part.

CHAPTER 2 — Principles

Overview

85

(1) This Chapter sets out the six data protection principles as follows—

(a) section 86 sets out the first data protection principle (requirement that processing be lawful, fair and transparent);

(b) section 87 sets out the second data protection principle (requirement that the purposes of processing be specified, explicit and legitimate);

(c) section 88 sets out the third data protection principle (requirement that personal data be adequate, relevant and not excessive);

(d) section 89 sets out the fourth data protection principle (requirement that personal data be accurate and kept up to date);

(e) section 90 sets out the fifth data protection principle (requirement that personal data be kept for no longer than is necessary);

(f) section 91 sets out the sixth data protection principle (requirement that personal data be processed in a secure manner).

(2) Each of sections 86, 87 and 91 makes provision to supplement the principle to which it relates.

The data protection principles

The first data protection principle

86

(1) The first data protection principle is that the processing of personal data must be—

(a) lawful, and

(b) fair and transparent.

(2) The processing of personal data is lawful only if and to the extent that—

(a) at least one of the conditions in Schedule 9 is met, and

(b) in the case of sensitive processing, at least one of the conditions in Schedule 10 is also met.

(3) The Secretary of State may by regulations amend Schedule 10—

(a) by adding conditions;

(b) by varying or omitting conditions added by regulations under paragraph (a).

(4) Regulations under subsection (3) are subject to the affirmative resolution procedure.

(5) In determining whether the processing of personal data is fair and transparent, regard is to be had to the method by which it is obtained.

(6) For the purposes of subsection (5), data is to be treated as obtained fairly and transparently if it consists of information obtained from a person who—

(a) is authorised by an enactment to supply it, or

(b) is required to supply it by an enactment or by an international obligation of the United Kingdom.

(7) In this Part, “sensitive processing” means—

(a) the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership;

(b) the processing of genetic data for the purpose of uniquely identifying an individual;

(d) the processing of data concerning health;

(e) the processing of data concerning an individual's sex life or sexual orientation;

(f) the processing of personal data as to—

(i) the commission or alleged commission of an offence by an individual, or

(ii) proceedings for an offence committed or alleged to have been committed by an individual, the disposal of such proceedings or the sentence of a court in such proceedings.

The second data protection principle

87

(1) The second data protection principle is that—

(a) the purpose for which personal data is collected (whether from the data subject or otherwise) must be specified, explicit and legitimate, and

(b) personal data so collected must not be processed by or on behalf of a controller in a manner that is incompatible with the purpose for which the controller collected it.

(2) Paragraph (b) of the second data protection principle is subject to subsections (3) and (4).

(3) Personal data collected by a controller for one purpose may be processed for any other purpose of the controller that collected the data or any purpose of another controller provided that—

(a) the controller is authorised by law to process the data for that purpose, and

(b) the processing is necessary and proportionate to that other purpose.

(4) Processing of personal data is to be regarded as compatible with the purpose for which it is collected if the processing—

(a) consists of—

(i) processing for archiving purposes in the public interest,

(ii) processing for the purposes of scientific or historical research, or

(iii) processing for statistical purposes, and

(b) is subject to appropriate safeguards for the rights and freedoms of the data subject.

The third data protection principle

88

The third data protection principle is that personal data must be adequate, relevant and not excessive in relation to the purpose for which it is processed.

The fourth data protection principle

89

The fourth data protection principle is that personal data undergoing processing must be accurate and, where necessary, kept up to date.

The fifth data protection principle

90

The fifth data protection principle is that personal data must be kept for no longer than is necessary for the purpose for which it is processed.

The sixth data protection principle

91

(1) The sixth data protection principle is that personal data must be processed in a manner that includes taking appropriate security measures as regards risks that arise from processing personal data.

(2) The risks referred to in subsection (1) include (but are not limited to) accidental or unauthorised access to, or destruction, loss, use, modification or disclosure of, personal data.

CHAPTER 3 — Rights of the data subject

Overview

92

(1) This Chapter sets out the rights of the data subject as follows—

(a) section 93 deals with the information to be made available to the data subject;

(b) sections 94 and 95 deal with the right of access by the data subject;

(d) section 98 deals with the right to information about decision-making;

(e) section 99 deals with the right to object to processing;

(f) section 100 deals with rights to rectification and erasure of personal data.

(2) In this Chapter, “the controller”, in relation to a data subject, means the controller in relation to personal data relating to the data subject.

Rights

Right to information

93

(1) The controller must give a data subject the following information—

(a) the identity and the contact details of the controller;

(b) the legal basis on which, and the purposes for which, the controller processes personal data;

(d) the recipients or the categories of recipients of the personal data (if applicable);

(e) the right to lodge a complaint with the Commissioner and the contact details of the Commissioner;

(f) how to exercise rights under this Chapter;

(g) any other information needed to secure that the personal data is processed fairly and transparently.

(2) The controller may comply with subsection (1) by making information generally available, where the controller considers it appropriate to do so.

(3) The controller is not required under subsection (1) to give a data subject information that the data subject already has.

(4) Where personal data relating to a data subject is collected by or on behalf of the controller from a person other than the data subject, the requirement in subsection (1) has effect, in relation to the personal data so collected, with the following exceptions—

(a) the requirement does not apply in relation to processing that is authorised by an enactment;

(b) the requirement does not apply in relation to the data subject if giving the information to the data subject would be impossible or involve disproportionate effort.

Right of access

94

(1) An individual is entitled to obtain from a controller—

(a) confirmation as to whether or not personal data concerning the individual is being processed, and

(b) where that is the case—

(i) communication, in intelligible form, of the personal data of which that individual is the data subject, and

(ii) the information set out in subsection (2).

(2) That information is—

(a) the purposes of and legal basis for the processing;

(b) the categories of personal data concerned;

(d) the period for which the personal data is to be preserved;

(e) the existence of a data subject's rights to rectification and erasure of personal data (see section 100);

(f) the right to lodge a complaint with the Commissioner and the contact details of the Commissioner;

(g) any information about the origin of the personal data concerned.

(2A) Under subsection (1), the data subject is only entitled to such confirmation, personal data and other information as the controller is able to provide based on a reasonable and proportionate search for the personal data and other information described in that subsection.

(3) A controller is not obliged to provide information under this section unless the controller has received such reasonable fee as the controller may require, subject to subsection (4).

(4) The Secretary of State may by regulations—

(a) specify cases in which a controller may not charge a fee;

(b) specify the maximum amount of a fee.

(5) Where a controller—

(a) reasonably requires further information—

(i) in order that the controller be satisfied as to the identity of the individual making a request under subsection (1), or

(ii) to locate the information which that individual seeks, and

(b) has informed that individual of that requirement,

the controller is not obliged to comply with the request unless the controller is supplied with that further information.

(6) Where a controller cannot comply with the request without disclosing information relating to another individual who can be identified from that information, the controller is not obliged to comply with the request unless—

(a) the other individual has consented to the disclosure of the information to the individual making the request, or

(b) it is reasonable in all the circumstances to comply with the request without the consent of the other individual.

(7) In subsection (6), the reference to information relating to another individual includes a reference to information identifying that individual as the source of the information sought by the request.

(8) Subsection (6) is not to be construed as excusing a controller from communicating so much of the information sought by the request as can be communicated without disclosing the identity of the other individual concerned, whether by the omission of names or other identifying particulars or otherwise.

(9) In determining for the purposes of subsection (6)(b) whether it is reasonable in all the circumstances to comply with the request without the consent of the other individual concerned, regard must be had, in particular, to—

(a) any duty of confidentiality owed to the other individual,

(b) any steps taken by the controller with a view to seeking the consent of the other individual,

(d) any express refusal of consent by the other individual.

(10) Subject to subsections (3), (5) and (6), a controller must comply with a request under subsection (1)—

(a) promptly, and

(b) in any event before the end of the applicable time period.

(11) If a court is satisfied on the application of an individual who has made a request under subsection (1) that the controller in question has failed to comply with the request in contravention of this section, the court may order the controller to comply with the request.

(12) A court may make an order under subsection (11) in relation to a joint controller whose responsibilities are determined in an arrangement under section 104 only if the controller is responsible for compliance with the obligation to which the order relates.

(13) The jurisdiction conferred on a court by this section is exercisable by the High Court or, in Scotland, by the Court of Session.

(14) In this section—

“the applicable time period” means the period of one month beginning with the relevant time, subject to subsection (14A);

“the relevant time”, in relation to a request under subsection (1), means the latest of the following—when the controller receives the request,when the fee (if any) is paid, andwhen the controller receives the information (if any) required under subsection (5) in connection with the request.

(14A) The controller may, by giving notice to the data subject, extend the applicable time period by two further months where that is necessary by reason of—

(a) the complexity of requests made by the data subject, or

(b) the number of such requests.

(14B) A notice under subsection (14A) must—

(a) be given before the end of the period of one month beginning with the relevant time, and

(b) state the reasons for the delay.

(15) Regulations under this section are subject to the negative resolution procedure.

Right of access: supplementary

95

(1) The controller must comply with the obligation imposed by section 94(1)(b)(i) by supplying the data subject with a copy of the information in writing unless—

(a) the supply of such a copy is not possible or would involve disproportionate effort, or

(b) the data subject agrees otherwise;

and where any of the information referred to in section 94(1)(b)(i) is expressed in terms which are not intelligible without explanation the copy must be accompanied by an explanation of those terms.

(2) Where a controller has previously complied with a request made under section 94 by an individual, the controller is not obliged to comply with a subsequent identical or similar request under that section by that individual unless a reasonable interval has elapsed between compliance with the previous request and the making of the current request.

(3) In determining for the purposes of subsection (2) whether requests under section 94 are made at reasonable intervals, regard must be had to—

(a) the nature of the data,

(b) the purpose for which the data is processed, and

(4) The information to be supplied pursuant to a request under section 94 must be supplied by reference to the data in question at the time when the request is received, except that it may take account of any amendment or deletion made between that time and the time when the information is supplied, being an amendment or deletion that would have been made regardless of the receipt of the request.

(5) For the purposes of section 94(6) to (8), an individual can be identified from information to be disclosed to a data subject by a controller if the individual can be identified from—

(a) that information, or

(b) that and any other information that the controller reasonably believes the data subject making the request is likely to possess or obtain.

Right not to be subject to automated decision-making

96

(1) The controller may not take a decision significantly affecting a data subject that is based on entirely automated processing of personal data relating to the data subject.

(2) Subsection (1) does not prevent such a decision being made on that basis if—

(a) the decision is required or authorised by law,

(b) the data subject has given consent to the decision being made on that basis, or

(i) for the purpose of considering whether to enter into a contract with the data subject,

(ii) with a view to entering into such a contract, or

(iii) in the course of performing such a contract.

(3) For the purposes of this section and section 97, a decision that has legal effects as regards an individual is to be regarded as significantly affecting the individual.

(4) For the purposes of this section and section 97, a decision is based on entirely automated processing if the decision-making process does not include an opportunity for a human being to accept, reject or influence the decision.

Right to intervene in automated decision-making

97

(1) This section applies where—

(a) the controller takes a decision significantly affecting a data subject that is based on entirely automated processing of personal data relating to the data subject, and

(b) the decision is required or authorised by law.

(2) This section does not apply to such a decision if—

(a) the data subject has given consent to the decision being made on that basis, or

(b) the decision is a decision taken in the course of steps taken—

(i) for the purpose of considering whether to enter into a contract with the data subject,

(ii) with a view to entering into such a contract, or

(iii) in the course of performing such a contract.

(3) The controller must as soon as reasonably practicable notify the data subject that such a decision has been made.

(4) The data subject may, before the end of the period of 1 month beginning with receipt of the notification, request the controller—

(a) to reconsider the decision, or

(b) to take a new decision that is not based on entirely automated processing.

(5) If a request is made to the controller under subsection (4), the controller must, before the end of the period of 1 month beginning with receipt of the request—

(a) consider the request, including any information provided by the data subject that is relevant to it, and

(b) by notice in writing inform the data subject of the outcome of that consideration.

(6) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Right to information about decision-making

98

(1) Where—

(a) the controller processes personal data relating to a data subject, and

(b) results produced by the processing are applied to the data subject,

the data subject is entitled to obtain from the controller, on request, knowledge of the reasoning underlying the processing.

(2) Where the data subject makes a request under subsection (1), the controller must comply with the request without undue delay.

Right to object to processing

99

(1) A data subject is entitled at any time, by notice given to the controller, to require the controller—

(a) not to process personal data relating to the data subject, or

(b) not to process such data for a specified purpose or in a specified manner,

on the ground that, for specified reasons relating to the situation of the data subject, the processing in question is an unwarranted interference with the interests or rights of the data subject.

(2) Where the controller—

(a) reasonably requires further information—

(i) in order that the controller be satisfied as to the identity of the individual giving notice under subsection (1), or

(ii) to locate the data to which the notice relates, and

(b) has informed that individual of that requirement,

the controller is not obliged to comply with the notice unless the controller is supplied with that further information.

(3) The controller must, before the end of 21 days beginning with the relevant time, give a notice to the data subject—

(a) stating that the controller has complied or intends to comply with the notice under subsection (1), or

(b) stating the controller's reasons for not complying with the notice to any extent and the extent (if any) to which the controller has complied or intends to comply with the notice under subsection (1).

(4) If the controller does not comply with a notice under subsection (1) to any extent, the data subject may apply to a court for an order that the controller take steps for complying with the notice.

(5) If the court is satisfied that the controller should comply with the notice (or should comply to any extent), the court may order the controller to take such steps for complying with the notice (or for complying with it to that extent) as the court thinks fit.

(6) A court may make an order under subsection (5) in relation to a joint controller whose responsibilities are determined in an arrangement under section 104 only if the controller is responsible for compliance with the obligation to which the order relates.

(7) The jurisdiction conferred on a court by this section is exercisable by the High Court or, in Scotland, by the Court of Session.

(8) In this section, “the relevant time”, in relation to a notice under subsection (1), means—

(a) when the controller receives the notice, or

(b) if later, when the controller receives the information (if any) required under subsection (2) in connection with the notice.

Rights to rectification and erasure

100

(1) If a court is satisfied on the application of a data subject that personal data relating to the data subject is inaccurate, the court may order the controller to rectify that data without undue delay.

(2) If a court is satisfied on the application of a data subject that the processing of personal data relating to the data subject would infringe any of sections 86 to 91, the court may order the controller to erase that data without undue delay.

(3) If personal data relating to the data subject must be maintained for the purposes of evidence, the court may (instead of ordering the controller to rectify or erase the personal data) order the controller to restrict its processing without undue delay.

(4) If—

(a) the data subject contests the accuracy of personal data, and

(b) the court is satisfied that the controller is not able to ascertain whether the data is accurate or not,

the court may (instead of ordering the controller to rectify or erase the personal data) order the controller to restrict its processing without undue delay.

(5) A court may make an order under this section in relation to a joint controller whose responsibilities are determined in an arrangement under section 104 only if the controller is responsible for carrying out the rectification, erasure or restriction of processing that the court proposes to order.

(6) The jurisdiction conferred on a court by this section is exercisable by the High Court or, in Scotland, by the Court of Session.

CHAPTER 4 — Controller and processor

Overview

101

This Chapter sets out—

(a) the general obligations of controllers and processors (see sections 102 to 106);

(b) specific obligations of controllers and processors with respect to security (see section 107);

General obligations

General obligations of the controller

102

Each controller must implement appropriate measures—

(a) to ensure, and

(b) to be able to demonstrate, in particular to the Commissioner,

that the processing of personal data complies with the requirements of this Part.

Data protection by design

103

(1) Where a controller proposes that a particular type of processing of personal data be carried out by or on behalf of the controller, the controller must, prior to the processing, consider the impact of the proposed processing on the rights and freedoms of data subjects.

(2) A controller must implement appropriate technical and organisational measures which are designed to ensure that—

(a) the data protection principles are implemented, and

(b) risks to the rights and freedoms of data subjects are minimised.

Joint controllers

104

(1) Where two or more controllers jointly determine the purposes and means of processing personal data, they are joint controllers for the purposes of this Part.

(2) Joint controllers must, in a transparent manner, determine their respective responsibilities for compliance with this Part by means of an arrangement between them, except to the extent that those responsibilities are determined under or by virtue of an enactment.

(3) The arrangement must designate the controller which is to be the contact point for data subjects.

Processors

105

(1) This section applies to the use by a controller of a processor to carry out processing of personal data on behalf of the controller.

(2) The controller may use only a processor who undertakes—

(a) to implement appropriate measures that are sufficient to secure that the processing complies with this Part;

(b) to provide to the controller such information as is necessary for demonstrating that the processing complies with this Part.

(3) If a processor determines, in breach of this Part, the purposes and means of processing, the processor is to be treated for the purposes of this Part as a controller in respect of that processing.

Processing under the authority of the controller or processor

106

A processor, and any person acting under the authority of a controller or processor, who has access to personal data may not process the data except—

(a) on instructions from the controller, or

(b) to comply with a legal obligation.

Obligations relating to security

Security of processing

107

(1) Each controller and each processor must implement security measures appropriate to the risks arising from the processing of personal data.

(2) In the case of automated processing, each controller and each processor must, following an evaluation of the risks, implement measures designed to—

(a) prevent unauthorised processing or unauthorised interference with the systems used in connection with it,

(b) ensure that it is possible to establish the precise details of any processing that takes place,

(c) ensure that any systems used in connection with the processing function properly and may, in the case of interruption, be restored, and

(d) ensure that stored personal data cannot be corrupted if a system used in connection with the processing malfunctions.

Obligations relating to personal data breaches

Communication of a personal data breach

108

(1) If a controller becomes aware of a serious personal data breach in relation to personal data for which the controller is responsible, the controller must notify the Commissioner of the breach without undue delay.

(2) Where the notification to the Commissioner is not made within 72 hours, the notification must be accompanied by reasons for the delay.

(3) Subject to subsection (4), the notification must include—

(a) a description of the nature of the personal data breach including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;

(b) the name and contact details of the contact point from whom more information can be obtained;

(d) a description of the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

(4) Where and to the extent that it is not possible to provide all the information mentioned in subsection (3) at the same time, the information may be provided in phases without undue further delay.

(5) If a processor becomes aware of a personal data breach (in relation to data processed by the processor), the processor must notify the controller without undue delay.

(6) Subsection (1) does not apply in relation to a personal data breach if the breach also constitutes a relevant error within the meaning given by section 231(9) of the Investigatory Powers Act 2016.

(7) For the purposes of this section, a personal data breach is serious if the breach seriously interferes with the rights and freedoms of a data subject.

CHAPTER 5 — Transfers of personal data outside the United Kingdom

Transfers of personal data outside the United Kingdom

109

(1) A controller may not transfer personal data to—

(a) a country or territory outside the United Kingdom, or

(b) an international organisation,

unless the transfer falls within subsection (2).

(2) A transfer of personal data falls within this subsection if the transfer is a necessary and proportionate measure carried out—

(a) for the purposes of the controller's statutory functions, or

(b) for other purposes provided for, in relation to the controller, in section 2(2)(a) of the Security Service Act 1989 or section 2(2)(a) or 4(2)(a) of the Intelligence Services Act 1994.

CHAPTER 6 — Exemptions

National security

110

(1) A provision mentioned in subsection (2) does not apply to personal data to which this Part applies if exemption from the provision is required for the purpose of safeguarding national security.

(2) The provisions are—

(a) Chapter 2 of this Part (the data protection principles), except section 86(1)(a) and (2) and Schedules 9 and 10;

(b) Chapter 3 of this Part (rights of data subjects);

(d) in Part 5—

(i) section 119 (inspection in accordance with international obligations);

(ii) in Schedule 13 (other general functions of the Commissioner), paragraphs 1(a) and (g) and 2;

(e) in Part 6—

(i) sections 142 to 154 and Schedule 15 (Commissioner's notices and powers of entry and inspection);

(ii) sections 170 to 173 (offences relating to personal data);

(iii) sections 174 to 176 (provision relating to the special purposes).

National security: certificate

111

(1) Subject to subsection (3), a certificate signed by a Minister of the Crown certifying that exemption from all or any of the provisions mentioned in section 110(2) is, or at any time was, required for the purpose of safeguarding national security in respect of any personal data is conclusive evidence of that fact.

(2) A certificate under subsection (1)—

(a) may identify the personal data to which it applies by means of a general description, and

(b) may be expressed to have prospective effect.

(3) Any person directly affected by the issuing of a certificate under subsection (1) may appeal to the Tribunal against the certificate.

(4) If on an appeal under subsection (3), the Tribunal finds that, applying the principles applied by a court on an application for judicial review, the Minister did not have reasonable grounds for issuing the certificate, the Tribunal may—

(a) allow the appeal, and

(b) quash the certificate.

(5) Where, in any proceedings under or by virtue of this Act, it is claimed by a controller that a certificate under subsection (1) which identifies the personal data to which it applies by means of a general description applies to any personal data, another party to the proceedings may appeal to the Tribunal on the ground that the certificate does not apply to the personal data in question.

(6) But, subject to any determination under subsection (7), the certificate is to be conclusively presumed so to apply.

(7) On an appeal under subsection (5), the Tribunal may determine that the certificate does not so apply.

(8) A document purporting to be a certificate under subsection (1) is to be—

(a) received in evidence, and

(b) deemed to be such a certificate unless the contrary is proved.

(9) A document which purports to be certified by or on behalf of a Minister of the Crown as a true copy of a certificate issued by that Minister under subsection (1) is—

(a) in any legal proceedings, evidence of that certificate, and

(b) in any legal proceedings in Scotland, sufficient evidence of that certificate.

(10) The power conferred by subsection (1) on a Minister of the Crown is exercisable only by—

(a) a Minister who is a member of the Cabinet, or

(b) the Attorney General or the Advocate General for Scotland.

Other exemptions

112

Schedule 11 provides for further exemptions.

Power to make further exemptions

113

(1) The Secretary of State may by regulations amend Schedule 11—

(a) by adding exemptions from any provision of this Part;

(b) by omitting exemptions added by regulations under paragraph (a).

(2) Regulations under this section are subject to the affirmative resolution procedure.

PART 5 — The Information Commissioner

The Commissioner

The Information Commissioner

114

(1) There is to continue to be an Information Commissioner.

(2) Schedule 12 makes provision about the Commissioner.

General functions

General functions under the GDPR and safeguards

115

(1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(2) General functions are conferred on the Commissioner by—

(a) Article 57 of the UK GDPR (tasks), and

(b) Article 58 of the UK GDPR (powers),

(and see also the Commissioner's duty under section 2 and section 28(5)).

(3) The Commissioner's functions in relation to the processing of personal data to which the UK GDPR applies include—

(a) a duty to advise Parliament, the government and other institutions and bodies on legislative and administrative measures relating to the protection of individuals' rights and freedoms with regard to the processing of personal data, and

(b) a power to issue, on the Commissioner's own initiative or on request, opinions to Parliament, the government or other institutions and bodies as well as to the public on any issue related to the protection of personal data.

(4) The Commissioner's functions under Article 58 of the UK GDPR are subject to the safeguards in subsections (5) to (9).

(5) The Commissioner's power under Article 58(1)(a) of the UK GDPR (power to require a controller or processor to provide information that the Commissioner requires for the performance of the Commissioner's tasks under the UK GDPR) is exercisable only by giving an information notice under section 142.

(6) The Commissioner's power under Article 58(1)(b) of the UK GDPR (power to carry out data protection audits) is exercisable only in accordance with section 146.

(7) The Commissioner's powers under Article 58(1)(e) and (f) of the UK GDPR (power to obtain information from controllers and processors and access to their premises) are exercisable only—

(a) in accordance with Schedule 15 (see section 154), or

(b) to the extent that they are exercised in conjunction with the power under Article 58(1)(b) of the UK GDPR, in accordance with section 146.

(8) The following powers are exercisable only by giving an enforcement notice under section 149—

(a) the Commissioner's powers under Article 58(2)(c) to (g) and (j) of the UK GDPR (certain corrective powers);

(b) the Commissioner's powers under Article 58(2)(h) to order a certification body to withdraw, or not to issue, a certification under Articles 42 and 43 of the UK GDPR.

(9) The Commissioner's powers under Articles 58(2)(i) and 83 of the UK GDPR (administrative fines) are exercisable only by giving a penalty notice under section 155.

(10) This section is without prejudice to other functions conferred on the Commissioner, whether by the UK GDPR, this Act or otherwise.

Other general functions

116

(A1) The Commissioner is responsible for monitoring the application of Part 3 of this Act, in order to protect the fundamental rights and freedoms of individuals in relation to processing by a competent authority for any of the law enforcement purposes (as defined in Part 3) and to facilitate the free flow of personal data.

(1) The Commissioner—

(a) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(b) is to continue to be the designated authority in the United Kingdom for the purposes of Article 13 of the Data Protection Convention.

(2) Schedule 13 confers general functions on the Commissioner in connection with processing to which the UK GDPR does not apply (and see also the Commissioner's duty under section 2).

(3) This section and Schedule 13 are without prejudice to other functions conferred on the Commissioner, whether by this Act or otherwise.

Competence in relation to courts etc

117

Nothing in this Act or the UK GDPR permits or requires the Commissioner to exercise functions in relation to the processing of personal data by—

(a) an individual acting in a judicial capacity, or

(b) a court or tribunal acting in its judicial capacity ...

....

International role

Co-operation and mutual assistance

118

(1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(4) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(5) Part 2 of Schedule 14 makes provision as to the functions to be carried out by the Commissioner for the purposes of Article 13 of the Data Protection Convention (co-operation between parties).

Inspection of personal data in accordance with international obligations

119

(1) The Commissioner may inspect personal data where the inspection is necessary in order to discharge an international obligation of the United Kingdom, subject to the restriction in subsection (2).

(2) The power under subsection (1) is exercisable only if the personal data—

(a) is processed wholly or partly by automated means, or

(b) is processed otherwise than by automated means and forms part of a filing system or is intended to form part of a filing system.

(3) The power under subsection (1) includes power to inspect, operate and test equipment which is used for the processing of personal data.

(4) Before exercising the power under subsection (1), the Commissioner must by written notice inform the controller and any processor that the Commissioner intends to do so.

(5) Subsection (4) does not apply if the Commissioner considers that the case is urgent.

(6) It is an offence—

(a) intentionally to obstruct a person exercising the power under subsection (1), or

(b) to fail without reasonable excuse to give a person exercising that power any assistance the person may reasonably require.

(7) Paragraphs (c) and (d) of section 3(14) do not apply to references in this section to personal data, the processing of personal data, a controller or a processor.

Further international role

120

(1) The Commissioner must, in relation to third countries and international organisations, take appropriate steps to—

(a) develop international co-operation mechanisms to facilitate the effective enforcement of legislation for the protection of personal data;

(b) provide international mutual assistance in the enforcement of legislation for the protection of personal data, subject to appropriate safeguards for the protection of personal data and ... fundamental rights and freedoms;

(c) engage relevant stakeholders in discussion and activities aimed at furthering international co-operation in the enforcement of legislation for the protection of personal data;

(d) promote the exchange and documentation of legislation and practice for the protection of personal data, including legislation and practice relating to jurisdictional conflicts with third countries.

(2) Subsection (1) applies only in connection with the processing of personal data to which the UK GDPR does not apply; for the equivalent duty in connection with the processing of personal data to which the UK GDPR applies, see Article 50 of the UK GDPR (international co-operation for the protection of personal data).

(2A) The Commissioner may contribute to the activities of international organisations with data protection functions.

(3) The Commissioner must carry out data protection functions which the Secretary of State directs the Commissioner to carry out for the purpose of enabling Her Majesty's Government in the United Kingdom to give effect to an international obligation of the United Kingdom.

(4) The Commissioner may provide an authority carrying out data protection functions under the law of a British overseas territory with assistance in carrying out those functions.

(5) The Secretary of State may direct that assistance under subsection (4) is to be provided on terms, including terms as to payment, specified or approved by the Secretary of State.

(6) In this section—

“data protection functions” means functions relating to the protection of individuals with respect to the processing of personal data;

“mutual assistance in the enforcement of legislation for the protection of personal data” includes assistance in the form of notification, complaint referral, investigative assistance and information exchange;

“third country” means a country or territory outside the United Kingdom.

(7) Section 3(14)(c) does not apply to references to personal data and the processing of personal data in this section.

Codes of practice

Data-sharing code

121

(1) The Commissioner must prepare a code of practice which contains—

(a) practical guidance in relation to the sharing of personal data in accordance with the requirements of the data protection legislation, and

(b) such other guidance as the Commissioner considers appropriate to promote good practice in the sharing of personal data.

(2) Where a code under this section is in force, the Commissioner may prepare amendments of the code or a replacement code.

(3) Before preparing a code or amendments under this section, the Commissioner must consult the Secretary of State and such of the following as the Commissioner considers appropriate—

(a) trade associations;

(b) data subjects;

(4) A code under this section may include transitional provision or savings.

(5) In this section—

“good practice in the sharing of personal data” means such practice in the sharing of personal data as appears to the Commissioner to be desirable having regard to the interests of data subjects and others, including compliance with the requirements of the data protection legislation;

“the sharing of personal data” means the disclosure of personal data by transmission, dissemination or otherwise making it available;

“trade association” includes a body representing controllers or processors.

Direct marketing code

122

(1) The Commissioner must prepare a code of practice which contains—

(a) practical guidance in relation to the carrying out of direct marketing in accordance with the requirements of the data protection legislation and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426), and

(b) such other guidance as the Commissioner considers appropriate to promote good practice in direct marketing.

(2) Where a code under this section is in force, the Commissioner may prepare amendments of the code or a replacement code.

(3) Before preparing a code or amendments under this section, the Commissioner must consult the Secretary of State and such of the following as the Commissioner considers appropriate—

(a) trade associations;

(b) data subjects;

(4) A code under this section may include transitional provision or savings.

(5) In this section—

“direct marketing” means the communication (by whatever means) of advertising or marketing material which is directed to particular individuals;

“good practice in direct marketing” means such practice in direct marketing as appears to the Commissioner to be desirable having regard to the interests of data subjects and others, including compliance with the requirements mentioned in subsection (1)(a);

“trade association” includes a body representing controllers or processors.

Age-appropriate design code

123

(1) The Commissioner must prepare a code of practice which contains such guidance as the Commissioner considers appropriate on standards of age-appropriate design of relevant information society services which are likely to be accessed by children.

(2) Where a code under this section is in force, the Commissioner may prepare amendments of the code or a replacement code.

(3) Before preparing a code or amendments under this section, the Commissioner must consult the Secretary of State and such other persons as the Commissioner considers appropriate, including—

(a) children,

(b) parents,

(d) child development experts, and

(e) trade associations.

(4) In preparing a code or amendments under this section, the Commissioner must have regard—

(a) to the fact that children have different needs at different ages, and

(b) to the United Kingdom's obligations under the United Nations Convention on the Rights of the Child.

(5) A code under this section may include transitional provision or savings.

(6) Any transitional provision included in the first code under this section must cease to have effect before the end of the period of 12 months beginning when the code comes into force.

(7) In this section—

“age-appropriate design” means the design of services so that they are appropriate for use by, and meet the development needs of, children;

“information society services” has the same meaning as in the UK GDPR, but does not include preventive or counselling services;

“relevant information society services” means information society services which involve the processing of personal data to which the UK GDPR applies;

“standards of age-appropriate design of relevant information society services” means such standards of age-appropriate design of such services as appear to the Commissioner to be desirable having regard to the best interests of children;

“trade association” includes a body representing controllers or processors;

“the United Nations Convention on the Rights of the Child” means the Convention on the Rights of the Child adopted by the General Assembly of the United Nations on 20 November 1989 (including any Protocols to that Convention which are in force in relation to the United Kingdom), subject to any reservations, objections or interpretative declarations by the United Kingdom for the time being in force.

Data protection and journalism code

124

(1) The Commissioner must prepare a code of practice which contains—

(a) practical guidance in relation to the processing of personal data for the purposes of journalism in accordance with the requirements of the data protection legislation, and

(b) such other guidance as the Commissioner considers appropriate to promote good practice in the processing of personal data for the purposes of journalism.

(2) Where a code under this section is in force, the Commissioner may prepare amendments of the code or a replacement code.

(3) Before preparing a code or amendments under this section, the Commissioner must consult such of the following as the Commissioner considers appropriate—

(a) trade associations;

(b) data subjects;

(4) A code under this section may include transitional provision or savings.

(5) In this section—

“good practice in the processing of personal data for the purposes of journalism” means such practice in the processing of personal data for those purposes as appears to the Commissioner to be desirable having regard to—the interests of data subjects and others ..., andthe special importance of the public interest in the freedom of expression and information; and includes compliance with the requirements of the data protection legislation;

“trade association” includes a body representing controllers or processors.

Approval of codes prepared under sections 121 to 124

125

(1) When a code is prepared under section 121, 122, 123 , 124 or 124A—

(a) the Commissioner must submit the final version to the Secretary of State, and

(b) the Secretary of State must lay the code before Parliament.

(2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(3) If, within the 40-day period, either House of Parliament resolves not to approve a code prepared under section 121, 122, 123 , 124 or 124A, the Commissioner must not issue the code.

(4) If no such resolution is made within that period—

(a) the Commissioner must issue the code, and

(b) the code comes into force at the end of the period of 21 days beginning with the day on which it is issued.

(5) If the Commissioner is prevented by subsection (3) from issuing a code that is not a replacement code, the Commissioner must prepare another version of the code.

(6) Nothing in subsection (3) prevents another version of the code being laid before Parliament.

(7) In this section, “the 40-day period” means—

(a) if the code is laid before both Houses of Parliament on the same day, the period of 40 days beginning with that day, or

(b) if the code is laid before the Houses of Parliament on different days, the period of 40 days beginning with the later of those days.

(8) In calculating the 40-day period, no account is to be taken of any whole days that fall within a period during which Parliament is dissolved or prorogued or during which both Houses of Parliament are adjourned for more than 4 days.

(9) This section, other than subsection (5), applies in relation to amendments prepared under section 121, 122, 123 , 124 or 124A as it applies in relation to codes prepared under those sections.

Publication and review of codes issued under section 125(4)

126

(1) The Commissioner must publish a code issued under section 125(4).

(2) Where an amendment of a code is issued under section 125(4), the Commissioner must publish—

(a) the amendment, or

(b) the code as amended by it.

(3) The Commissioner must keep under review each code issued under section 125(4) for the time being in force.

(4) Where the Commissioner becomes aware that the terms of such a code could result in a breach of an international obligation of the United Kingdom, the Commissioner must exercise the power under section 121(2), 122(2), 123(2) , 124(2) or 124A(3) with a view to remedying the situation.

Effect of codes issued under section 125(4)

127

(1) A failure by a person to act in accordance with a provision of a code issued under section 125(4) does not of itself make that person liable to legal proceedings in a court or tribunal.

(2) A code issued under section 125(4), including an amendment or replacement code, is admissible in evidence in legal proceedings.

(3) In any proceedings before a court or tribunal, the court or tribunal must take into account a provision of a code issued under section 125(4) in determining a question arising in the proceedings if—

(a) the question relates to a time when the provision was in force, and

(b) the provision appears to the court or tribunal to be relevant to the question.

(4) Where the Commissioner is carrying out a function described in subsection (5), the Commissioner must take into account a provision of a code issued under section 125(4) in determining a question arising in connection with the carrying out of the function if—

(a) the question relates to a time when the provision was in force, and

(b) the provision appears to the Commissioner to be relevant to the question.

(5) Those functions are functions under—

(a) the data protection legislation, or

(b) the Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426).

Other codes of practice

128

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Consensual audits

129

(1) The Commissioner's functions under Article 58(1) of the UK GDPR and paragraph 1 of Schedule 13 include power, with the consent of a controller or processor, to carry out an assessment of whether the controller or processor is complying with good practice in the processing of personal data.

(2) The Commissioner must inform the controller or processor of the results of such an assessment.

(3) In this section, “good practice in the processing of personal data” has the same meaning as in section 124A.

Records of national security certificates

130

(1) A Minister of the Crown who issues a certificate under section 27, 79 or 111 must send a copy of the certificate to the Commissioner.

(2) If the Commissioner receives a copy of a certificate under subsection (1), the Commissioner must publish a record of the certificate.

(3) The record must contain—

(a) the name of the Minister who issued the certificate,

(b) the date on which the certificate was issued, and

(4) The Commissioner must not publish the text, or a part of the text, of the certificate if—

(a) the Minister determines that publishing the text or that part of the text—

(i) would be against the interests of national security,

(ii) would be contrary to the public interest, or

(iii) might jeopardise the safety of any person, and

(b) the Minister has notified the Commissioner of that determination.

(5) The Commissioner must keep the record of the certificate available to the public while the certificate is in force.

(6) If a Minister of the Crown revokes a certificate issued under section 27, 79 or 111, the Minister must notify the Commissioner.

Information provided to the Commissioner

Disclosure of information to the Commissioner

131

(1) No enactment or rule of law prohibiting or restricting the disclosure of information precludes a person from providing the Commissioner with information necessary for the discharge of the Commissioner's functions.

(2) But this section does not authorise the making of a disclosure which is prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.

(3) Until the repeal of Part 1 of the Regulation of Investigatory Powers Act 2000 by paragraphs 45 and 54 of Schedule 10 to the Investigatory Powers Act 2016 is fully in force, subsection (2) has effect as if it included a reference to that Part.

Confidentiality of information

132

(1) A person who is or has been the Commissioner, or a member of the Commissioner's staff or an agent of the Commissioner, must not disclose information which—

(a) has been obtained by, or provided to, the Commissioner in the course of, or for the purposes of, the discharging of the Commissioner's functions,

(b) relates to an identified or identifiable individual or business, and

(c) is not available to the public from other sources at the time of the disclosure and has not previously been available to the public from other sources,

unless the disclosure is made with lawful authority.

(2) For the purposes of subsection (1), a disclosure is made with lawful authority only if and to the extent that—

(a) the disclosure was made with the consent of the individual or of the person for the time being carrying on the business,

(b) the information was obtained or provided as described in subsection (1)(a) for the purpose of its being made available to the public (in whatever manner),

(c) the disclosure was made for the purposes of, and is necessary for, the discharge of one or more of the Commissioner's functions,

(d) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(e) the disclosure was made for the purposes of criminal or civil proceedings, however arising, or

(f) having regard to the rights, freedoms and legitimate interests of any person, the disclosure was necessary in the public interest.

(3) It is an offence for a person knowingly or recklessly to disclose information in contravention of subsection (1).

Guidance about privileged communications

133

(1) The Commissioner must produce and publish guidance about—

(a) how the Commissioner proposes to secure that privileged communications which the Commissioner obtains or has access to in the course of carrying out the Commissioner's functions are used or disclosed only so far as necessary for carrying out those functions, and

(b) how the Commissioner proposes to comply with restrictions and prohibitions on obtaining or having access to privileged communications which are imposed by an enactment.

(2) The Commissioner—

(a) may alter or replace the guidance, and

(b) must publish any altered or replacement guidance.

(3) The Commissioner must consult the Secretary of State before publishing guidance under this section (including altered or replacement guidance).

(4) The Commissioner must arrange for guidance under this section (including altered or replacement guidance) to be laid before Parliament.

(5) In this section, “privileged communications” means—

(a) communications made—

(i) between a professional legal adviser and the adviser's client, and

(ii) in connection with the giving of legal advice to the client with respect to legal obligations, liabilities or rights, and

(b) communications made—

(i) between a professional legal adviser and the adviser's client or between such an adviser or client and another person,

(ii) in connection with or in contemplation of legal proceedings, and

(iii) for the purposes of such proceedings.

(6) In subsection (5)—

(a) references to the client of a professional legal adviser include references to a person acting on behalf of the client, and

(b) references to a communication include—

(i) a copy or other record of the communication, and

(ii) anything enclosed with or referred to in the communication if made as described in subsection (5)(a)(ii) or in subsection (5)(b)(ii) and (iii).

Fees

Fees for services

134

The Commissioner may require a person other than a data subject or a data protection officer to pay a reasonable fee for a service provided to the person, or at the person's request, which the Commissioner is required or authorised to provide under the data protection legislation.

Manifestly unfounded or excessive requests by data subjects etc

135

(A1) This section makes provision about cases in which a request made to the Commissioner, to which the Commissioner is required or authorised to respond under the data protection legislation, is manifestly unfounded or excessive.

(1) ... The Commissioner may—

(a) charge a reasonable fee for dealing with the request, or

(b) refuse to act on the request.

(1A) In subsection (1)—

(a) the reference in paragraph (a) to charging a reasonable fee is, in a case in which section 134 is relevant, a reference to doing so under that section, and

(b) paragraph (b) is not to be read as implying anything about whether the Commissioner may refuse to act on requests that are neither manifestly unfounded nor excessive.

(2) An example of a request that may be excessive is one that merely repeats the substance of previous requests.

(3) In any proceedings where there is an issue as to whether a request described in subsection (A1) is manifestly unfounded or excessive, it is for the Commissioner to show that it is.

(4) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(5) Article 57(3) of the UK GDPR (performance of Commissioner’s tasks generally to be free of charge for data subject) has effect subject to this section.

Guidance about fees

136

(1) The Commissioner must produce and publish guidance about the fees the Commissioner proposes to charge in accordance with—

(a) section 134 or 135, ...

(b) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(2) Before publishing the guidance, the Commissioner must consult the Secretary of State.

Charges

Charges payable to the Commissioner by controllers

137

(1) The Secretary of State may by regulations require controllers to pay charges of an amount specified in the regulations to the Commissioner.

(2) Regulations under subsection (1) may require a controller to pay a charge regardless of whether the Commissioner has provided, or proposes to provide, a service to the controller.

(3) Regulations under subsection (1) may—

(a) make provision about the time or times at which, or period or periods within which, a charge must be paid;

(b) make provision for cases in which a discounted charge is payable;

(d) make provision for cases in which a charge which has been paid is to be refunded.

(4) In making regulations under subsection (1), the Secretary of State must have regard to the desirability of securing that the charges payable to the Commissioner under such regulations are sufficient to offset—

(a) expenses incurred by the Commissioner in discharging the Commissioner's functions—

(i) under the data protection legislation,

(ii) under the Data Protection Act 1998,

(iii) under or by virtue of sections 108 and 109 of the Digital Economy Act 2017, and

(iv) under or by virtue of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426),

(b) any expenses of the Secretary of State in respect of the Commissioner so far as attributable to those functions,

(c) to the extent that the Secretary of State considers appropriate, any deficit previously incurred (whether before or after the passing of this Act) in respect of the expenses mentioned in paragraph (a), and

(d) to the extent that the Secretary of State considers appropriate, expenses incurred by the Secretary of State in respect of the inclusion of any officers or staff of the Commissioner in any scheme under section 1 of the Superannuation Act 1972 or section 1 of the Public Service Pensions Act 2013.

(5) The Secretary of State may from time to time require the Commissioner to provide information about the expenses referred to in subsection (4)(a).

(6) The Secretary of State may by regulations make provision—

(a) requiring a controller to provide information to the Commissioner, or

(b) enabling the Commissioner to require a controller to provide information to the Commissioner,

for either or both of the purposes mentioned in subsection (7).

(7) Those purposes are—

(a) determining whether a charge is payable by the controller under regulations under subsection (1);

(b) determining the amount of a charge payable by the controller.

(8) The provision that may be made under subsection (6)(a) includes provision requiring a controller to notify the Commissioner of a change in the controller's circumstances of a kind specified in the regulations.

Regulations under section 137: supplementary

138

(1) Before making regulations under section 137(1) or (6), the Secretary of State must consult such representatives of persons likely to be affected by the regulations as the Secretary of State thinks appropriate (and see also section 182).

(2) The Commissioner—

(a) must keep under review the working of regulations under section 137(1) or (6), and

(b) may from time to time submit proposals to the Secretary of State for amendments to be made to the regulations.

(3) The Secretary of State must review the working of regulations under section 137(1) or (6)—

(a) at the end of the period of 5 years beginning with the making of the first set of regulations under section 108 of the Digital Economy Act 2017, and

(b) at the end of each subsequent 5 year period.

(4) Regulations under section 137(1) are subject to the negative resolution procedure if—

(a) they only make provision increasing a charge for which provision is made by previous regulations under section 137(1) or section 108(1) of the Digital Economy Act 2017, and

(b) they do so to take account of an increase in the retail prices index since the previous regulations were made.

(5) Subject to subsection (4), regulations under section 137(1) or (6) are subject to the affirmative resolution procedure.

(6) In subsection (4), “the retail prices index” means—

(a) the general index of retail prices (for all items) published by the Statistics Board, or

(b) where that index is not published for a month, any substitute index or figures published by the Board.

(7) Regulations under section 137(1) or (6) may not apply to—

(a) Her Majesty in her private capacity,

(b) Her Majesty in right of the Duchy of Lancaster, or

Reports etc

Reporting to Parliament

139

(1) The Commissioner must—

(a) produce a general report on the carrying out of the Commissioner's functions annually,

(b) arrange for it to be laid before Parliament, and

(1A) In connection with the Commissioner’s functions under the data protection legislation, the report must contain (among other things)—

(a) a review of what the Commissioner has done during the reporting period to comply with the duties under—

(i) sections 120A and 120B,

(ii) section 108 of the Deregulation Act 2015, and

(iii) section 21 of the Legislative and Regulatory Reform Act 2006,

including a review of the operation of the strategy prepared and published under section 120C;

(b) a review of what the Commissioner has done during the reporting period to comply with the duty under section 120D.

(1B) In subsection (1A), “the reporting period” means the period to which the report relates.

(2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(2A) The report under this section may include the annual report under section 161A.

(3) The Commissioner may produce other reports relating to the carrying out of the Commissioner's functions and arrange for them to be laid before Parliament.

Publication by the Commissioner

140

A duty under this Act for the Commissioner to publish a document is a duty for the Commissioner to publish it, or to arrange for it to be published, in such form and manner as the Commissioner considers appropriate.

Notices from the Commissioner

141

(1) This section applies in relation to a notice authorised or required by this Act to be given to a person by the Commissioner.

(2) The notice may be given to an individual—

(a) by delivering it to the individual,

(b) by sending it to the individual by post addressed to the individual at his or her usual or last-known place of residence or business, or

(3) The notice may be given to a body corporate or unincorporate—

(a) by sending it by post to the proper officer of the body at its principal office, or

(b) by addressing it to the proper officer of the body and leaving it at that office.

(4) The notice may be given to a partnership in Scotland—

(a) by sending it by post to the principal office of the partnership, or

(b) by addressing it to that partnership and leaving it at that office.

(5) The notice may be given to the person by other means, including by electronic means, with the person's consent.

(6) In this section—

“principal office”, in relation to a registered company, means its registered office;

“proper officer”, in relation to any body, means the secretary or other executive officer charged with the conduct of its general affairs;

“registered company” means a company registered under the enactments relating to companies for the time being in force in the United Kingdom.

(7) This section is without prejudice to any other lawful method of giving a notice.

PART 6 — Enforcement

Information notices

142

(1) The Commissioner may, by written notice (an “information notice”)—

(a) require a controller or processor to provide the Commissioner with information that the Commissioner reasonably requires for the purposes of carrying out the Commissioner's functions under the data protection legislation, or

(b) require any person to provide the Commissioner with information that the Commissioner reasonably requires for the purposes of—

(i) investigating a suspected failure of a type described in section 149(2) or a suspected offence under this Act, or

(ii) determining whether the processing of personal data is carried out by an individual in the course of a purely personal or household activity.

(2) An information notice must state—

(a) whether it is given under subsection (1)(a), (b)(i) or (b)(ii), and

(b) why the Commissioner requires the information.

(3) An information notice—

(a) may specify or describe particular information or a category of information;

(b) may specify the form in which the information must be provided;

(d) may specify the place where the information must be provided;

(but see the restrictions in subsections (5) to (7)).

(4) An information notice must provide information about—

(a) the consequences of failure to comply with it, and

(b) the rights under sections 162 and 164 (appeals etc).

(5) An information notice may not require a person to provide information before the end of the period within which an appeal can be brought against the notice.

(6) If an appeal is brought against an information notice, the information need not be provided pending the determination or withdrawal of the appeal.

(7) If an information notice—

(a) states that, in the Commissioner's opinion, the information is required urgently, and

(b) gives the Commissioner's reasons for reaching that opinion,

subsections (5) and (6) do not apply but the notice must not require the information to be provided before the end of the period of 24 hours beginning when the notice is given.

(8) The Commissioner may cancel an information notice by written notice to the person to whom it was given.

(9) In subsection (1), in relation to a person who is a controller or processor for the purposes of the UK GDPR, the reference to a controller or processor includes a representative of a controller or processor designated under Article 27 of the UK GDPR (representatives of controllers or processors not established in the United Kingdom).

(10) Section 3(14)(c) does not apply to the reference to the processing of personal data in subsection (1)(b).

Information notices: restrictions

143

(1) The Commissioner may not give an information notice with respect to the processing of personal data for the special purposes unless—

(a) a determination under section 174 with respect to the data or the processing has taken effect, or

(b) the Commissioner—

(i) has reasonable grounds for suspecting that such a determination could be made, and

(ii) the information is required for the purposes of making such a determination.

(2) An information notice does not require a person to give the Commissioner information to the extent that requiring the person to do so would involve an infringement of the privileges of either House of Parliament.

(3) An information notice does not require a person to give the Commissioner information in respect of a communication which is made—

(a) between a professional legal adviser and the adviser's client, and

(b) in connection with the giving of legal advice to the client with respect to obligations, liabilities or rights under the data protection legislation.

(4) An information notice does not require a person to give the Commissioner information in respect of a communication which is made—

(a) between a professional legal adviser and the adviser's client or between such an adviser or client and another person,

(b) in connection with or in contemplation of proceedings under or arising out of the data protection legislation, and

(5) In subsections (3) and (4), references to the client of a professional legal adviser include references to a person acting on behalf of the client.

(6) An information notice does not require a person to provide the Commissioner with information if doing so would, by revealing evidence of the commission of an offence expose the person to proceedings for that offence.

(7) The reference to an offence in subsection (6) does not include an offence under—

(a) this Act;

(b) section 5 of the Perjury Act 1911 (false statements made otherwise than on oath);

(c) section 44(2) of the Criminal Law (Consolidation) (Scotland) Act 1995 (false statements made otherwise than on oath);

(d) Article 10 of the Perjury (Northern Ireland) Order 1979 (S.I. 1979/1714 (N.I. 19)) (false statutory declarations and other false unsworn statements).

(8) An oral or written statement provided by a person in response to an information notice may not be used in evidence against that person on a prosecution for an offence under this Act (other than an offence under section 144) unless in the proceedings—

(a) in giving evidence the person provides information inconsistent with the statement, and

(b) evidence relating to the statement is adduced, or a question relating to it is asked, by that person or on that person's behalf.

(9) In subsection (6), in relation to an information notice given to a representative of a controller or processor designated under Article 27 of the UK GDPR, the reference to the person providing the information being exposed to proceedings for an offence includes a reference to the controller or processor being exposed to such proceedings.

False statements made in response to information notices

144

It is an offence for a person, in response to an information notice—

(a) to make a statement which the person knows to be false in a material respect, or

(b) recklessly to make a statement which is false in a material respect.

Information orders

145

(1) This section applies if, on an application by the Commissioner, a court is satisfied that a person has failed to comply with a requirement of an information notice.

(2) The court may make an order requiring the person to provide to the Commissioner some or all of the following—

(a) information referred to in the information notice;

(b) other information which the court is satisfied the Commissioner requires, having regard to the statement included in the notice in accordance with section 142(2)(b).

(3) The order—

(a) may specify the form in which the information must be provided,

(b) must specify the time at which, or the period within which, the information must be provided, and

Assessment notices

146

(1) The Commissioner may by written notice (an “assessment notice”) require a controller or processor to permit the Commissioner to carry out an assessment of whether the controller or processor has complied or is complying with the data protection legislation.

(2) An assessment notice may require the controller or processor to do any of the following—

(a) permit the Commissioner to enter specified premises;

(b) direct the Commissioner to documents on the premises that are of a specified description;

(c) assist the Commissioner to view information of a specified description that is capable of being viewed using equipment on the premises;

(d) comply with a request from the Commissioner for a copy (in such form as may be requested) of—

(i) the documents to which the Commissioner is directed;

(ii) the information which the Commissioner is assisted to view;

(e) direct the Commissioner to equipment or other material on the premises which is of a specified description;

(f) permit the Commissioner to inspect or examine the documents, information, equipment or material to which the Commissioner is directed or which the Commissioner is assisted to view;

(g) provide the Commissioner with an explanation of such documents, information, equipment or material;

(h) permit the Commissioner to observe the processing of personal data that takes place on the premises;

(i) make available for interview by the Commissioner a specified number of people of a specified description who process personal data on behalf of the controller, not exceeding the number who are willing to be interviewed;

(j) make arrangements for an approved person to prepare a report on a specified matter;

(k) provide to the Commissioner a report prepared in pursuance of such arrangements.

(3) In subsection (2), references to the Commissioner include references to the Commissioner's officers and staff.

(3A) An assessment notice that requires a controller or processor to make arrangements for an approved person to prepare a report may require the arrangements to include specified terms as to—

(a) the preparation of the report;

(b) the contents of the report;

(d) the date by which the report is to be completed.

(4) An assessment notice must, in relation to each requirement imposed by the notice, specify the time or times at which, or period or periods within which, the requirement must be complied with (but see the restrictions in subsections (6) to (9)).

(5) An assessment notice must provide information about—

(a) the consequences of failure to comply with it, and

(b) the rights under sections 162 and 164 (appeals etc).

(6) An assessment notice may not require a person to do anything before the end of the period within which an appeal can be brought against the notice.

(7) If an appeal is brought against an assessment notice, the controller or processor need not comply with a requirement in the notice pending the determination or withdrawal of the appeal.

(8) If an assessment notice—

(a) states that, in the Commissioner's opinion, it is necessary for the controller or processor to comply with a requirement in the notice urgently,

(b) gives the Commissioner's reasons for reaching that opinion, and

subsections (6) and (7) do not apply but the notice must not require the controller or processor to comply with the requirement before the end of the period of 7 days beginning when the notice is given.

(9) If an assessment notice—

(a) states that, in the Commissioner's opinion, there are reasonable grounds for suspecting that a controller or processor has failed or is failing as described in section 149(2) or that an offence under this Act has been or is being committed,

(b) indicates the nature of the suspected failure or offence,

(d) states that, in the Commissioner's opinion, it is necessary for the controller or processor to comply with a requirement in the notice in less than 7 days, and

(e) gives the Commissioner's reasons for reaching that opinion,

subsections (6) and (7) do not apply.

(10) The Commissioner may cancel an assessment notice by written notice to the controller or processor to whom it was given.

(11) Where the Commissioner gives an assessment notice to a processor, the Commissioner must, so far as reasonably practicable, give a copy of the notice to each controller for whom the processor processes personal data.

(11A) Where the Commissioner gives an assessment notice that requires the controller or processor to make arrangements for an approved person to prepare a report, the controller or processor is liable for the payment of the approved person’s remuneration and expenses under the arrangements.

(12) In this section—

“approved person”, in relation to a report, means a person approved to prepare the report in accordance with section 146A;

“domestic premises” means premises, or a part of premises, used as a dwelling;

“specified” means specified in an assessment notice.

Assessment notices: restrictions

147

(1) An assessment notice does not require a person to do something to the extent that requiring the person to do it would involve an infringement of the privileges of either House of Parliament.

(2) An assessment notice does not have effect so far as compliance would result in the disclosure of a communication which is made—

(a) between a professional legal adviser and the adviser's client, and

(b) in connection with the giving of legal advice to the client with respect to obligations, liabilities or rights under the data protection legislation.

(3) An assessment notice does not have effect so far as compliance would result in the disclosure of a communication which is made—

(a) between a professional legal adviser and the adviser's client or between such an adviser or client and another person,

(b) in connection with or in contemplation of proceedings under or arising out of the data protection legislation, and

(4) In subsections (2) and (3)—

(a) references to the client of a professional legal adviser include references to a person acting on behalf of such a client, and

(b) references to a communication include—

(i) a copy or other record of the communication, and

(ii) anything enclosed with or referred to in the communication if made as described in subsection (2)(b) or in subsection (3)(b) and (c).

(5) The Commissioner may not give a controller or processor an assessment notice with respect to the processing of personal data for the special purposes.

(6) The Commissioner may not give an assessment notice to—

(a) a body specified in section 23(3) of the Freedom of Information Act 2000 (bodies dealing with security matters), ...

(b) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Information notices and assessment notices: destruction of documents etc

Destroying or falsifying information and documents etc

148

(1) This section applies where a person—

(a) has been given an information notice requiring the person to provide the Commissioner with information, or

(b) has been given an assessment notice requiring the person to direct the Commissioner to a document, equipment or other material or to assist the Commissioner to view information.

(2) It is an offence for the person—

(a) to destroy or otherwise dispose of, conceal, block or (where relevant) falsify all or part of the information, document, equipment or material, or

(b) to cause or permit the destruction, disposal, concealment, blocking or (where relevant) falsification of all or part of the information, document, equipment or material,

with the intention of preventing the Commissioner from viewing, or being provided with or directed to, all or part of the information, document, equipment or material.

(3) It is a defence for a person charged with an offence under subsection (2) to prove that the destruction, disposal, concealment, blocking or falsification would have occurred in the absence of the person being given the notice.

Enforcement notices

149

(1) Where the Commissioner is satisfied that a person has failed, or is failing, as described in subsection (2), (3), (4) or (5), the Commissioner may give the person a written notice (an “enforcement notice”) which requires the person—

(a) to take steps specified in the notice, or

(b) to refrain from taking steps specified in the notice,

or both (and see also sections 150 and 151).

(2) The first type of failure is where a controller or processor has failed, or is failing, to comply with any of the following—

(a) a provision of Chapter II of the UK GDPR or Chapter 2 of Part 3 or Chapter 2 of Part 4 of this Act (principles of processing);

(b) a provision of or made under Articles 12 to 22D of the UK GDPR or Part 3 or 4 of this Act conferring rights on a data subject;

(c) a provision of Articles 25 to 39 of the UK GDPR or section 64 or 65 of this Act (obligations of controllers and processors);

(d) a requirement to communicate a personal data breach to the Commissioner or a data subject under section 67, 68 or 108 of this Act;

(e) the principles for transfers of personal data to third countries, non-Convention countries and international organisations in Articles 44A to 49A of the UK GDPR or in sections 73 to 78 or 109 of this Act.

(3) The second type of failure is where a monitoring body has failed, or is failing, to comply with an obligation under Article 41 of the UK GDPR (monitoring of approved codes of conduct).

(4) The third type of failure is where a person who is a certification provider—

(a) does not meet the requirements for accreditation,

(b) has failed, or is failing, to comply with an obligation under Article 42 or 43 of the UK GDPR (certification of controllers and processors), or

(c) has failed, or is failing, to comply with any other provision of the UK GDPR (whether in the person's capacity as a certification provider or otherwise).

(5) The fourth type of failure is where a controller has failed, or is failing, to comply with regulations under section 137.

(6) An enforcement notice given in reliance on subsection (2), (3) or (5) may only impose requirements which the Commissioner considers appropriate for the purpose of remedying the failure.

(7) An enforcement notice given in reliance on subsection (4) may only impose requirements which the Commissioner considers appropriate having regard to the failure (whether or not for the purpose of remedying the failure).

(8) The Secretary of State may by regulations confer power on the Commissioner to give an enforcement notice in respect of other failures to comply with the data protection legislation.

(9) Regulations under this section—

(a) may make provision about the giving of an enforcement notice in respect of the failure, including by amending this section and sections 150 to 152,

(b) may make provision about the giving of an information notice, an assessment notice , an interview notice or a penalty notice, or about powers of entry and inspection, in connection with the failure, including by amending sections 142, 143, 146, 147 , 148A, 148B and 155 to 157 and Schedules 15 and 16, and

Enforcement notices: supplementary

150

(1) An enforcement notice must—

(a) state what the person has failed or is failing to do, and

(b) give the Commissioner's reasons for reaching that opinion.

(2) In deciding whether to give an enforcement notice in reliance on section 149(2), the Commissioner must consider whether the failure has caused or is likely to cause any person damage or distress.

(3) In relation to an enforcement notice given in reliance on section 149(2), the Commissioner's power under section 149(1)(b) to require a person to refrain from taking specified steps includes power—

(a) to impose a ban relating to all processing of personal data, or

(b) to impose a ban relating only to a specified description of processing of personal data, including by specifying one or more of the following—

(i) a description of personal data;

(ii) the purpose or manner of the processing;

(iii) the time when the processing takes place.

(4) An enforcement notice may specify the time or times at which, or period or periods within which, a requirement imposed by the notice must be complied with (but see the restrictions in subsections (6) to (8)).

(5) An enforcement notice must provide information about—

(a) the consequences of failure to comply with it, and

(b) the rights under sections 162 and 164 (appeals etc).

(6) An enforcement notice must not specify a time for compliance with a requirement in the notice which falls before the end of the period within which an appeal can be brought against the notice.

(7) If an appeal is brought against an enforcement notice, a requirement in the notice need not be complied with pending the determination or withdrawal of the appeal.

(8) If an enforcement notice—

(a) states that, in the Commissioner's opinion, it is necessary for a requirement to be complied with urgently, and

(b) gives the Commissioner's reasons for reaching that opinion,

subsections (6) and (7) do not apply but the notice must not require the requirement to be complied with before the end of the period of 24 hours beginning when the notice is given.

(9) In this section, “specified” means specified in an enforcement notice.

Enforcement notices: rectification and erasure of personal data etc

151

(1) Subsections (2) and (3) apply where an enforcement notice is given in respect of a failure by a controller or processor—

(a) to comply with a data protection principle relating to accuracy, or

(b) to comply with a data subject's request to exercise rights under Article 16, 17 or 18 of the UK GDPR (right to rectification, erasure or restriction on processing) or section 46, 47 or 100 of this Act.

(2) If the enforcement notice requires the controller or processor to rectify or erase inaccurate personal data, it may also require the controller or processor to rectify or erase any other data which—

(a) is held by the controller or processor, and

(b) contains an expression of opinion which appears to the Commissioner to be based on the inaccurate personal data.

(3) Where a controller or processor has accurately recorded personal data provided by the data subject or a third party but the data is inaccurate, the enforcement notice may require the controller or processor—

(a) to take steps specified in the notice to ensure the accuracy of the data,

(b) if relevant, to secure that the data indicates the data subject's view that the data is inaccurate, and

(c) to supplement the data with a statement of the true facts relating to the matters dealt with by the data that is approved by the Commissioner,

(as well as imposing requirements under subsection (2)).

(4) When deciding what steps it is reasonable to specify under subsection (3)(a), the Commissioner must have regard to the purpose for which the data was obtained and further processed.

(5) Subsections (6) and (7) apply where—

(a) an enforcement notice requires a controller or processor to rectify or erase personal data, or

(b) the Commissioner is satisfied that the processing of personal data which has been rectified or erased by the controller or processor involved a failure described in subsection (1).

(6) An enforcement notice may, if reasonably practicable, require the controller or processor to notify third parties to whom the data has been disclosed of the rectification or erasure.

(7) In determining whether it is reasonably practicable to require such notification, the Commissioner must have regard, in particular, to the number of people who would have to be notified.

(8) In this section, “data protection principle relating to accuracy” means the principle in—

(a) Article 5(1)(d) of the UK GDPR,

(b) section 38(1) of this Act, or

Enforcement notices: restrictions

152

(1) The Commissioner may not give a controller or processor an enforcement notice in reliance on section 149(2) with respect to the processing of personal data for the special purposes unless—

(a) a determination under section 174 with respect to the data or the processing has taken effect, and

(b) a court has granted leave for the notice to be given.

(2) A court must not grant leave for the purposes of subsection (1)(b) unless it is satisfied that—

(a) the Commissioner has reason to suspect a failure described in section 149(2) which is of substantial public importance, and

(b) the controller or processor has been given notice of the application for leave in accordance with rules of court or the case is urgent.

(3) An enforcement notice does not require a person to do something to the extent that requiring the person to do it would involve an infringement of the privileges of either House of Parliament.

(4) In the case of a joint controller in respect of the processing of personal data to which Part 3 or 4 applies whose responsibilities for compliance with that Part are determined in an arrangement under section 58 or 104, the Commissioner may only give the controller an enforcement notice in reliance on section 149(2) if the controller is responsible for compliance with the provision, requirement or principle in question.

Enforcement notices: cancellation and variation

153

(1) The Commissioner may cancel or vary an enforcement notice by giving written notice to the person to whom it was given.

(2) A person to whom an enforcement notice is given may apply in writing to the Commissioner for the cancellation or variation of the notice.

(3) An application under subsection (2) may be made only—

(a) after the end of the period within which an appeal can be brought against the notice, and

(b) on the ground that, by reason of a change of circumstances, one or more of the provisions of that notice need not be complied with in order to remedy the failure identified in the notice.

Powers of entry and inspection

154

Schedule 15 makes provision about powers of entry and inspection.

Penalties

Penalty notices

155

(1) If the Commissioner is satisfied that a person—

(a) has failed or is failing as described in section 149(2), (3), (4) or (5), ...

(b) has failed to comply with an information notice, an assessment notice , an interview notice or an enforcement notice , or

the Commissioner may, by written notice (a “penalty notice”), require the person to pay to the Commissioner an amount in sterling specified in the notice.

(2) Subject to subsection (4), when deciding whether to give a penalty notice to a person and determining the amount of the penalty, the Commissioner must have regard to the following, so far as relevant—

(a) to the extent that the notice concerns a matter to which the UK GDPR applies, the matters listed in Article 83(1) and (2) of the UK GDPR;

(b) to the extent that the notice concerns another matter, the matters listed in subsection (3).

(3) Those matters are—

(a) the nature, gravity and duration of the failure;

(b) the intentional or negligent character of the failure;

(d) the degree of responsibility of the controller or processor, taking into account technical and organisational measures implemented by the controller or processor in accordance with section 57, 66, 103 or 107;

(e) any relevant previous failures by the controller or processor;

(f) the degree of co-operation with the Commissioner, in order to remedy the failure and mitigate the possible adverse effects of the failure;

(g) the categories of personal data affected by the failure;

(h) the manner in which the infringement became known to the Commissioner, including whether, and if so to what extent, the controller or processor notified the Commissioner of the failure;

(i) the extent to which the controller or processor has complied with previous enforcement notices or penalty notices;

(j) adherence to approved codes of conduct or certification mechanisms;

(k) any other aggravating or mitigating factor applicable to the case, including financial benefits gained, or losses avoided, as a result of the failure (whether directly or indirectly);

(l) whether the penalty would be effective, proportionate and dissuasive.

(4) Subsections (2) and (3) do not apply in the case of a decision or determination relating to a failure described in section 149(5).

(5) Schedule 16 makes further provision about penalty notices, including provision requiring the Commissioner to give a notice of intent to impose a penalty and provision about payment, variation, cancellation and enforcement.

(6) The Secretary of State may by regulations—

(a) confer power on the Commissioner to give a penalty notice in respect of other failures to comply with the data protection legislation, and

(b) provide for the maximum penalty that may be imposed in relation to such failures to be either the standard maximum amount or the higher maximum amount.

(7) Regulations under this section—

(a) may make provision about the giving of penalty notices in respect of the failure,

(b) may amend this section and sections 156 to 158, and

(8) In this section, “higher maximum amount” and “standard maximum amount” have the same meaning as in section 157.

Penalty notices: restrictions

156

(1) The Commissioner may not give a controller or processor a penalty notice in reliance on section 149(2) with respect to the processing of personal data for the special purposes unless—

(a) a determination under section 174 with respect to the data or the processing has taken effect, and

(b) a court has granted leave for the notice to be given.

(2) A court must not grant leave for the purposes of subsection (1)(b) unless it is satisfied that—

(a) the Commissioner has reason to suspect a failure described in section 149(2) which is of substantial public importance, and

(b) the controller or processor has been given notice of the application for leave in accordance with rules of court or the case is urgent.

(3) The Commissioner may not give a controller or processor a penalty notice with respect to the processing of personal data where the purposes and manner of the processing are determined by or on behalf of either House of Parliament.

(4) The Commissioner may not give a penalty notice to—

(a) the Crown Estate Commissioners, or

(b) a person who is a controller by virtue of section 209(4) (controller for the Royal Household etc).

(5) In the case of a joint controller in respect of the processing of personal data to which Part 3 or 4 applies whose responsibilities for compliance with that Part are determined in an arrangement under section 58 or 104, the Commissioner may only give the controller a penalty notice in reliance on section 149(2) if the controller is responsible for compliance with the provision, requirement or principle in question.

Maximum amount of penalty

157

(1) In relation to an infringement of a provision of the UK GDPR, the maximum amount of the penalty that may be imposed by a penalty notice is—

(a) the amount specified in Article 83 of the UK GDPR, or

(b) if an amount is not specified there, the standard maximum amount.

(2) In relation to an infringement of a provision of Part 3 of this Act, the maximum amount of the penalty that may be imposed by a penalty notice is—

(a) in relation to a failure to comply with section 35, 36, 37, 38(1), 39(1), 40, 44, 45, 46, 47, 48, 50B, 50C, 52, 53, 73, ... 75, 76, 77 or 78, the higher maximum amount, and

(b) otherwise, the standard maximum amount.

(3) In relation to an infringement of a provision of Part 4 of this Act, the maximum amount of the penalty that may be imposed by a penalty notice is—

(a) in relation to a failure to comply with section 86, 87, 88, 89, 90, 91, 93, 94, 100 or 109, the higher maximum amount, and

(b) otherwise, the standard maximum amount.

(4) In relation to a failure to comply with an information notice, an assessment notice , an interview notice or an enforcement notice, the maximum amount of the penalty that may be imposed by a penalty notice is the higher maximum amount.

(5) The “higher maximum amount” is—

(a) in the case of an undertaking, £17,500,000 or 4% of the undertaking's total annual worldwide turnover in the preceding financial year, whichever is higher, or

(b) in any other case, £17,500,000.

(6) The “standard maximum amount” is—

(a) in the case of an undertaking, £8,700,000 or 2% of the undertaking's total annual worldwide turnover in the preceding financial year, whichever is higher, or

(b) in any other case, £8,700,000.

(7) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Fixed penalties for non-compliance with charges regulations

158

(1) The Commissioner must produce and publish a document specifying the amount of the penalty for a failure to comply with regulations made under section 137.

(2) The Commissioner may specify different amounts for different types of failure.

(3) The maximum amount that may be specified is 150% of the highest charge payable by a controller in respect of a financial year in accordance with the regulations, disregarding any discount available under the regulations.

(4) The Commissioner—

(a) may alter or replace the document, and

(b) must publish any altered or replacement document.

(5) Before publishing a document under this section (including any altered or replacement document), the Commissioner must consult—

(a) the Secretary of State, and

(b) such other persons as the Commissioner considers appropriate.

(6) The Commissioner must arrange for a document published under this section (including any altered or replacement document) to be laid before Parliament.

Amount of penalties: supplementary

159

(1) For the purposes of Article 83 of the UK GDPR and section 157, the Secretary of State may by regulations—

(a) provide that a person of a description specified in the regulations is or is not an undertaking, and

(b) make provision about how an undertaking's turnover is to be determined.

(2) For the purposes of Article 83 of the UK GDPR, section 157 and section 158, the Secretary of State may by regulations provide that a period is or is not a financial year.

(3) Regulations under this section are subject to the affirmative resolution procedure.

Guidance and report

Guidance about regulatory action

160

(1) The Commissioner must produce and publish guidance about how the Commissioner proposes to exercise the Commissioner's functions in connection with—

(a) information notices,

(b) assessment notices,

(ba) interview notices,

(d) penalty notices.

(2) The Commissioner may produce and publish guidance about how the Commissioner proposes to exercise the Commissioner's other functions under this Part.

(3) In relation to information notices, the guidance must include—

(a) provision specifying factors to be considered in determining the time at which, or the period within which, information is to be required to be provided;

(b) provision about the circumstances in which the Commissioner would consider it appropriate to give an information notice to a person in reliance on section 142(7) (urgent cases);

(c) provision about how the Commissioner will determine how to proceed if a person does not comply with an information notice.

(4) In relation to assessment notices, the guidance must include—

(a) provision specifying factors to be considered in determining whether to give an assessment notice to a person;

(aa) provision specifying factors to be considered in determining whether to give an assessment notice to a person that imposes a requirement of a sort mentioned in section 146(2)(j);

(ab) provision about the factors the Commissioner may take into account when determining the suitability of a person to prepare a report of a sort mentioned in section 146(2)(j);

(b) provision about the circumstances in which the Commissioner would consider it appropriate to give an assessment notice in reliance on section 146(8) or (9) (urgent cases);

(i) are not to be examined or inspected in accordance with an assessment notice, or

(ii) are to be so examined or inspected only by a person of a description specified in the guidance;

(d) provision about the nature of inspections and examinations carried out in accordance with an assessment notice;

(e) provision about the nature of interviews carried out in accordance with an assessment notice;

(f) provision about the preparation, issuing and publication by the Commissioner of assessment reports in respect of controllers and processors that have been given assessment notices;

(g) provision about how the Commissioner will determine how to proceed if a person does not comply with an assessment notice.

(5) The guidance produced in accordance with subsection (4)(c) must include provisions that relate to—

(a) documents and information concerning an individual's physical or mental health;

(b) documents and information concerning the provision of social care for an individual.

(5A) In relation to interview notices, the guidance must include—

(a) provision specifying factors to be considered in determining whether to give an interview notice to an individual;

(b) provision about the circumstances in which the Commissioner would consider it appropriate to give an interview notice to an individual in reliance on section 148A(8) (urgent cases);

(c) provision about the circumstances in which the Commissioner would consider it appropriate to vary the place or time specified in an interview notice at the request of the individual to whom the notice is given;

(d) provision about the nature of interviews carried out in accordance with an interview notice;

(e) provision about how the Commissioner will determine how to proceed if an individual does not comply with an interview notice.

(6) In relation to enforcement notices, the guidance must include—

(a) provision specifying factors to be considered in determining whether to give an enforcement notice to a person;

(b) provision about the circumstances in which the Commissioner would consider it appropriate to give an enforcement notice to a person in reliance on section 150(8) (urgent cases);

(c) provision about how the Commissioner will determine how to proceed if a person does not comply with an enforcement notice.

(7) In relation to penalty notices, the guidance must include—

(a) provision about the circumstances in which the Commissioner would consider it appropriate to issue a penalty notice;

(b) provision about the circumstances in which the Commissioner would consider it appropriate to allow a person to make oral representations about the Commissioner's intention to give the person a penalty notice;

(d) provision about how the Commissioner will determine how to proceed if a person does not comply with a penalty notice.

(e) provision about the circumstances in which the Commissioner would consider it necessary to comply with the duty in paragraph 4(A2) of Schedule 16 after the period of 6 months mentioned in that paragraph.

(8) The Commissioner—

(a) may alter or replace guidance produced under this section, and

(b) must publish any altered or replacement guidance.

(9) Before producing guidance under this section (including any altered or replacement guidance), the Commissioner must consult—

(a) the Secretary of State, and

(b) such other persons as the Commissioner considers appropriate.

(10) Section 161 applies in relation to the first guidance under subsection (1).

(11) The Commissioner must arrange for other guidance under this section (including any altered or replacement guidance) to be laid before Parliament.

(12) In this section, “social care” has the same meaning as in Part 1 of the Health and Social Care Act 2008 (see section 9(3) of that Act).

Approval of first guidance about regulatory action

161

(1) When the first guidance is produced under section 160(1)—

(a) the Commissioner must submit the final version to the Secretary of State, and

(b) the Secretary of State must lay the guidance before Parliament.

(2) If, within the 40-day period, either House of Parliament resolves not to approve the guidance—

(a) the Commissioner must not issue the guidance, and

(b) the Commissioner must produce another version of the guidance (and this section applies to that version).

(3) If, within the 40-day period, no such resolution is made—

(a) the Commissioner must issue the guidance, and

(b) the guidance comes into force at the end of the period of 21 days beginning with the day on which it is issued.

(4) Nothing in subsection (2)(a) prevents another version of the guidance being laid before Parliament.

(5) In this section, “the 40-day period” means—

(a) if the guidance is laid before both Houses of Parliament on the same day, the period of 40 days beginning with that day, or

(b) if the guidance is laid before the Houses of Parliament on different days, the period of 40 days beginning with the later of those days.

(6) In calculating the 40-day period, no account is to be taken of any whole days that fall within a period during which Parliament is dissolved or prorogued or during which both Houses of Parliament are adjourned for more than 4 days.

Appeals etc

Rights of appeal

162

(1) A person who is given any of the following notices may appeal to the Tribunal—

(a) an information notice;

(b) an assessment notice;

(ba) an interview notice;

(d) a penalty notice;

(e) a penalty variation notice.

(2) A person who is given an enforcement notice may appeal to the Tribunal against the refusal of an application under section 153 for the cancellation or variation of the notice.

(3) A person who is given a penalty notice or a penalty variation notice may appeal to the Tribunal against the amount of the penalty specified in the notice, whether or not the person appeals against the notice.

(4) Where a determination is made under section 174 in respect of the processing of personal data, the controller or processor may appeal to the Tribunal against the determination.

Determination of appeals

163

(1) Subsections (2) to (4) apply where a person appeals to the Tribunal under section 162(1) or (3).

(2) The Tribunal may review any determination of fact on which the notice or decision against which the appeal is brought was based.

(3) If the Tribunal considers—

(a) that the notice or decision against which the appeal is brought is not in accordance with the law, or

(b) to the extent that the notice or decision involved an exercise of discretion by the Commissioner, that the Commissioner ought to have exercised the discretion differently,

the Tribunal must allow the appeal or substitute another notice or decision which the Commissioner could have given or made.

(4) Otherwise, the Tribunal must dismiss the appeal.

(5) On an appeal under section 162(2), if the Tribunal considers that the enforcement notice ought to be cancelled or varied by reason of a change in circumstances, the Tribunal must cancel or vary the notice.

(6) On an appeal under section 162(4), the Tribunal may cancel the Commissioner's determination.

Applications in respect of urgent notices

164

(1) This section applies where an information notice, an assessment notice , an interview notice or an enforcement notice given to a person contains an urgency statement.

(2) The person may apply to the court for either or both of the following—

(a) the disapplication of the urgency statement in relation to some or all of the requirements of the notice;

(b) a change to the time at which, or the period within which, a requirement of the notice must be complied with.

(3) On an application under subsection (2), the court may do any of the following—

(a) direct that the notice is to have effect as if it did not contain the urgency statement;

(b) direct that the inclusion of the urgency statement is not to have effect in relation to a requirement of the notice;

(c) vary the notice by changing the time at which, or the period within which, a requirement of the notice must be complied with;

(d) vary the notice by making other changes required to give effect to a direction under paragraph (a) or (b) or in consequence of a variation under paragraph (c).

(4) The decision of the court on an application under this section is final.

(5) In this section, “urgency statement” means—

(a) in relation to an information notice, a statement under section 142(7)(a),

(b) in relation to an assessment notice, a statement under section 146(8)(a) or (9)(d),

(ba) in relation to an interview notice, a statement under section 148A(8)(a), and

Complaints

Complaints by data subjects

165

(1) Articles 57(1)(f) and (2) and 77 of the UK GDPR (data subject's right to lodge a complaint) confer rights on data subjects to complain to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of the UK GDPR.

(2) A data subject may make a complaint to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of Part 3 or 4 of this Act.

(3) The Commissioner must facilitate the making of complaints under subsection (2) by taking steps such as providing a complaint form which can be completed electronically and by other means.

(4) If the Commissioner receives a complaint under subsection (2), the Commissioner must—

(a) take appropriate steps to respond to the complaint,

(b) inform the complainant of the outcome of the complaint,

(d) if asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint.

(5) The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes—

(a) investigating the subject matter of the complaint, to the extent appropriate, and

(b) informing the complainant about progress on the complaint, including about whether further investigation or co-ordination with a foreign designated authority is necessary.

(6) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(7) In this section—

“foreign designated authority” means an authority designated for the purposes of Article 13 of the Data Protection Convention by a party, other than the United Kingdom, which is bound by that Convention;

Orders to progress complaints

166

(1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the UK GDPR, the Commissioner—

(a) fails to take appropriate steps to respond to the complaint,

(b) fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or

(c) if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.

(2) The Tribunal may, on an application by the data subject, make an order requiring the Commissioner—

(a) to take appropriate steps to respond to the complaint, or

(b) to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.

(3) An order under subsection (2)(a) may require the Commissioner—

(a) to take steps specified in the order;

(b) to conclude an investigation, or take a specified step, within a period specified in the order.

(4) Section 165(5) applies for the purposes of subsections (1)(a) and (2)(a) as it applies for the purposes of section 165(4)(a).

Remedies in the court

Compliance orders

167

(1) This section applies if, on an application by a data subject, a court is satisfied that there has been an infringement of the data subject's rights under the data protection legislation in contravention of that legislation.

(2) A court may make an order for the purposes of securing compliance with the data protection legislation which requires the controller in respect of the processing, or a processor acting on behalf of that controller—

(a) to take steps specified in the order, or

(b) to refrain from taking steps specified in the order.

(3) The order may, in relation to each step, specify the time at which, or the period within which, it must be taken.

(4) In subsection (1)—

(a) the reference to an application by a data subject includes an application made in exercise of the right under Article 79(1) of the UK GDPR (right to an effective remedy against a controller or processor);

(b) the reference to the data protection legislation does not include Part 4 of this Act or regulations made under that Part.

(5) In relation to a joint controller in respect of the processing of personal data to which Part 3 applies whose responsibilities are determined in an arrangement under section 58, a court may only make an order under this section if the controller is responsible for compliance with the provision of the data protection legislation that is contravened.

Compensation for contravention of the GDPR

168

(1) In Article 82 of the UK GDPR (right to compensation for material or non-material damage), “non-material damage” includes distress.

(2) Subsection (3) applies where—

(a) in accordance with rules of court, proceedings under Article 82 of the UK GDPR are brought by a representative body on behalf of a person, and

(b) a court orders the payment of compensation.

(3) The court may make an order providing for the compensation to be paid on behalf of the person to—

(a) the representative body, or

(b) such other person as the court thinks fit.

Compensation for contravention of other data protection legislation

169

(1) A person who suffers damage by reason of a contravention of a requirement of the data protection legislation, other than the UK GDPR, is entitled to compensation for that damage from the controller or the processor, subject to subsections (2) and (3).

(2) Under subsection (1)—

(a) a controller involved in processing of personal data is liable for any damage caused by the processing, and

(b) a processor involved in processing of personal data is liable for damage caused by the processing only if the processor—

(i) has not complied with an obligation under the data protection legislation specifically directed at processors, or

(ii) has acted outside, or contrary to, the controller's lawful instructions.

(3) A controller or processor is not liable as described in subsection (2) if the controller or processor proves that the controller or processor is not in any way responsible for the event giving rise to the damage.

(4) A joint controller in respect of the processing of personal data to which Part 3 or 4 applies whose responsibilities are determined in an arrangement under section 58 or 104 is only liable as described in subsection (2) if the controller is responsible for compliance with the provision of the data protection legislation that is contravened.

(5) In this section, “damage” includes financial loss and damage not involving financial loss, such as distress.

Offences relating to personal data

Unlawful obtaining etc of personal data

170

(1) It is an offence for a person knowingly or recklessly—

(a) to obtain or disclose personal data without the consent of the controller,

(b) to procure the disclosure of personal data to another person without the consent of the controller, or

(c) after obtaining personal data, to retain it without the consent of the person who was the controller in relation to the personal data when it was obtained.

(2) It is a defence for a person charged with an offence under subsection (1) to prove that the obtaining, disclosing, procuring or retaining—

(a) was necessary for the purposes of preventing , investigating or detecting crime,

(b) was required or authorised by an enactment, by a rule of law or by the order of a court or tribunal, or

(3) It is also a defence for a person charged with an offence under subsection (1) to prove that—

(a) the person acted in the reasonable belief that the person had a legal right to do the obtaining, disclosing, procuring or retaining,

(b) the person acted in the reasonable belief that the person would have had the consent of the controller if the controller had known about the obtaining, disclosing, procuring or retaining and the circumstances of it, or

(i) for the special purposes,

(ii) with a view to the publication by a person of any journalistic, academic, artistic or literary material, and

(iii) in the reasonable belief that in the particular circumstances the obtaining, disclosing, procuring or retaining was justified as being in the public interest.

(4) It is an offence for a person to sell personal data if the person obtained the data in circumstances in which an offence under subsection (1) was committed.

(5) It is an offence for a person to offer to sell personal data if the person—

(a) has obtained the data in circumstances in which an offence under subsection (1) was committed, or

(b) subsequently obtains the data in such circumstances.

(6) For the purposes of subsection (5), an advertisement indicating that personal data is or may be for sale is an offer to sell the data.

(7) In this section—

(a) references to the consent of a controller do not include the consent of a person who is a controller by virtue of Article 28(10) of the UK GDPR or section 59(8) or 105(3) of this Act (processor to be treated as controller in certain circumstances);

(b) where there is more than one controller, such references are references to the consent of one or more of them.

Re-identification of de-identified personal data

171

(1) It is an offence for a person knowingly or recklessly to re-identify information that is de-identified personal data without the consent of the controller responsible for de-identifying the personal data.

(2) For the purposes of this section and section 172—

(a) personal data is “de-identified” if it has been processed in such a manner that it can no longer be attributed, without more, to a specific data subject;

(b) a person “re-identifies” information if the person takes steps which result in the information no longer being de-identified within the meaning of paragraph (a).

(3) It is a defence for a person charged with an offence under subsection (1) to prove that the re-identification—

(a) was necessary for the purposes of preventing , investigating or detecting crime,

(b) was required or authorised by an enactment, by a rule of law or by the order of a court or tribunal, or

(4) It is also a defence for a person charged with an offence under subsection (1) to prove that—

(a) the person acted in the reasonable belief that the person—

(i) is the data subject to whom the information relates,

(ii) had the consent of that data subject, or

(iii) would have had such consent if the data subject had known about the re-identification and the circumstances of it,

(b) the person acted in the reasonable belief that the person—

(i) is the controller responsible for de-identifying the personal data,

(ii) had the consent of that controller, or

(iii) would have had such consent if that controller had known about the re-identification and the circumstances of it,

(i) for the special purposes,

(ii) with a view to the publication by a person of any journalistic, academic, artistic or literary material, and

(iii) in the reasonable belief that in the particular circumstances the re-identification was justified as being in the public interest, or

(d) the effectiveness testing conditions were met (see section 172).

(5) It is an offence for a person knowingly or recklessly to process personal data that is information that has been re-identified where the person does so—

(a) without the consent of the controller responsible for de-identifying the personal data, and

(b) in circumstances in which the re-identification was an offence under subsection (1).

(6) It is a defence for a person charged with an offence under subsection (5) to prove that the processing—

(a) was necessary for the purposes of preventing , investigating or detecting crime,

(b) was required or authorised by an enactment, by a rule of law or by the order of a court or tribunal, or

(7) It is also a defence for a person charged with an offence under subsection (5) to prove that—

(a) the person acted in the reasonable belief that the processing was lawful,

(b) the person acted in the reasonable belief that the person—

(i) had the consent of the controller responsible for de-identifying the personal data, or

(ii) would have had such consent if that controller had known about the processing and the circumstances of it, or

(i) for the special purposes,

(ii) with a view to the publication by a person of any journalistic, academic, artistic or literary material, and

(iii) in the reasonable belief that in the particular circumstances the processing was justified as being in the public interest.

(8) In this section—

(a) references to the consent of a controller do not include the consent of a person who is a controller by virtue of Article 28(10) of the UK GDPR or section 59(8) or 105(3) of this Act (processor to be treated as controller in certain circumstances);

(b) where there is more than one controller, such references are references to the consent of one or more of them.

Re-identification: effectiveness testing conditions

172

(1) For the purposes of section 171, in relation to a person who re-identifies information that is de-identified personal data, “the effectiveness testing conditions” means the conditions in subsections (2) and (3).

(2) The first condition is that the person acted—

(a) with a view to testing the effectiveness of the de-identification of personal data,

(b) without intending to cause, or threaten to cause, damage or distress to a person, and

(c) in the reasonable belief that, in the particular circumstances, re-identifying the information was justified as being in the public interest.

(3) The second condition is that the person notified the Commissioner or the controller responsible for de-identifying the personal data about the re-identification—

(a) without undue delay, and

(b) where feasible, not later than 72 hours after becoming aware of it.

(4) Where there is more than one controller responsible for de-identifying personal data, the requirement in subsection (3) is satisfied if one or more of them is notified.

Alteration etc of personal data to prevent disclosure to data subject

173

(1) Subsection (3) applies where—

(a) a request has been made in exercise of a data subject access right, and

(b) the person making the request would have been entitled to receive information in response to that request.

(2) In this section, “data subject access right” means a right under—

(a) Article 15 of the UK GDPR (right of access by the data subject);

(b) Article 20 of the UK GDPR (right to data portability);

(d) section 94 of this Act (intelligence services processing: right of access by the data subject).

(3) It is an offence for a person listed in subsection (4) to alter, deface, block, erase, destroy or conceal information with the intention of preventing disclosure of all or part of the information that the person making the request would have been entitled to receive.

(4) Those persons are—

(a) the controller, and

(b) a person who is employed by the controller, an officer of the controller or subject to the direction of the controller.

(5) It is a defence for a person charged with an offence under subsection (3) to prove that—

(a) the alteration, defacing, blocking, erasure, destruction or concealment of the information would have occurred in the absence of a request made in exercise of a data subject access right, or

(b) the person acted in the reasonable belief that the person making the request was not entitled to receive the information in response to the request.

The special purposes

174

(1) In this Part, “the special purposes” means one or more of the following—

(a) the purposes of journalism;

(b) academic purposes;

(d) literary purposes.

(2) In this Part, “special purposes proceedings” means legal proceedings against a controller or processor which relate, wholly or partly, to personal data processed for the special purposes and which are—

(a) proceedings under section 167 (including proceedings on an application under Article 79 of the UK GDPR), or

(b) proceedings under Article 82 of the UK GDPR or section 169.

(3) The Commissioner may make a written determination, in relation to the processing of personal data, that—

(a) the personal data is not being processed only for the special purposes;

(b) the personal data is not being processed with a view to the publication by a person of journalistic, academic, artistic or literary material which has not previously been published by the controller.

(4) The Commissioner must give written notice of the determination to the controller and the processor.

(5) The notice must provide information about the rights of appeal under section 162.

(6) The determination does not take effect until one of the following conditions is satisfied—

(a) the period for the controller or the processor to appeal against the determination has ended without an appeal having been brought, or

(b) an appeal has been brought against the determination and—

(i) the appeal and any further appeal in relation to the determination has been decided or has otherwise ended, and

(ii) the time for appealing against the result of the appeal or further appeal has ended without another appeal having been brought.

Provision of assistance in special purposes proceedings

175

(1) An individual who is a party, or prospective party, to special purposes proceedings may apply to the Commissioner for assistance in those proceedings.

(2) As soon as reasonably practicable after receiving an application under subsection (1), the Commissioner must decide whether, and to what extent, to grant it.

(3) The Commissioner must not grant the application unless, in the Commissioner's opinion, the case involves a matter of substantial public importance.

(4) If the Commissioner decides not to provide assistance, the Commissioner must, as soon as reasonably practicable, notify the applicant of the decision, giving reasons for the decision.

(5) If the Commissioner decides to provide assistance, the Commissioner must—

(a) as soon as reasonably practicable, notify the applicant of the decision, stating the extent of the assistance to be provided, and

(b) secure that the person against whom the proceedings are, or are to be, brought is informed that the Commissioner is providing assistance.

(6) The assistance that may be provided by the Commissioner includes—

(a) paying costs in connection with the proceedings, and

(b) indemnifying the applicant in respect of liability to pay costs, expenses or damages in connection with the proceedings.

(7) In England and Wales or Northern Ireland, the recovery of expenses incurred by the Commissioner in providing an applicant with assistance under this section (as taxed or assessed in accordance with rules of court) is to constitute a first charge for the benefit of the Commissioner—

(a) on any costs which, by virtue of any judgment or order of the court, are payable to the applicant by any other person in respect of the matter in connection with which the assistance is provided, and

(b) on any sum payable to the applicant under a compromise or settlement arrived at in connection with that matter to avoid, or bring to an end, any proceedings.

(8) In Scotland, the recovery of such expenses (as taxed or assessed in accordance with rules of court) is to be paid to the Commissioner, in priority to other debts—

(a) out of any expenses which, by virtue of any judgment or order of the court, are payable to the applicant by any other person in respect of the matter in connection with which the assistance is provided, and

(b) out of any sum payable to the applicant under a compromise or settlement arrived at in connection with that matter to avoid, or bring to an end, any proceedings.

Staying special purposes proceedings

176

(1) In any special purposes proceedings before a court, if the controller or processor claims, or it appears to the court, that any personal data to which the proceedings relate—

(a) is being processed only for the special purposes,

(b) is being processed with a view to the publication by any person of journalistic, academic, artistic or literary material, and

the court must stay or, in Scotland, sist the proceedings.

(2) In considering, for the purposes of subsection (1)(c), whether material has previously been published, publication in the immediately preceding 24 hours is to be ignored.

(3) Under subsection (1), the court must stay or sist the proceedings until either of the following conditions is met—

(a) a determination of the Commissioner under section 174 with respect to the personal data or the processing takes effect;

(b) where the proceedings were stayed or sisted on the making of a claim, the claim is withdrawn.

Guidance about how to seek redress against media organisations

177

(1) The Commissioner must produce and publish guidance about the steps that may be taken where an individual considers that a media organisation is failing or has failed to comply with the data protection legislation.

(2) In this section, “media organisation” means a body or other organisation whose activities consist of or include journalism.

(3) The guidance must include provision about relevant complaints procedures, including—

(a) who runs them,

(b) what can be complained about, and

(4) For the purposes of subsection (3), relevant complaints procedures include procedures for making complaints to the Commissioner, the Office of Communications, the British Broadcasting Corporation and other persons who produce or enforce codes of practice for media organisations.

(5) The guidance must also include provision about—

(a) the powers available to the Commissioner in relation to a failure to comply with the data protection legislation,

(b) when a claim in respect of such a failure may be made before a court and how to make such a claim,

(d) the rights of bodies and other organisations to make complaints and claims on behalf of data subjects, and

(e) the Commissioner's power to provide assistance in special purpose proceedings.

(6) The Commissioner—

(a) may alter or replace the guidance, and

(b) must publish any altered or replacement guidance.

(7) The Commissioner must produce and publish the first guidance under this section before the end of the period of 1 year beginning when this Act is passed.

Review of processing of personal data for the purposes of journalism

178

(1) The Commissioner must—

(a) review the extent to which, during each review period, the processing of personal data for the purposes of journalism complied with—

(i) the data protection legislation, and

(ii) good practice in the processing of personal data for the purposes of journalism,

(b) prepare a report of the review, and

(2) In this section—

“good practice in the processing of personal data for the purposes of journalism” has the same meaning as in section 124;

“review period” means—the period of 4 years beginning with the day on which Chapter 2 of Part 2 of this Act comes into force, andeach subsequent period of 5 years beginning with the day after the day on which the previous review period ended.

(3) The Commissioner must start a review under this section, in respect of a review period, within the period of 6 months beginning when the review period ends.

(4) The Commissioner must submit the report of a review under this section to the Secretary of State—

(a) in the case of the first review, before the end of the period of 18 months beginning when the Commissioner started the review, and

(b) in the case of each subsequent review, before the end of the period of 12 months beginning when the Commissioner started the review.

(5) The report must include consideration of the extent of compliance (as described in subsection (1)(a)) in each part of the United Kingdom.

(6) The Secretary of State must—

(a) lay the report before Parliament, and

(b) send a copy of the report to—

(i) the Scottish Ministers,

(ii) the Welsh Ministers, and

(iii) the Executive Office in Northern Ireland.

(7) Schedule 17 makes further provision for the purposes of a review under this section.

Effectiveness of the media’s dispute resolution procedures

179

(1) The Secretary of State must, before the end of each review period, lay before Parliament a report produced by the Secretary of State or an appropriate person on—

(a) the use of relevant alternative dispute resolution procedures, during that period, in cases involving a failure, or alleged failure, by a relevant media organisation to comply with the data protection legislation, and

(b) the effectiveness of those procedures in such cases.

(2) In this section—

“appropriate person” means a person who the Secretary of State considers has appropriate experience and skills to produce a report described in subsection (1);

“relevant alternative dispute resolution procedures” means alternative dispute resolution procedures provided by persons who produce or enforce codes of practice for relevant media organisations;

“relevant media organisation” means a body or other organisation whose activities consist of or include journalism, other than a broadcaster;

“review period” means—the period of 3 years beginning when this Act is passed, andeach subsequent period of 3 years.

(3) The Secretary of State must send a copy of the report to—

(a) the Scottish Ministers,

(b) the Welsh Ministers, and

Jurisdiction and court procedure

Jurisdiction

180

(1) The jurisdiction conferred on a court by the provisions listed in subsection (2) is exercisable—

(a) in England and Wales, by the High Court or the county court,

(b) in Northern Ireland, by the High Court or a county court, and

subject to subsections (3) and (4).

(2) Those provisions are—

(a) section 145 (information orders);

(b) section 152 (enforcement notices and processing for the special purposes);

(d) section 167 and Article 79 of the UK GDPR (compliance orders);

(e) sections 168 and 169 and Article 82 of the UK GDPR (compensation).

(3) In relation to the processing of personal data to which Part 4 applies, the jurisdiction conferred by the provisions listed in subsection (2) is exercisable only by the High Court or, in Scotland, the Court of Session.

(4) In relation to an information notice which contains a statement under section 142(7), the jurisdiction conferred on a court by section 145 is exercisable only by the High Court or, in Scotland, the Court of Session.

(5) The jurisdiction conferred on a court by section 164 (applications in respect of urgent notices) is exercisable only by the High Court or, in Scotland, the Court of Session.

Definitions

Interpretation of Part 6

181

In this Part—

“assessment notice” has the meaning given in section 146;

“certification provider” has the meaning given in section 17;

“enforcement notice” has the meaning given in section 149;

“information notice” has the meaning given in section 142;

“interview notice” has the meaning given in section 148A;

“penalty notice” has the meaning given in section 155;

“penalty variation notice” has the meaning given in Schedule 16;

PART 7 — Supplementary and final provision

Regulations under this Act

Regulations and consultation

182

(1) Regulations under this Act are to be made by statutory instrument.

(2) Before making regulations under this Act, the Secretary of State must consult—

(a) the Commissioner, and

(b) such other persons as the Secretary of State considers appropriate.

(3) Subsection (2) does not apply to regulations made under—

(a) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(b) section 30;

(d) section 212;

(e) section 213;

(f) paragraph 15 of Schedule 2.

(4) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(5) Regulations under this Act may—

(a) make different provision for different purposes;

(b) include consequential, supplementary, incidental, transitional, transitory or saving provision.

(6) For the purposes of this Act, where regulations are subject to “the negative resolution procedure” the statutory instrument containing the regulations is subject to annulment in pursuance of a resolution of either House of Parliament.

(7) For the purposes of this Act, where regulations are subject to “the affirmative resolution procedure” the regulations may not be made unless a draft of the statutory instrument containing them has been laid before Parliament and approved by a resolution of each House of Parliament.

(8) For the purposes of this Act, regulations are subject to “the made affirmative resolution procedure” if—

(a) the statutory instrument containing the regulations must be laid before Parliament after being made, together with an urgency statement in respect of them, and

(b) the regulations cease to have effect at the end of a period beginning with the day on which the instrument is made, unless within that period the instrument is approved by a resolution of each House of Parliament.

(9) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(10) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(11) Any provision that may be included in regulations under this Act subject to the negative resolution procedure may be made by regulations made under this Act or another enactment that are subject to the affirmative resolution procedure or the made affirmative resolution procedure.

(12) If a draft of a statutory instrument containing regulations under section 7 would, apart from this subsection, be treated for the purposes of the standing orders of either House of Parliament as a hybrid instrument, it is to proceed in that House as if it were not such an instrument.

(13) A requirement under a provision of this Act to consult may be satisfied by consultation before, as well as by consultation after, the provision comes into force.

(14) For the purposes of this section, an urgency statement is a reasoned statement that the Secretary of State considers it desirable for regulations to come into force without delay.

Changes to the Data Protection Convention

Power to reflect changes to the Data Protection Convention

183

(1) The Secretary of State may by regulations make such provision as the Secretary of State considers necessary or appropriate in connection with an amendment of, or an instrument replacing, the Data Protection Convention which has effect, or is expected to have effect, in the United Kingdom.

(2) The power under subsection (1) includes power—

(a) to amend or replace the definition of “the Data Protection Convention” in section 3;

(b) to amend Chapter 3 of Part 2 of this Act;

(d) to make provision about the functions of the Commissioner, courts or tribunals in connection with relevant processing of personal data, including provision amending Parts 5 to 7 of this Act;

(e) to make provision about the functions of the Commissioner in connection with the Data Protection Convention or an instrument replacing that Convention, including provision amending Parts 5 to 7 of this Act;

(f) to consequentially amend this Act.

(2A) In subsection (2)(d), “relevant processing of personal data” means—

(a) processing of personal data described in Article 2(1)(a) or (b) or (1A) of the UK GDPR, and

(b) processing of personal data to which Part 4 of this Act applies.

(3) Regulations under this section are subject to the affirmative resolution procedure.

(4) Regulations under this section may not be made after the end of the period of 3 years beginning with the day on which this Act is passed.

Rights of the data subject

Prohibition of requirement to produce relevant records

184

(1) It is an offence for a person (“P1”) to require another person to provide P1 with, or give P1 access to, a relevant record in connection with—

(a) the recruitment of an employee by P1,

(b) the continued employment of a person by P1, or

(2) It is an offence for a person (“P2”) to require another person to provide P2 with, or give P2 access to, a relevant record if—

(a) P2 is involved in the provision of goods, facilities or services to the public or a section of the public, and

(b) the requirement is a condition of providing or offering to provide goods, facilities or services to the other person or to a third party.

(3) It is a defence for a person charged with an offence under subsection (1) or (2) to prove that imposing the requirement—

(a) was required or authorised by an enactment, by a rule of law or by the order of a court or tribunal, or

(b) in the particular circumstances, was justified as being in the public interest.

(4) The imposition of the requirement referred to in subsection (1) or (2) is not to be regarded as justified as being in the public interest on the ground that it would assist in the prevention , investigation or detection of crime, given —

(a) Part 5 of the Police Act 1997 (certificates of criminal records etc), and

(b) Part 1 of the Disclosure (Scotland) Act 2020 (disclosure of criminal history and other information).

(5) In subsections (1) and (2), the references to a person who requires another person to provide or give access to a relevant record include a person who asks another person to do so—

(a) knowing that, in the circumstances, it would be reasonable for the other person to feel obliged to comply with the request, or

(b) being reckless as to whether, in the circumstances, it would be reasonable for the other person to feel obliged to comply with the request,

and the references to a “requirement” in subsections (3) and (4) are to be interpreted accordingly.

(6) In this section—

“employment” means any employment, including—work under a contract for services or as an office-holder,work under an apprenticeship,work experience as part of a training course or in the course of training for employment, andvoluntary work,and “employee” is to be interpreted accordingly;

“relevant record” has the meaning given in Schedule 18 and references to a relevant record include—a part of such a record, anda copy of, or of part of, such a record.

Avoidance of certain contractual terms relating to health records

185

(1) A term or condition of a contract is void in so far as it purports to require an individual to supply another person with a record which—

(a) consists of the information contained in a health record, and

(b) has been or is to be obtained by a data subject in the exercise of a data subject access right.

(2) A term or condition of a contract is also void in so far as it purports to require an individual to produce such a record to another person.

(3) The references in subsections (1) and (2) to a record include a part of a record and a copy of all or part of a record.

(4) In this section, “data subject access right” means a right under—

(a) Article 15 of the UK GDPR (right of access by the data subject);

(b) Article 20 of the UK GDPR (right to data portability);

(d) section 94 of this Act (intelligence services processing: right of access by the data subject).

Data subject’s rights and other prohibitions and restrictions

186

(1) An enactment or rule of law prohibiting or restricting the disclosure of information, or authorising the withholding of information, does not remove or restrict the obligations and rights provided for in the provisions listed in subsection (2) ....

(2) The provisions providing obligations and rights are—

(a) Chapter III of the UK GDPR (rights of the data subject),

(b) Chapter 3 of Part 3 of this Act (law enforcement processing: rights of the data subject), and

(2A) Subsection (1) does not apply—

(a) to an enactment contained in, or made under, a provision listed in subsection (2),

(b) to an enactment contained in, or made under, a provision listed in subsection (3),

(c) to the extent that an enactment makes express provision to the contrary referring to this section or to a provision listed in subsection (2), or

(d) to the extent that subsection (1) is disapplied by section 186A(3).

(3) The provisions referred to in subsection (2A)(b) are—

(a) in Chapter 2 of Part 2 of this Act, sections 15 and 16 and Schedules 2, 3 and 4,

(b) in Chapter 3 of Part 2 of this Act, sections ... 24, 25 and 26,

(ca) in Part 3 of this Act, section 78A, and

(d) in Part 4 of this Act, Chapter 6 .

Representation of data subjects

Representation of data subjects with their authority

187

(1) In relation to the processing of personal data to which the UK GDPR applies, Article 80(1) of the UK GDPR (representation of data subjects)—

(a) ... enables a data subject to authorise a body or other organisation which meets the conditions set out in subsections (3) and (4) to exercise the data subject's rights under Articles 77, 78 and 79 of the UK GDPR (rights to lodge complaints and to an effective judicial remedy) on the data subject's behalf, and

(b) also authorises such a body or organisation to exercise the data subject's rights under Article 82 of the UK GDPR (right to compensation).

(2) In relation to the processing of personal data to which the UK GDPR does not apply, a body or other organisation which meets the conditions in subsections (3) and (4), if authorised to do so by a data subject, may exercise some or all of the following rights of a data subject on the data subject's behalf—

(a) rights under section 165(2) and (4)(d) (complaints to the Commissioner);

(b) rights under section 166(2) (orders for the Commissioner to progress complaints);

(d) the right to bring judicial review proceedings against the Commissioner.

(3) The first condition is that the body or organisation, by virtue of its constitution or an enactment—

(a) is required (after payment of outgoings) to apply the whole of its income and any capital it expends for charitable or public purposes,

(b) is prohibited from directly or indirectly distributing amongst its members any part of its assets (otherwise than for charitable or public purposes), and

(4) The second condition is that the body or organisation is active in the field of protection of data subjects' rights and freedoms with regard to the protection of their personal data.

(5) In this Act, references to a “representative body”, in relation to a right of a data subject, are to a body or other organisation authorised to exercise the right on the data subject's behalf under Article 80 of the UK GDPR or this section.

Representation of data subjects with their authority: collective proceedings

188

(1) The Secretary of State may by regulations make provision for representative bodies to bring proceedings before a court or tribunal in England and Wales or Northern Ireland combining two or more relevant claims.

(2) In this section, “relevant claim”, in relation to a representative body, means a claim in respect of a right of a data subject which the representative body is authorised to exercise on the data subject's behalf under Article 80(1) of the UK GDPR or section 187.

(3) The power under subsection (1) includes power—

(a) to make provision about the proceedings;

(b) to confer functions on a person, including functions involving the exercise of a discretion;

(4) The provision mentioned in subsection (3)(a) includes provision about—

(a) the effect of judgments and orders;

(b) agreements to settle claims;

(d) the persons to whom compensation may or must be paid, including compensation not claimed by the data subject;

(e) costs.

(5) Regulations under this section are subject to the negative resolution procedure.

Duty to review provision for representation of data subjects

189

(1) Before the end of the review period, the Secretary of State must—

(a) review the matters listed in subsection (2) in relation to England and Wales and Northern Ireland,

(b) prepare a report of the review, and

(2) Those matters are—

(a) the operation of Article 80(1) of the UK GDPR,

(b) the operation of section 187,

(c) the merits of exercising the power under Article 80(2) of the UK GDPR (power to enable a body or other organisation which meets the conditions in Article 80(1) of the UK GDPR to exercise some or all of a data subject's rights under Articles 77, 78 and 79 of the UK GDPR without being authorised to do so by the data subject),

(d) the merits of making equivalent provision in relation to data subjects' rights under Article 82 of the UK GDPR (right to compensation), and

(e) the merits of making provision for a children's rights organisation to exercise some or all of a data subject's rights under Articles 77, 78, 79 and 82 of the UK GDPR on behalf of a data subject who is a child, with or without being authorised to do so by the data subject.

(3) “The review period” is the period of 30 months beginning when section 187 comes into force.

(4) In carrying out the review, the Secretary of State must—

(a) consider the particular needs of children separately from the needs of adults,

(b) have regard to the fact that children have different needs at different stages of development,

(c) carry out an analysis of the particular challenges that children face in authorising, and deciding whether to authorise, other persons to act on their behalf under Article 80(1) of the UK GDPR or section 187,

(d) consider the support and advice available to children in connection with the exercise of their rights under Articles 77, 78, 79 and 82 of the UK GDPR by another person on their behalf and the merits of making available other support or advice, and

(e) have regard to the United Kingdom's obligations under the United Nations Convention on the Rights of the Child.

(5) Before preparing the report under subsection (1), the Secretary of State must consult the Commissioner and such other persons as the Secretary of State considers appropriate, including—

(a) persons active in the field of protection of data subjects' rights and freedoms with regard to the protection of their personal data,

(b) children and parents,

(c) children's rights organisations and other persons who appear to the Secretary of State to represent the interests of children,

(d) child development experts, and

(e) trade associations.

(6) In this section—

“children's rights organisation” means a body or other organisation which—is active in representing the interests of children, andhas objectives which are in the public interest;

“trade association” includes a body representing controllers or processors;

“the United Nations Convention on the Rights of the Child” means the Convention on the Rights of the Child adopted by the General Assembly of the United Nations on 20 November 1989 (including any Protocols to that Convention which are in force in relation to the United Kingdom), subject to any reservations, objections or interpretative declarations by the United Kingdom for the time being in force.

Post-review powers to make provision about representation of data subjects

190

(1) After the report under section 189(1) is laid before Parliament, the Secretary of State may by regulations—

(a) exercise the powers under Article 80(2) of the UK GDPR in relation to England and Wales and Northern Ireland,

(b) make provision enabling a body or other organisation which meets the conditions in Article 80(1) of the UK GDPR to exercise a data subject's rights under Article 82 of the UK GDPR in England and Wales and Northern Ireland without being authorised to do so by the data subject, and

(c) make provision described in section 189(2)(e) in relation to the exercise in England and Wales and Northern Ireland of the rights of a data subject who is a child.

(2) The powers under subsection (1) include power—

(a) to make provision enabling a data subject to prevent a body or other organisation from exercising, or continuing to exercise, the data subject's rights;

(b) to make provision about proceedings before a court or tribunal where a body or organisation exercises a data subject's rights;

(c) to make provision for bodies or other organisations to bring proceedings before a court or tribunal combining two or more claims in respect of a right of a data subject;

(d) to confer functions on a person, including functions involving the exercise of a discretion;

(e) to amend sections 166 to 168, 180, 187, 203, 205 and 206;

(f) to insert new sections and Schedules into Part 6 or 7 ;

(g) to make different provision in relation to England and Wales and in relation to Northern Ireland.

(3) The powers under subsection (1)(a) and (b) include power to make provision in relation to data subjects who are children or data subjects who are not children or both.

(4) The provision mentioned in subsection (2)(b) and (c) includes provision about—

(a) the effect of judgments and orders;

(b) agreements to settle claims;

(d) the persons to whom compensation may or must be paid, including compensation not claimed by the data subject;

(e) costs.

(5) Regulations under this section are subject to the affirmative resolution procedure.

Framework for Data Processing by Government

191

(1) The Secretary of State may prepare a document, called the Framework for Data Processing by Government, which contains guidance about the processing of personal data in connection with the exercise of functions of—

(a) the Crown, a Minister of the Crown or a United Kingdom government department, and

(b) a person with functions of a public nature who is specified or described in regulations made by the Secretary of State.

(2) The document may make provision relating to all of those functions or only to particular functions or persons.

(3) The document may not make provision relating to, or to the functions of, a part of the Scottish Administration, the Welsh Government, a Northern Ireland Minister or a Northern Ireland department.

(4) The Secretary of State may from time to time prepare amendments of the document or a replacement document.

(5) Before preparing a document or amendments under this section, the Secretary of State must consult—

(a) the Commissioner, and

(b) any other person the Secretary of State considers it appropriate to consult.

(6) Regulations under subsection (1)(b) are subject to the negative resolution procedure.

(7) In this section, “Northern Ireland Minister” includes the First Minister and deputy First Minister in Northern Ireland.

Approval of the Framework

192

(1) Before issuing a document prepared under section 191, the Secretary of State must lay it before Parliament.

(2) If, within the 40-day period, either House of Parliament resolves not to approve the document, the Secretary of State must not issue it.

(3) If no such resolution is made within that period—

(a) the Secretary of State must issue the document, and

(b) the document comes into force at the end of the period of 21 days beginning with the day on which it is issued.

(4) Nothing in subsection (2) prevents another version of the document being laid before Parliament.

(5) In this section, “the 40-day period” means—

(a) if the document is laid before both Houses of Parliament on the same day, the period of 40 days beginning with that day, or

(b) if the document is laid before the Houses of Parliament on different days, the period of 40 days beginning with the later of those days.

(6) In calculating the 40-day period, no account is to be taken of any whole days that fall within a period during which Parliament is dissolved or prorogued or during which both Houses of Parliament are adjourned for more than 4 days.

(7) This section applies in relation to amendments prepared under section 191 as it applies in relation to a document prepared under that section.

Publication and review of the Framework

193

(1) The Secretary of State must publish a document issued under section 192(3).

(2) Where an amendment of a document is issued under section 192(3), the Secretary of State must publish—

(a) the amendment, or

(b) the document as amended by it.

(3) The Secretary of State must keep under review the document issued under section 192(3) for the time being in force.

(4) Where the Secretary of State becomes aware that the terms of such a document could result in a breach of an international obligation of the United Kingdom, the Secretary of State must exercise the power under section 191(4) with a view to remedying the situation.

Effect of the Framework

194

(1) When carrying out processing of personal data which is the subject of a document issued under section 192(3) which is for the time being in force, a person must have regard to the document.

(2) A failure to act in accordance with a provision of such a document does not of itself make a person liable to legal proceedings in a court or tribunal.

(3) A document issued under section 192(3), including an amendment or replacement document, is admissible in evidence in legal proceedings.

(4) In any legal proceedings before a court or tribunal, the court or tribunal must take into account a provision of any document issued under section 192(3) in determining a question arising in the proceedings if—

(a) the question relates to a time when the provision was in force, and

(b) the provision appears to the court or tribunal to be relevant to the question.

(5) In determining a question arising in connection with the carrying out of any of the Commissioner's functions, the Commissioner must take into account a provision of a document issued under section 192(3) if—

(a) the question relates to a time when the provision was in force, and

(b) the provision appears to the Commissioner to be relevant to the question.

Data-sharing: HMRC and reserve forces

Reserve forces: data-sharing by HMRC

195

(1) The Reserve Forces Act 1996 is amended as follows.

(2) After section 125 insert—

(125A) (1) This subsection applies to contact details for— (a) a member of an ex-regular reserve force, or (b) a person to whom section 66 (officers and former servicemen liable to recall) applies, which are held by HMRC in connection with a function of HMRC. (2) HMRC may supply contact details to which subsection (1) applies to the Secretary of State for the purpose of enabling the Secretary of State— (a) to contact a member of an ex-regular reserve force in connection with the person's liability, or potential liability, to be called out for service under Part 6; (b) to contact a person to whom section 66 applies in connection with the person's liability, or potential liability, to be recalled for service under Part 7. (3) Where a person's contact details are supplied under subsection (2) for a purpose described in that subsection, they may also be used for defence purposes connected with the person's service (whether past, present or future) in the reserve forces or regular services. (4) In this section, “HMRC” means Her Majesty's Revenue and Customs. (125B) (1) A person who receives information supplied under section 125A may not disclose it except with the consent of the Commissioners for Her Majesty's Revenue and Customs (which may be general or specific). (2) A person who contravenes subsection (1) is guilty of an offence. (3) It is a defence for a person charged with an offence under this section to prove that the person reasonably believed— (a) that the disclosure was lawful, or (b) that the information had already lawfully been made available to the public. (4) Subsections (4) to (7) of section 19 of the Commissioners for Revenue and Customs Act 2005 apply to an offence under this section as they apply to an offence under that section. (5) Nothing in section 107 or 108 (institution of proceedings and evidence) applies in relation to an offence under this section. (125C) (1) Nothing in section 125A or 125B authorises the making of a disclosure which contravenes the data protection legislation. (2) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Offences

Penalties for offences

196

(1) A person who commits an offence under section 119 or 173 or paragraph 15 of Schedule 15 is liable—

(a) on summary conviction in England and Wales, to a fine;

(b) on summary conviction in Scotland or Northern Ireland, to a fine not exceeding level 5 on the standard scale.

(2) A person who commits an offence under section 132, 144, 148, 148C, 170, 171 or 184 is liable—

(a) on summary conviction in England and Wales, to a fine;

(b) on summary conviction in Scotland or Northern Ireland, to a fine not exceeding the statutory maximum;

(3) Subsections (4) and (5) apply where a person is convicted of an offence under section 170 or 184.

(4) The court by or before which the person is convicted may order a document or other material to be forfeited, destroyed or erased if—

(a) it has been used in connection with the processing of personal data, and

(b) it appears to the court to be connected with the commission of the offence,

subject to subsection (5).

(5) If a person, other than the offender, who claims to be the owner of the material, or to be otherwise interested in the material, applies to be heard by the court, the court must not make an order under subsection (4) without giving the person an opportunity to show why the order should not be made.

Prosecution

197

(1) In England and Wales, proceedings for an offence under this Act may be instituted only—

(a) by the Commissioner, or

(b) by or with the consent of the Director of Public Prosecutions.

(2) In Northern Ireland, proceedings for an offence under this Act may be instituted only—

(a) by the Commissioner, or

(b) by or with the consent of the Director of Public Prosecutions for Northern Ireland.

(3) Subject to subsection (4), summary proceedings for an offence under section 173 (alteration etc of personal data to prevent disclosure) may be brought within the period of 6 months beginning with the day on which the prosecutor first knew of evidence that, in the prosecutor's opinion, was sufficient to bring the proceedings.

(4) Such proceedings may not be brought after the end of the period of 3 years beginning with the day on which the offence was committed.

(5) A certificate signed by or on behalf of the prosecutor and stating the day on which the 6 month period described in subsection (3) began is conclusive evidence of that fact.

(6) A certificate purporting to be signed as described in subsection (5) is to be treated as so signed unless the contrary is proved.

(7) In relation to proceedings in Scotland, section 136(3) of the Criminal Procedure (Scotland) Act 1995 (deemed date of commencement of proceedings) applies for the purposes of this section as it applies for the purposes of that section.

Liability of directors etc

198

(1) Subsection (2) applies where—

(a) an offence under this Act has been committed by a body corporate, and

(b) it is proved to have been committed with the consent or connivance of or to be attributable to neglect on the part of—

(i) a director, manager, secretary or similar officer of the body corporate, or

(ii) a person who was purporting to act in such a capacity.

(2) The director, manager, secretary, officer or person, as well as the body corporate, is guilty of the offence and liable to be proceeded against and punished accordingly.

(3) Where the affairs of a body corporate are managed by its members, subsections (1) and (2) apply in relation to the acts and omissions of a member in connection with the member's management functions in relation to the body as if the member were a director of the body corporate.

(4) Subsection (5) applies where—

(a) an offence under this Act has been committed by a Scottish partnership, and

(b) the contravention in question is proved to have occurred with the consent or connivance of, or to be attributable to any neglect on the part of, a partner.

(5) The partner, as well as the partnership, is guilty of the offence and liable to be proceeded against and punished accordingly.

Recordable offences

199

(1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(2) Regulations under section 27(4) of the Police and Criminal Evidence Act 1984 (recordable offences) may repeal subsection (1).

Guidance about PACE codes of practice

200

(1) The Commissioner must produce and publish guidance about how the Commissioner proposes to perform the duty under section 67(9) of the Police and Criminal Evidence Act 1984 (duty to have regard to codes of practice under that Act when investigating offences and charging offenders) in connection with offences under this Act.

(2) The Commissioner—

(a) may alter or replace the guidance, and

(b) must publish any altered or replacement guidance.

(3) The Commissioner must consult the Secretary of State before publishing guidance under this section (including any altered or replacement guidance).

(4) The Commissioner must arrange for guidance under this section (including any altered or replacement guidance) to be laid before Parliament.

The Tribunal

Disclosure of information to the Tribunal

201

(1) No enactment or rule of law prohibiting or restricting the disclosure of information precludes a person from providing the First-tier Tribunal or the Upper Tribunal with information necessary for the discharge of—

(a) its functions under the data protection legislation, or

(b) its other functions relating to the Commissioner's acts and omissions.

(2) But this section does not authorise the making of a disclosure which is prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.

(3) Until the repeal of Part 1 of the Regulation of Investigatory Powers Act 2000 by paragraphs 45 and 54 of Schedule 10 to the Investigatory Powers Act 2016 is fully in force, subsection (2) has effect as if it included a reference to that Part.

Proceedings in the First-tier Tribunal: contempt

202

(1) This section applies where—

(a) a person does something, or fails to do something, in relation to proceedings before the First-tier Tribunal—

(i) on an appeal under section 27, 79, 82E, 111 or 162, or

(ii) for an order under section 166, and

(b) if those proceedings were proceedings before a court having power to commit for contempt, the act or omission would constitute contempt of court.

(2) The First-tier Tribunal may certify the offence to the Upper Tribunal.

(3) Where an offence is certified under subsection (2), the Upper Tribunal may—

(a) inquire into the matter, and

(b) deal with the person charged with the offence in any manner in which it could deal with the person if the offence had been committed in relation to the Upper Tribunal.

(4) Before exercising the power under subsection (3)(b), the Upper Tribunal must—

(a) hear any witness who may be produced against or on behalf of the person charged with the offence, and

(b) hear any statement that may be offered in defence.

Tribunal Procedure Rules

203

(1) Tribunal Procedure Rules may make provision for regulating—

(a) the exercise of the rights of appeal conferred by section 27, 79, 82E, 111 or 162, and

(b) the exercise of the rights of data subjects under section 166, including their exercise by a representative body.

(2) In relation to proceedings involving the exercise of those rights, Tribunal Procedure Rules may make provision about—

(a) securing the production of material used for the processing of personal data, and

(b) the inspection, examination, operation and testing of equipment or material used in connection with the processing of personal data.

Interpretation

Meaning of “health professional” and “social work professional”

204

(1) In this Act, “health professional” means any of the following—

(a) a registered medical practitioner;

(b) a registered nurse or midwife;

(d) a registered dispensing optician or a registered optometrist within the meaning of the Opticians Act 1989 (see section 36 of that Act);

(e) a registered osteopath with the meaning of the Osteopaths Act 1993 (see section 41 of that Act);

(f) a registered chiropractor within the meaning of the Chiropractors Act 1994 (see section 43 of that Act);

(g) a person registered as a member of a profession to which the Health ... Professions Order 2001 (S.I. 2002/254) for the time being extends; ...

(h) a registered pharmacist or a registered pharmacy technician within the meaning of the Pharmacy Order 2010 (S.I. 2010/231) (see article 3 of that Order);

(i) a registered person within the meaning of the Pharmacy (Northern Ireland) Order 1976 (S.I. 1976/1213 (N.I. 22)) (see Article 2 of that Order);

(j) a child psychotherapist;

(k) a scientist employed by a health service body as head of a department.

(l) a person registered under the Anaesthesia Associates and Physician Associates Order 2024.

(2) In this Act, “social work professional” means any of the following—

(a) a person registered as a social worker in the register maintained by Social Work England under section 39(1) of the Children and Social Work Act 2017;

(b) a person registered as a social worker in the register maintained by Social Care Wales under section 80 of the Regulation and Inspection of Social Care (Wales) Act 2016 (anaw 2);

(c) a person registered as a social worker in the register maintained by the Scottish Social Services Council under section 44 of the Regulation of Care (Scotland) Act 2001 (asp 8);

(d) a person registered as a social worker in the register maintained by the Northern Ireland Social Care Council under section 3 of the Health and Personal Social Services Act (Northern Ireland) 2001 (c. 3 (N.I.)).

(3) In subsection (1)(a) “registered medical practitioner” includes a person who is provisionally registered under section 15 or 21 of the Medical Act 1983 and is engaged in such employment as is mentioned in subsection (3) of that section.

(4) In subsection (1)(k) “health service body” means any of the following—

(a) the Secretary of State in relation to the exercise of functions under section 2A or 2B of, or paragraph 7C, 8 or 12 of Schedule 1 to, the National Health Service Act 2006;

(b) a local authority in relation to the exercise of functions under section 2B or 111 of, or any of paragraphs 1 to 7B or 13 of Schedule 1 to, the National Health Service Act 2006;

(d) a Special Health Authority established under section 28 of the National Health Service Act 2006;

(e) an NHS foundation trust;

(f) the National Institute for Health and Care Excellence;

(g) NHS England;

(h) a National Health Service trust first established under section 5 of the National Health Service and Community Care Act 1990;

(i) a Local Health Board established under section 11 of the National Health Service (Wales) Act 2006;

(j) a National Health Service trust first established under section 18 of the National Health Service (Wales) Act 2006;

(k) a Special Health Authority established under section 22 of the National Health Service (Wales) Act 2006;

(l) a Health Board within the meaning of the National Health Service (Scotland) Act 1978;

(m) a Special Health Board within the meaning of the National Health Service (Scotland) Act 1978;

(n) a National Health Service trust first established under section 12A of the National Health Service (Scotland) Act 1978;

(o) the managers of a State Hospital provided under section 102 of the National Health Service (Scotland) Act 1978;

(p) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(q) a special health and social care agency established under the Health and Personal Social Services (Special Agencies) (Northern Ireland) Order 1990 (S.I. 1990/247 (N.I. 3));

(r) a Health and Social Care trust established under Article 10 of the Health and Personal Social Services (Northern Ireland) Order 1991 (S.I. 1991/194 (N.I. 1)).

General interpretation

205

(1) In this Act—

“biometric data” means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of an individual, which allows or confirms the unique identification of that individual, such as facial images or dactyloscopic data;

“data concerning health” means personal data relating to the physical or mental health of an individual, including the provision of health care services, which reveals information about his or her health status;

“enactment” includes—an enactment passed or made after this Act,an enactment comprised in subordinate legislation,an enactment comprised in, or in an instrument made under, a Measure or Act of the National Assembly for Wales,an enactment comprised in, or in an instrument made under, an Act of the Scottish Parliament, ...an enactment comprised in, or in an instrument made under, Northern Ireland legislation; andany assimilated direct legislation;

“genetic data” means personal data relating to the inherited or acquired genetic characteristics of an individual which gives unique information about the physiology or the health of that individual and which results, in particular, from an analysis of a biological sample from the individual in question;

“government department” includes the following (except in the expression “United Kingdom government department”)—a part of the Scottish Administration;a Northern Ireland department;the Welsh Government;a body or authority exercising statutory functions on behalf of the Crown;

“health record” means a record which—consists of data concerning health, andhas been made by or on behalf of a health professional in connection with the diagnosis, care or treatment of the individual to whom the data relates;

“inaccurate”, in relation to personal data, means incorrect or misleading as to any matter of fact;

“international obligation of the United Kingdom” includes—. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .an obligation that arises under an international agreement or arrangement to which the United Kingdom is a party;

“international organisation” means an organisation and its subordinate bodies governed by international law, or any other body which is set up by, or on the basis of, an agreement between two or more countries;

“Minister of the Crown” has the same meaning as in the Ministers of the Crown Act 1975;

“publish” means make available to the public or a section of the public (and related expressions are to be read accordingly);

“subordinate legislation” has the meaning given in the Interpretation Act 1978;

“tribunal” means any tribunal in which legal proceedings may be brought;

“the Tribunal”, in relation to an application or appeal under this Act, means—the Upper Tribunal, in any case where it is determined by or under Tribunal Procedure Rules that the Upper Tribunal is to hear the application or appeal, orthe First-tier Tribunal, in any other case.

(1A) In this Act, references to fundamental rights or fundamental freedoms (however expressed) are to the Convention rights within the meaning of the Human Rights Act 1998.

(2) References in this Act to a period expressed in hours, days, weeks, months or years are to be interpreted in accordance with Article 3 of Regulation (EEC, Euratom) No. 1182/71 of the Council of 3 June 1971 determining the rules applicable to periods, dates and time limits, except in—

(za) section 119A(10) and (11);

(a) section 125(4), (7) and (8);

(b) section 161(3), (5) and (6);

(d) section 178(2);

(e) section 182(8) ...;

(f) section 183(4);

(g) section 192(3), (5) and (6);

(h) section 197(3) and (4);

(i) paragraph 23(4) and (5) of Schedule 1;

(j) paragraphs 5(4) and 6(4) of Schedule 3;

(k) Schedule 5;

(l) paragraph 11(5) of Schedule 12;

(la) paragraph 22(6) of Schedule 12A;

(m) Schedule 15;

(and the references in section 5 to terms used in ... Part 2 do not include references to a period expressed in hours, days, weeks, months or years).

(3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(4) In the definition of “the UK GDPR” in section 3(10)—

(a) the reference to Regulation (EU) 2016/679 as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 is to be treated as a reference to that Regulation as modified by Schedule 1 to the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (“the 2019 Regulations”), but

(b) nothing in the definition or in paragraph (a) determines whether, where Regulation (EU) 2016/679 is modified on or after IP completion day by the law of England and Wales, Scotland or Northern Ireland (other than by Schedule 1 to the 2019 Regulations), the reference to Regulation (EU) 2016/679 is then to be read as a reference to that Regulation as modified.

(5) Subsection (4) is not to be read as implying anything about how other references to Regulation (EU) 2016/679 or references to other assimilated law are to be interpreted.

Index of defined expressions

206

The Table below lists provisions which define or otherwise explain terms defined for this Act, for a Part of this Act or for Chapter 2 or 3 of Part 2 of this Act.

Territorial application

Territorial application of this Act

207

(1) This Act applies only to processing of personal data described in subsections (1A) and (2).

(1A) In the case of the processing of personal data to which Part 2 (the UK GDPR) applies, it applies to the types of such processing to which the UK GDPR applies by virtue of Article 3 of the UK GDPR.

(2) In the case of the processing of personal data to which Part 2 does not apply, it applies where such processing is carried out in the context of the activities of an establishment of a controller or processor in the United Kingdom, whether or not the processing takes place in the United Kingdom.

(3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(4) Subsections (1), (1A) and (2) have effect subject to any provision in or made under section 120 providing for the Commissioner to carry out functions in relation to other processing of personal data.

(5) Section 3(14)(c) does not apply to the reference to the processing of personal data in subsection (2).

(6) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(7) In this section, references to a person who has an establishment in the United Kingdom include the following—

(a) an individual who is ordinarily resident in the United Kingdom,

(b) a body incorporated under the law of the United Kingdom or a part of the United Kingdom,

(c) a partnership or other unincorporated association formed under the law of the United Kingdom or a part of the United Kingdom, and

(d) a person not within paragraph (a), (b) or (c) who maintains, and carries on activities through, an office, branch or agency or other stable arrangements in the United Kingdom,

....

General

Children in Scotland

208

(1) Subsections (2) and (3) apply where a question falls to be determined in Scotland as to the legal capacity of a person aged under 16 to—

(a) exercise a right conferred by the data protection legislation, or

(b) give consent for the purposes of the data protection legislation.

(2) The person is to be taken to have that capacity where the person has a general understanding of what it means to exercise the right or give such consent.

(3) A person aged 12 or over is to be presumed to be of sufficient age and maturity to have such understanding, unless the contrary is shown.

Application to the Crown

209

(1) This Act binds the Crown.

(2) For the purposes of the UK GDPR and this Act, each government department is to be treated as a person separate from the other government departments (to the extent that is not already the case).

(3) Where government departments are not able to enter into contracts with each other, a provision of the UK GDPR or this Act that would require relations between them to be governed by a contract (or other binding legal act) in writing is to be treated as satisfied if the relations are the subject of a memorandum of understanding between them.

(4) Where the purposes for which and the manner in which personal data is, or is to be, processed are determined by a person acting on behalf of the Royal Household, the Duchy of Lancaster or the Duchy of Cornwall, the controller in respect of that data for the purposes of the UK GDPR and this Act is—

(a) in relation to the Royal Household, the Keeper of the Privy Purse,

(b) in relation to the Duchy of Lancaster, such person as the Chancellor of the Duchy appoints, and

(c) in relation to the Duchy of Cornwall, such person as the Duke of Cornwall, or the possessor for the time being of the Duchy of Cornwall, appoints.

(5) Different persons may be appointed under subsection (4)(b) or (c) for different purposes.

(6) As regards criminal liability—

(a) a government department is not liable to prosecution under this Act;

(b) nothing in subsection (4) makes a person who is a controller by virtue of that subsection liable to prosecution under this Act;

(c) a person in the service of the Crown is liable to prosecution under the provisions of this Act listed in subsection (7).

(7) Those provisions are—

(a) section 119;

(b) section 170;

(d) section 173;

(e) paragraph 15 of Schedule 15.

Application to Parliament

210

(1) Parts 1, 2 and 5 to 7 of this Act apply to the processing of personal data by or on behalf of either House of Parliament.

(2) Where the purposes for which and the manner in which personal data is, or is to be, processed are determined by or on behalf of the House of Commons, the controller in respect of that data for the purposes of the UK GDPR and this Act is the Corporate Officer of that House.

(3) Where the purposes for which and the manner in which personal data is, or is to be, processed are determined by or on behalf of the House of Lords, the controller in respect of that data for the purposes of the UK GDPR and this Act is the Corporate Officer of that House.

(4) Subsections (2) and (3) do not apply where the purposes for which and the manner in which the personal data is, or is to be, processed are determined by or on behalf of the Intelligence and Security Committee of Parliament.

(5) As regards criminal liability—

(a) nothing in subsection (2) or (3) makes the Corporate Officer of the House of Commons or the Corporate Officer of the House of Lords liable to prosecution under this Act;

(b) a person acting on behalf of either House of Parliament is liable to prosecution under the provisions of this Act listed in subsection (6).

(6) Those provisions are—

(a) section 170;

(b) section 171;

(d) paragraph 15 of Schedule 15.

Minor and consequential provision

211

(1) In Schedule 19—

(a) Part 1 contains minor and consequential amendments of primary legislation;

(b) Part 2 contains minor and consequential amendments of other legislation;

(d) Part 4 contains supplementary provision.

(2) The Secretary of State may by regulations make provision that is consequential on any provision made by this Act.

(3) Regulations under subsection (2)—

(a) may include transitional, transitory or saving provision;

(b) may amend, repeal or revoke an enactment.

(4) The reference to an enactment in subsection (3)(b) does not include an enactment passed or made after the end of the Session in which this Act is passed.

(5) Regulations under this section that amend, repeal or revoke primary legislation are subject to the affirmative resolution procedure.

(6) Any other regulations under this section are subject to the negative resolution procedure.

(7) In this section, “primary legislation” means—

(a) an Act;

(b) an Act of the Scottish Parliament;

(d) Northern Ireland legislation.

Final

Commencement

212

(1) Except as provided by subsections (2) and (3), this Act comes into force on such day as the Secretary of State may by regulations appoint.

(2) This section and the following provisions come into force on the day on which this Act is passed—

(a) sections 1 and 3;

(b) section 182;

(d) sections 209 and 210;

(e) sections 213(2), 214 and 215;

(f) any other provision of this Act so far as it confers power to make regulations or Tribunal Procedure Rules or is otherwise necessary for enabling the exercise of such a power on or after the day on which this Act is passed.

(3) The following provisions come into force at the end of the period of 2 months beginning when this Act is passed—

(a) section 124;

(b) sections 125, 126 and 127, so far as they relate to a code prepared under section 124;

(d) section 178 and Schedule 17;

(e) section 179.

(4) Regulations under this section may make different provision for different areas.

Transitional provision

213

(1) Schedule 20 contains transitional, transitory and saving provision.

(2) The Secretary of State may by regulations make transitional, transitory or saving provision in connection with the coming into force of any provision of this Act or with the EU GDPR beginning to apply, including provision amending or repealing a provision of Schedule 20.

(3) Regulations under this section that amend or repeal a provision of Schedule 20 are subject to the negative resolution procedure.

(4) Schedule 21 contains further transitional, transitory and saving provision made in connection with the amendment of this Act and the UK GDPR by regulations under section 8 of the European Union (Withdrawal) Act 2018.

Extent

214

(1) This Act extends to England and Wales, Scotland and Northern Ireland, subject to—

(a) subsections (2) to (5), and

(b) paragraph 12 of Schedule 12.

(2) Section 199 extends to England and Wales only.

(3) Sections 188, 189 and 190 extend to England and Wales and Northern Ireland only.

(4) An amendment, repeal or revocation made by this Act has the same extent in the United Kingdom as the enactment amended, repealed or revoked.

(5) This subsection and the following provisions also extend to the Isle of Man—

(a) paragraphs 332 and 434 of Schedule 19;

(b) sections 211(1), 212(1) and 213(2), so far as relating to those paragraphs.

(6) Where there is a power to extend a part of an Act by Order in Council to any of the Channel Islands, the Isle of Man or any of the British overseas territories, the power may be exercised in relation to an amendment or repeal of that part which is made by or under this Act.

Short title

215

This Act may be cited as the Data Protection Act 2018.

SCHEDULE 1

PART 1 — Conditions relating to employment, health and research etc

Employment, social security and social protection

1

(1) This condition is met if—

(a) the processing is necessary for the purposes of performing or exercising obligations or rights which are imposed or conferred by law on the controller or the data subject in connection with employment, social security or social protection, and

(b) when the processing is carried out, the controller has an appropriate policy document in place (see paragraph 39 in Part 4 of this Schedule).

(2) See also the additional safeguards in Part 4 of this Schedule.

(3) In this paragraph—

“social security” includes any of the branches of social security listed in Article 3(1) of Regulation (EC) No. 883/2004 of the European Parliament and of the Council on the co-ordination of social security systems (as amended from time to time);

“social protection” includes an intervention described in Article 2(b) of Regulation (EC) 458/2007 of the European Parliament and of the Council of 25 April 2007 on the European system of integrated social protection statistics (ESSPROS) as it had effect in EU law immediately before IP completion day.

Health or social care purposes

2

(1) This condition is met if the processing is necessary for health or social care purposes.

(2) In this paragraph “health or social care purposes” means the purposes of—

(a) preventive or occupational medicine,

(b) the assessment of the working capacity of an employee,

(d) the provision of health care or treatment,

(e) the provision of social care, or

(f) the management of health care systems or services or social care systems or services.

(3) See also the conditions and safeguards in Article 9(3) of the UK GDPR (obligations of secrecy) and section 11(1).

Public health

3

This condition is met if the processing—

(a) is necessary for reasons of public interest in the area of public health, and

(b) is carried out—

(i) by or under the responsibility of a health professional, or

(ii) by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law.

Research etc

4

This condition is met if the processing—

(a) is necessary for archiving purposes, scientific or historical research purposes or statistical purposes,

(b) is carried out in accordance with Article 84B of the UK GDPR, and

PART 2 — Substantial public interest conditions

Requirement for an appropriate policy document when relying on conditions in this Part

5

(1) Except as otherwise provided, a condition in this Part of this Schedule is met only if, when the processing is carried out, the controller has an appropriate policy document in place (see paragraph 39 in Part 4 of this Schedule).

(2) See also the additional safeguards in Part 4 of this Schedule.

Statutory etc and government purposes

6

(1) This condition is met if the processing—

(a) is necessary for a purpose listed in sub-paragraph (2), and

(b) is necessary for reasons of substantial public interest.

(2) Those purposes are—

(a) the exercise of a function conferred on a person by an enactment or rule of law;

(b) the exercise of a function of the Crown, a Minister of the Crown or a government department.

Administration of justice and parliamentary purposes

7

This condition is met if the processing is necessary—

(a) for the administration of justice, or

(b) for the exercise of a function of either House of Parliament.

Equality of opportunity or treatment

8

(1) This condition is met if the processing—

(a) is of a specified category of personal data, and

(b) is necessary for the purposes of identifying or keeping under review the existence or absence of equality of opportunity or treatment between groups of people specified in relation to that category with a view to enabling such equality to be promoted or maintained,

subject to the exceptions in sub-paragraphs (3) to (5).

(2) In sub-paragraph (1), “specified” means specified in the following table—

Category of personal data	Groups of people (in relation to a category of personal data)
Personal data revealing racial or ethnic origin	People of different racial or ethnic origins
Personal data revealing religious or philosophical beliefs	People holding different religious or philosophical beliefs
Data concerning health	People with different states of physical or mental health
Personal data concerning an individual's sexual orientation	People of different sexual orientation

(3) Processing does not meet the condition in sub-paragraph (1) if it is carried out for the purposes of measures or decisions with respect to a particular data subject.

(4) Processing does not meet the condition in sub-paragraph (1) if it is likely to cause substantial damage or substantial distress to an individual.

(5) Processing does not meet the condition in sub-paragraph (1) if—

(a) an individual who is the data subject (or one of the data subjects) has given notice in writing to the controller requiring the controller not to process personal data in respect of which the individual is the data subject (and has not given notice in writing withdrawing that requirement),

(b) the notice gave the controller a reasonable period in which to stop processing such data, and

Racial and ethnic diversity at senior levels of organisations

9

(1) This condition is met if the processing—

(a) is of personal data revealing racial or ethnic origin,

(b) is carried out as part of a process of identifying suitable individuals to hold senior positions in a particular organisation, a type of organisation or organisations generally,

(c) is necessary for the purposes of promoting or maintaining diversity in the racial and ethnic origins of individuals who hold senior positions in the organisation or organisations, and

(d) can reasonably be carried out without the consent of the data subject,

subject to the exception in sub-paragraph (3).

(2) For the purposes of sub-paragraph (1)(d), processing can reasonably be carried out without the consent of the data subject only where—

(a) the controller cannot reasonably be expected to obtain the consent of the data subject, and

(b) the controller is not aware of the data subject withholding consent.

(3) Processing does not meet the condition in sub-paragraph (1) if it is likely to cause substantial damage or substantial distress to an individual.

(4) For the purposes of this paragraph, an individual holds a senior position in an organisation if the individual—

(a) holds a position listed in sub-paragraph (5), or

(b) does not hold such a position but is a senior manager of the organisation.

(5) Those positions are—

(a) a director, secretary or other similar officer of a body corporate;

(b) a member of a limited liability partnership;

(c) a partner in a partnership within the Partnership Act 1890, a limited partnership registered under the Limited Partnerships Act 1907 or an entity of a similar character formed under the law of a country or territory outside the United Kingdom.

(6) In this paragraph, “senior manager”, in relation to an organisation, means a person who plays a significant role in—

(a) the making of decisions about how the whole or a substantial part of the organisation's activities are to be managed or organised, or

(b) the actual managing or organising of the whole or a substantial part of those activities.

(7) The reference in sub-paragraph (2)(b) to a data subject withholding consent does not include a data subject merely failing to respond to a request for consent.

Preventing or detecting unlawful acts

10

(1) This condition is met if the processing—

(a) is necessary for the purposes of the prevention , investigation or detection of an unlawful act,

(b) must be carried out without the consent of the data subject so as not to prejudice those purposes, and

(2) If the processing consists of the disclosure of personal data to a competent authority, or is carried out in preparation for such disclosure, the condition in sub-paragraph (1) is met even if, when the processing is carried out, the controller does not have an appropriate policy document in place (see paragraph 5 of this Schedule).

(3) In this paragraph—

“act” includes a failure to act;

“competent authority” has the same meaning as in Part 3 of this Act (see section 30).

Protecting the public against dishonesty etc

11

(1) This condition is met if the processing—

(a) is necessary for the exercise of a protective function,

(b) must be carried out without the consent of the data subject so as not to prejudice the exercise of that function, and

(2) In this paragraph, “protective function” means a function which is intended to protect members of the public against—

(a) dishonesty, malpractice or other seriously improper conduct,

(b) unfitness or incompetence,

(d) failures in services provided by a body or association.

Regulatory requirements relating to unlawful acts and dishonesty etc

12

(1) This condition is met if—

(a) the processing is necessary for the purposes of complying with, or assisting other persons to comply with, a regulatory requirement which involves a person taking steps to establish whether another person has—

(i) committed an unlawful act, or

(ii) been involved in dishonesty, malpractice or other seriously improper conduct,

(b) in the circumstances, the controller cannot reasonably be expected to obtain the consent of the data subject to the processing, and

(2) In this paragraph—

“act” includes a failure to act;

“regulatory requirement” means—a requirement imposed by legislation or by a person in exercise of a function conferred by legislation, ora requirement forming part of generally accepted principles of good practice relating to a type of body or an activity.

Journalism etc in connection with unlawful acts and dishonesty etc

13

(1) This condition is met if—

(a) the processing consists of , or is carried out in preparation for, the disclosure of personal data for the special purposes,

(b) it is carried out in connection with a matter described in sub-paragraph (2),

(d) it is carried out with a view to the publication of the personal data by any person, and

(e) the controller reasonably believes that publication of the personal data would be in the public interest.

(2) The matters mentioned in sub-paragraph (1)(b) are any of the following (whether alleged or established)—

(a) the commission of an unlawful act by a person;

(b) dishonesty, malpractice or other seriously improper conduct of a person;

(d) mismanagement in the administration of a body or association;

(e) a failure in services provided by a body or association.

(3) The condition in sub-paragraph (1) is met even if, when the processing is carried out, the controller does not have an appropriate policy document in place (see paragraph 5 of this Schedule).

(4) In this paragraph—

“act” includes a failure to act;

“the special purposes” means—the purposes of journalism;academic purposes;artistic purposes;literary purposes.

Preventing fraud

14

(1) This condition is met if the processing—

(a) is necessary for the purposes of preventing fraud or a particular kind of fraud, and

(b) consists of—

(i) the disclosure of personal data by a person as a member of an anti-fraud organisation,

(ii) the disclosure of personal data in accordance with arrangements made by an anti-fraud organisation,

(iia) the processing of personal data carried out in preparation for disclosure described in sub-paragraph (i) or (ii), or

(iii) the processing of personal data disclosed as described in sub-paragraph (i) or (ii).

(2) In this paragraph, “anti-fraud organisation” has the same meaning as in section 68 of the Serious Crime Act 2007.

Suspicion of terrorist financing or money laundering

15

This condition is met if the processing is necessary for the purposes of making a disclosure in good faith under either of the following—

(a) section 21CA of the Terrorism Act 2000 (disclosures between certain entities within regulated sector in relation to suspicion of commission of terrorist financing offence or for purposes of identifying terrorist property);

(b) section 339ZB of the Proceeds of Crime Act 2002 (disclosures within regulated sector in relation to suspicion of money laundering).

Support for individuals with a particular disability or medical condition

16

(1) This condition is met if the processing—

(a) is carried out by a not-for-profit body which provides support to individuals with a particular disability or medical condition,

(b) is of a type of personal data falling within sub-paragraph (2) which relates to an individual falling within sub-paragraph (3),

(i) raising awareness of the disability or medical condition, or

(ii) providing support to individuals falling within sub-paragraph (3) or enabling such individuals to provide support to each other,

(d) can reasonably be carried out without the consent of the data subject, and

(e) is necessary for reasons of substantial public interest.

(2) The following types of personal data fall within this sub-paragraph—

(a) personal data revealing racial or ethnic origin;

(b) genetic data or biometric data;

(d) personal data concerning an individual's sex life or sexual orientation.

(3) An individual falls within this sub-paragraph if the individual is or has been a member of the body mentioned in sub-paragraph (1)(a) and—

(a) has the disability or condition mentioned there, has had that disability or condition or has a significant risk of developing that disability or condition, or

(b) is a relative or carer of an individual who satisfies paragraph (a) of this sub-paragraph.

(4) For the purposes of sub-paragraph (1)(d), processing can reasonably be carried out without the consent of the data subject only where—

(a) the controller cannot reasonably be expected to obtain the consent of the data subject, and

(b) the controller is not aware of the data subject withholding consent.

(5) In this paragraph—

“carer” means an individual who provides or intends to provide care for another individual other than—under or by virtue of a contract, oras voluntary work;

“disability” has the same meaning as in the Equality Act 2010 (see section 6 of, and Schedule 1 to, that Act).

(6) The reference in sub-paragraph (4)(b) to a data subject withholding consent does not include a data subject merely failing to respond to a request for consent.

Counselling etc

17

(1) This condition is met if the processing—

(a) is necessary for the provision of confidential counselling, advice or support or of another similar service provided confidentially,

(b) is carried out without the consent of the data subject for one of the reasons listed in sub-paragraph (2), and

(2) The reasons mentioned in sub-paragraph (1)(b) are—

(a) in the circumstances, consent to the processing cannot be given by the data subject;

(b) in the circumstances, the controller cannot reasonably be expected to obtain the consent of the data subject to the processing;

(c) the processing must be carried out without the consent of the data subject because obtaining the consent of the data subject would prejudice the provision of the service mentioned in sub-paragraph (1)(a).

Safeguarding of children and of individuals at risk

18

(1) This condition is met if—

(a) the processing is necessary for the purposes of—

(i) protecting an individual from neglect or physical, mental or emotional harm, or

(ii) protecting the physical, mental or emotional well-being of an individual,

(b) the individual is—

(i) aged under 18, or

(ii) aged 18 or over and at risk,

(c) the processing is carried out without the consent of the data subject for one of the reasons listed in sub-paragraph (2), and

(d) the processing is necessary for reasons of substantial public interest.

(2) The reasons mentioned in sub-paragraph (1)(c) are—

(a) in the circumstances, consent to the processing cannot be given by the data subject;

(b) in the circumstances, the controller cannot reasonably be expected to obtain the consent of the data subject to the processing;

(c) the processing must be carried out without the consent of the data subject because obtaining the consent of the data subject would prejudice the provision of the protection mentioned in sub-paragraph (1)(a).

(3) For the purposes of this paragraph, an individual aged 18 or over is “at risk” if the controller has reasonable cause to suspect that the individual—

(a) has needs for care and support,

(b) is experiencing, or at risk of, neglect or physical, mental or emotional harm, and

(4) In sub-paragraph (1)(a), the reference to the protection of an individual or of the well-being of an individual includes both protection relating to a particular individual and protection relating to a type of individual.

Safeguarding of economic well-being of certain individuals

19

(1) This condition is met if the processing—

(a) is necessary for the purposes of protecting the economic well-being of an individual at economic risk who is aged 18 or over,

(b) is of data concerning health,

(d) is necessary for reasons of substantial public interest.

(2) The reasons mentioned in sub-paragraph (1)(c) are—

(a) in the circumstances, consent to the processing cannot be given by the data subject;

(b) in the circumstances, the controller cannot reasonably be expected to obtain the consent of the data subject to the processing;

(c) the processing must be carried out without the consent of the data subject because obtaining the consent of the data subject would prejudice the provision of the protection mentioned in sub-paragraph (1)(a).

(3) In this paragraph, “individual at economic risk” means an individual who is less able to protect his or her economic well-being by reason of physical or mental injury, illness or disability.

Insurance

20

(1) This condition is met if the processing—

(a) is necessary for an insurance purpose,

(b) is of personal data revealing racial or ethnic origin, religious or philosophical beliefs or trade union membership, genetic data or data concerning health, and

subject to sub-paragraphs (2) and (3).

(2) Sub-paragraph (3) applies where—

(a) the processing is not carried out for the purposes of measures or decisions with respect to the data subject, and

(b) the data subject does not have and is not expected to acquire—

(i) rights against, or obligations in relation to, a person who is an insured person under an insurance contract to which the insurance purpose mentioned in sub-paragraph (1)(a) relates, or

(ii) other rights or obligations in connection with such a contract.

(3) Where this sub-paragraph applies, the processing does not meet the condition in sub-paragraph (1) unless, in addition to meeting the requirements in that sub-paragraph, it can reasonably be carried out without the consent of the data subject.

(4) For the purposes of sub-paragraph (3), processing can reasonably be carried out without the consent of the data subject only where—

(a) the controller cannot reasonably be expected to obtain the consent of the data subject, and

(b) the controller is not aware of the data subject withholding consent.

(5) In this paragraph—

“insurance contract” means a contract of general insurance or long-term insurance;

“insurance purpose” means—advising on, arranging, underwriting or administering an insurance contract,administering a claim under an insurance contract, orexercising a right, or complying with an obligation, arising in connection with an insurance contract, including a right or obligation arising under an enactment or rule of law.

(6) The reference in sub-paragraph (4)(b) to a data subject withholding consent does not include a data subject merely failing to respond to a request for consent.

(7) Terms used in the definition of “insurance contract” in sub-paragraph (5) and also in an order made under section 22 of the Financial Services and Markets Act 2000 (regulated activities) have the same meaning in that definition as they have in that order.

Occupational pensions

21

(1) This condition is met if the processing—

(a) is necessary for the purpose of making a determination in connection with eligibility for, or benefits payable under, an occupational pension scheme,

(b) is of data concerning health which relates to a data subject who is the parent, grandparent, great-grandparent or sibling of a member of the scheme,

(d) can reasonably be carried out without the consent of the data subject.

(2) For the purposes of sub-paragraph (1)(d), processing can reasonably be carried out without the consent of the data subject only where—

(a) the controller cannot reasonably be expected to obtain the consent of the data subject, and

(b) the controller is not aware of the data subject withholding consent.

(3) In this paragraph—

“occupational pension scheme” has the meaning given in section 1 of the Pension Schemes Act 1993;

“member”, in relation to a scheme, includes an individual who is seeking to become a member of the scheme.

(4) The reference in sub-paragraph (2)(b) to a data subject withholding consent does not include a data subject merely failing to respond to a request for consent.

Political parties

22

(1) This condition is met if the processing—

(a) is of personal data revealing political opinions,

(b) is carried out by a person or organisation included in the register maintained under section 23 of the Political Parties, Elections and Referendums Act 2000, and

subject to the exceptions in sub-paragraphs (2) and (3).

(2) Processing does not meet the condition in sub-paragraph (1) if it is likely to cause substantial damage or substantial distress to a person.

(3) Processing does not meet the condition in sub-paragraph (1) if—

(a) an individual who is the data subject (or one of the data subjects) has given notice in writing to the controller requiring the controller not to process personal data in respect of which the individual is the data subject (and has not given notice in writing withdrawing that requirement),

(b) the notice gave the controller a reasonable period in which to stop processing such data, and

(4) In this paragraph, “political activities” include campaigning, fund-raising, political surveys and case-work.

Elected representatives responding to requests

23

(1) This condition is met if—

(a) the processing is carried out—

(i) by an elected representative or a person acting with the authority of such a representative,

(ii) in connection with the discharge of the elected representative's functions, and

(iii) in response to a request by an individual that the elected representative take action on behalf of the individual, and

(b) the processing is necessary for the purposes of, or in connection with, the action reasonably taken by the elected representative in response to that request,

subject to sub-paragraph (2).

(2) Where the request is made by an individual other than the data subject, the condition in sub-paragraph (1) is met only if the processing must be carried out without the consent of the data subject for one of the following reasons—

(a) in the circumstances, consent to the processing cannot be given by the data subject;

(b) in the circumstances, the elected representative cannot reasonably be expected to obtain the consent of the data subject to the processing;

(d) the processing is necessary in the interests of another individual and the data subject has withheld consent unreasonably.

(3) In this paragraph, “elected representative” means—

(a) a member of the House of Commons;

(b) a member of the National Assembly for Wales;

(d) a member of the Northern Ireland Assembly;

(e) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(f) an elected member of a local authority within the meaning of section 270(1) of the Local Government Act 1972, namely—

(i) in England, a county council, a district council, a London borough council or a parish council;

(ii) in Wales, a county council, a county borough council or a community council;

(g) an elected mayor of a local authority within the meaning of Part 1A or 2 of the Local Government Act 2000;

(h) a mayor for the area of a combined authority established under section 103 of the Local Democracy, Economic Development and Construction Act 2009;

(ha) a mayor for the area of a combined county authority established under section 9(1) of the Levelling-up and Regeneration Act 2023;

(i) the Mayor of London or an elected member of the London Assembly;

(j) an elected member of—

(i) the Common Council of the City of London, or

(ii) the Council of the Isles of Scilly;

(k) an elected member of a council constituted under section 2 of the Local Government etc (Scotland) Act 1994;

(l) an elected member of a district council within the meaning of the Local Government Act (Northern Ireland) 1972 (c. 9 (N.I.));

(m) a police and crime commissioner.

(4) For the purposes of sub-paragraph (3), a person who is—

(a) a member of the House of Commons immediately before Parliament is dissolved,

(b) a member of the National Assembly for Wales immediately before that Assembly is dissolved,

(d) a member of the Northern Ireland Assembly immediately before that Assembly is dissolved,

is to be treated as if the person were such a member until the end of the period of 30 days beginning with the day after the day on which the subsequent general election in relation to that Parliament or Assembly is held.

(5) For the purposes of sub-paragraph (3), a person who is an elected member of the Common Council of the City of London and whose term of office comes to an end at the end of the day preceding the annual Wardmotes is to be treated as if he or she were such a member until the end of the fourth day after the day on which those Wardmotes are held.

Disclosure to elected representatives

24

(1) This condition is met if—

(a) the processing consists of , or is carried out in preparation for, the disclosure of personal data—

(i) to an elected representative or a person acting with the authority of such a representative, and

(ii) in response to a communication to the controller from that representative or person which was made in response to a request from an individual,

(b) the personal data is relevant to the subject matter of that communication, and

subject to sub-paragraph (2).

(2) Where the request to the elected representative came from an individual other than the data subject, the condition in sub-paragraph (1) is met only if the disclosure must be made without the consent of the data subject for one of the following reasons—

(a) in the circumstances, consent to the processing cannot be given by the data subject;

(b) in the circumstances, the elected representative cannot reasonably be expected to obtain the consent of the data subject to the processing;

(d) the processing is necessary in the interests of another individual and the data subject has withheld consent unreasonably.

(3) In this paragraph, “elected representative” has the same meaning as in paragraph 23.

Informing elected representatives about prisoners

25

(1) This condition is met if—

(a) the processing consists of the processing of personal data about a prisoner for the purpose of informing a member of the House of Commons, a member of the National Assembly for Wales or a member of the Scottish Parliament about the prisoner, and

(b) the member is under an obligation not to further disclose the personal data.

(2) The references in sub-paragraph (1) to personal data about, and to informing someone about, a prisoner include personal data about, and informing someone about, arrangements for the prisoner's release.

(3) In this paragraph—

“prison” includes a young offender institution, a remand centre, a secure training centre or a secure college;

“prisoner” means a person detained in a prison.

Publication of legal judgments

26

This condition is met if the processing—

(a) consists of the publication of a judgment or other decision of a court or tribunal, or

(b) is necessary for the purposes of publishing such a judgment or decision.

Anti-doping in sport

27

(1) This condition is met if the processing is necessary—

(a) for the purposes of measures designed to eliminate doping which are undertaken by or under the responsibility of a body or association that is responsible for eliminating doping in a sport, at a sporting event or in sport generally, or

(b) for the purposes of providing information about doping, or suspected doping, to such a body or association.

(2) The reference in sub-paragraph (1)(a) to measures designed to eliminate doping includes measures designed to identify or prevent doping.

(3) If the processing consists of the disclosure of personal data to a body or association described in sub-paragraph (1)(a), or is carried out in preparation for such disclosure, the condition in sub-paragraph (1) is met even if, when the processing is carried out, the controller does not have an appropriate policy document in place (see paragraph 5 of this Schedule).

Standards of behaviour in sport

28

(1) This condition is met if the processing—

(a) is necessary for the purposes of measures designed to protect the integrity of a sport or a sporting event,

(b) must be carried out without the consent of the data subject so as not to prejudice those purposes, and

(2) In sub-paragraph (1)(a), the reference to measures designed to protect the integrity of a sport or a sporting event is a reference to measures designed to protect a sport or a sporting event against—

(a) dishonesty, malpractice or other seriously improper conduct, or

(b) failure by a person participating in the sport or event in any capacity to comply with standards of behaviour set by a body or association with responsibility for the sport or event.

PART 3 — Additional conditions relating to criminal convictions etc

Consent

29

This condition is met if the data subject has given consent to the processing.

Protecting individual’s vital interests

30

This condition is met if—

(a) the processing is necessary to protect the vital interests of an individual, and

(b) the data subject is physically or legally incapable of giving consent.

Processing by not-for-profit bodies

31

This condition is met if the processing is carried out—

(a) in the course of its legitimate activities with appropriate safeguards by a foundation, association or other not-for-profit body with a political, philosophical, religious or trade union aim, and

(b) on condition that—

(i) the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes, and

(ii) the personal data is not disclosed outside that body without the consent of the data subjects.

Personal data in the public domain

32

This condition is met if the processing relates to personal data which is manifestly made public by the data subject.

Legal claims

33

This condition is met if the processing—

(a) is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings),

(b) is necessary for the purpose of obtaining legal advice, or

Judicial acts

34

This condition is met if the processing is necessary when a court or tribunal is acting in its judicial capacity.

Administration of accounts used in commission of indecency offences involving children

35

(1) This condition is met if—

(a) the processing is of personal data about a conviction or caution for an offence listed in sub-paragraph (2),

(b) the processing is necessary for the purpose of administering an account relating to the payment card used in the commission of the offence or cancelling that payment card, and

(c) when the processing is carried out, the controller has an appropriate policy document in place (see paragraph 39 in Part 4 of this Schedule).

(2) Those offences are an offence under—

(a) section 1 of the Protection of Children Act 1978 (indecent photographs of children),

(b) Article 3 of the Protection of Children (Northern Ireland) Order 1978 (S.I. 1978/1047 (N.I. 17)) (indecent photographs of children),

(d) section 160 of the Criminal Justice Act 1988 (possession of indecent photograph of child),

(e) Article 15 of the Criminal Justice (Evidence etc) (Northern Ireland) Order 1988 (S.I. 1988/1847 (N.I. 17)) (possession of indecent photograph of child), or

(f) section 62 of the Coroners and Justice Act 2009 (possession of prohibited images of children),

or incitement to commit an offence under any of those provisions.

(3) See also the additional safeguards in Part 4 of this Schedule.

(4) In this paragraph—

“caution” means a caution given to a person in England and Wales or Northern Ireland in respect of an offence which, at the time when the caution is given, is admitted;

“conviction” has the same meaning as in the Rehabilitation of Offenders Act 1974 or the Rehabilitation of Offenders (Northern Ireland) Order 1978 (S.I. 1978/1908 (N.I. 27));

“payment card” includes a credit card, a charge card and a debit card.

Extension of conditions in Part 2 of this Schedule referring to substantial public interest

36

This condition is met if the processing would meet a condition in Part 2 of this Schedule but for an express requirement for the processing to be necessary for reasons of substantial public interest.

Extension of insurance conditions

37

This condition is met if the processing—

(a) would meet the condition in paragraph 20 in Part 2 of this Schedule (the “insurance condition”), or

(b) would meet the condition in paragraph 36 by virtue of the insurance condition,

but for the requirement for the processing to be processing of a category of personal data specified in paragraph 20(1)(b).

PART 4 — Appropriate policy document and additional safeguards

Application of this Part of this Schedule

38

This Part of this Schedule makes provision about the processing of personal data carried out in reliance on a condition in Part 1, 2 or 3 of this Schedule which requires the controller to have an appropriate policy document in place when the processing is carried out.

Requirement to have an appropriate policy document in place

39

The controller has an appropriate policy document in place in relation to the processing of personal data in reliance on a condition described in paragraph 38 if the controller has produced a document which—

(a) explains the controller's procedures for securing compliance with the principles in Article 5 of the UK GDPR (principles relating to processing of personal data) in connection with the processing of personal data in reliance on the condition in question, and

(b) explains the controller's policies as regards the retention and erasure of personal data processed in reliance on the condition, giving an indication of how long such personal data is likely to be retained.

Additional safeguard: retention of appropriate policy document

40

(1) Where personal data is processed in reliance on a condition described in paragraph 38, the controller must during the relevant period—

(a) retain the appropriate policy document,

(b) review and (if appropriate) update it from time to time, and

(2) “Relevant period”, in relation to the processing of personal data in reliance on a condition described in paragraph 38, means a period which—

(a) begins when the controller starts to carry out processing of personal data in reliance on that condition, and

(b) ends at the end of the period of 6 months beginning when the controller ceases to carry out such processing.

Additional safeguard: record of processing

41

A record maintained by the controller, or the controller's representative, under Article 30 of the UK GDPR in respect of the processing of personal data in reliance on a condition described in paragraph 38 must include the following information—

(a) which condition is relied on,

(b) how the processing satisfies Article 6 of the UK GDPR (lawfulness of processing), and

(c) whether the personal data is retained and erased in accordance with the policies described in paragraph 39(b) and, if it is not, the reasons for not following those policies.

SCHEDULE 2

PART 1 — Adaptations and restrictions as described in Articles 6(3) and 23(1)

GDPR provisions to be adapted or restricted: “the listed GDPR provisions”

1

In this Part of this Schedule, “the listed GDPR provisions” means—

(a) the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR)—

(i) Article 13(1) to (3) (personal data collected from data subject: information to be provided);

(ii) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);

(iii) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);

(iv) Article 16 (right to rectification);

(v) Article 17(1) and (2) (right to erasure);

(vi) Article 18(1) (restriction of processing);

(vii) Article 19 (notification obligation regarding rectification or erasure of personal data or restriction of processing);

(viii) Article 20(1) and (2) (right to data portability);

(ix) Article 21(1) (objections to processing);

(x) Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (i) to (ix); and

(b) the following provisions of the UK GDPR (the application of which may be adapted by virtue of Article 6(3) of the UK GDPR)—

(i) Article 5(1)(a) (lawful, fair and transparent processing), other than the lawfulness requirements set out in Article 6;

(ii) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Crime and taxation: general

2

(1) The listed GDPR provisions and Article 34(1) and (4) of the UK GDPR (communication of personal data breach to the data subject) do not apply to personal data processed for any of the following purposes—

(a) the prevention , investigation or detection of crime,

(b) the apprehension or prosecution of offenders, or

to the extent that the application of those provisions would be likely to prejudice any of the matters mentioned in paragraphs (a) to (c).

(2) Sub-paragraph (3) applies where—

(a) personal data is processed by a person (“Controller 1”) for any of the purposes mentioned in sub-paragraph (1)(a) to (c), and

(b) another person (“Controller 2”) obtains the data from Controller 1 for the purpose of discharging statutory functions and processes it for the purpose of discharging statutory functions.

(3) Controller 2 is exempt from the obligations in the following provisions of the UK GDPR—

(a) Article 13(1) to (3) (personal data collected from data subject: information to be provided),

(b) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided),

(d) Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in paragraphs (a) to (c),

to the same extent that Controller 1 is exempt from those obligations by virtue of sub-paragraph (1).

Crime and taxation: risk assessment systems

3

(1) The UK GDPR provisions listed in sub-paragraph (3) do not apply to personal data which consists of a classification applied to the data subject as part of a risk assessment system falling within sub-paragraph (2) to the extent that the application of those provisions would prevent the system from operating effectively.

(2) A risk assessment system falls within this sub-paragraph if—

(a) it is operated by a government department, a local authority or another authority administering housing benefit, and

(b) it is operated for the purposes of—

(i) the assessment or collection of a tax or duty or an imposition of a similar nature, or

(ii) the prevention , investigation or detection of crime or apprehension or prosecution of offenders, where the offence concerned involves the unlawful use of public money or an unlawful claim for payment out of public money.

(3) The UK GDPR provisions referred to in sub-paragraph (1) are the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR)—

(a) Article 13(1) to (3) (personal data collected from data subject: information to be provided);

(b) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);

(d) Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in paragraphs (a) to (c).

Immigration

4

(1) The relevant UK GDPR provisions do not apply to personal data processed by the Secretary of State for any of the following purposes—

(a) the maintenance of effective immigration control, or

(b) the investigation or detection of activities that would undermine the maintenance of effective immigration control,

to the extent that the application of those provisions would be likely to prejudice any of the matters mentioned in paragraphs (a) and (b).

(1A) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(1B) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(1C) Paragraphs 4A and 4B make provision about ... safeguards in connection with the exemption in sub-paragraph (1).

(2) In sub-paragraph (1) and paragraph 4A, the “relevant UK GDPR provisions” are the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR)—

(a) Article 13(1) to (3) (personal data collected from data subject: information to be provided);

(b) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);

(d) Article 17(1) and (2) (right to erasure);

(e) Article 18(1) (restriction of processing);

(f) Article 21(1) (objections to processing);

(g) Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (a) to (f).

(That is, the listed GDPR provisions other than Article 16 (right to rectification), Article 19 (notification obligation regarding rectification or erasure of personal data or restriction of processing) and Article 20(1) and (2) (right to data portability) and, subject to sub-paragraph (2)(g) of this paragraph, the provisions of Article 5 listed in paragraph 1(b).)

(3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(4) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Information required to be disclosed by law etc or in connection with legal proceedings

5

(1) The listed GDPR provisions do not apply to personal data consisting of information that the controller is obliged by an enactment to make available to the public, to the extent that the application of those provisions would prevent the controller from complying with that obligation.

(2) The listed GDPR provisions do not apply to personal data where disclosure of the data is required by an enactment, a rule of law or an order of a court or tribunal, to the extent that the application of those provisions would prevent the controller from making the disclosure.

(3) The listed GDPR provisions do not apply to personal data where disclosure of the data—

(a) is necessary for the purpose of, or in connection with, legal proceedings (including prospective legal proceedings),

(b) is necessary for the purpose of obtaining legal advice, or

to the extent that the application of those provisions would prevent the controller from making the disclosure.

PART 2 — Restrictions as described in Article 23(1): restrictions of rules in Articles 13 to 21 and 34

GDPR provisions to be restricted: “the listed GDPR provisions”

6

In this Part of this Schedule, “the listed GDPR provisions” means the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR)—

(a) Article 13(1) to (3) (personal data collected from data subject: information to be provided);

(b) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);

(d) Article 16 (right to rectification);

(e) Article 17(1) and (2) (right to erasure);

(f) Article 18(1) (restriction of processing);

(g) Article 19 (notification obligation regarding rectification or erasure of personal data or restriction of processing);

(h) Article 20(1) and (2) (right to data portability);

(i) Article 21(1) (objections to processing);

(j) Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (a) to (i).

Functions designed to protect the public etc

7

The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a function that—

(a) is designed as described in column 1 of the Table, and

(b) meets the condition relating to the function specified in column 2 of the Table,

to the extent that the application of those provisions would be likely to prejudice the proper discharge of the function.

Audit functions

8

(1) The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a function listed in sub-paragraph (2) to the extent that the application of those provisions would be likely to prejudice the proper discharge of the function.

(2) The functions are any function that is conferred by an enactment on—

(a) the Comptroller and Auditor General;

(b) the Auditor General for Scotland;

(d) the Comptroller and Auditor General for Northern Ireland.

Functions of the Bank of England

9

(1) The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a relevant function of the Bank of England to the extent that the application of those provisions would be likely to prejudice the proper discharge of the function.

(2) “Relevant function of the Bank of England” means—

(a) a function discharged by the Bank acting in its capacity as a monetary authority (as defined in section 244(2)(c) and (2A) of the Banking Act 2009);

(b) a public function of the Bank within the meaning of section 349 of the Financial Services and Markets Act 2000;

(c) a function conferred on the Prudential Regulation Authority by or under the Financial Services and Markets Act 2000 or by another enactment.

Regulatory functions relating to legal services, the health service and children’s services

10

(1) The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a function listed in sub-paragraph (2) to the extent that the application of those provisions would be likely to prejudice the proper discharge of the function.

(2) The functions are—

(a) a function of the Legal Services Board;

(b) the function of considering a complaint under the scheme established under Part 6 of the Legal Services Act 2007 (legal complaints);

(i) section 14 of the NHS Redress Act 2006,

(ii) section 113(1) or (2) or section 114(1) or (3) of the Health and Social Care (Community Health and Standards) Act 2003,

(iii) section 24D or 26 of the Children Act 1989, or

(iv) Part 2A of the Public Services Ombudsman (Wales) Act 2005 or Part 5 of the Public Services Ombudsman (Wales) Act 2019;

(d) the function of considering a complaint or representations under Chapter 1 of Part 10 of the Social Services and Well-being (Wales) Act 2014 (anaw 4).

Regulatory functions of certain other persons

11

The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a function that—

(a) is a function of a person described in column 1 of the Table, and

(b) is conferred on that person as described in column 2 of the Table,

to the extent that the application of those provisions would be likely to prejudice the proper discharge of the function.

12

In the Table in paragraph 11—

the “Financial Ombudsman” means the scheme operator within the meaning of Part 16 of the Financial Services and Markets Act 2000 (see section 225 of that Act);

the “investigator of complaints against the financial regulators” means the person appointed under section 84(1)(b) of the Financial Services Act 2012;

“relevant authority” has the same meaning as in section 5 of the Local Government and Housing Act 1989, and “monitoring officer”, in relation to such an authority, means a person designated as such under that section;

“relevant Welsh authority” has the same meaning as “relevant authority” in section 49(6) of the Local Government Act 2000, and “monitoring officer”, in relation to such an authority, has the same meaning as in Part 3 of that Act.

Parliamentary privilege

13

The listed GDPR provisions and Article 34(1) and (4) of the UK GDPR (communication of personal data breach to the data subject) do not apply to personal data where this is required for the purpose of avoiding an infringement of the privileges of either House of Parliament.

Judicial appointments, judicial independence and judicial proceedings

14

(1) The listed GDPR provisions do not apply to personal data processed for the purposes of assessing a person's suitability for judicial office or the office of Queen's Counsel.

(2) The listed GDPR provisions do not apply to personal data processed by—

(a) an individual acting in a judicial capacity, or

(b) a court or tribunal acting in its judicial capacity.

(3) As regards personal data not falling within sub-paragraph (1) or (2), the listed GDPR provisions do not apply to the extent that the application of those provisions would be likely to prejudice judicial independence or judicial proceedings.

Crown honours, dignities and appointments

15

(1) The listed GDPR provisions do not apply to personal data processed for the purposes of the conferring by the Crown of any honour or dignity.

(2) The listed GDPR provisions do not apply to personal data processed for the purposes of assessing a person's suitability for any of the following offices—

(a) archbishops and diocesan and suffragan bishops in the Church of England;

(b) deans of cathedrals of the Church of England;

(d) the First and Second Church Estates Commissioners;

(e) lord-lieutenants;

(f) Masters of Trinity College and Churchill College, Cambridge;

(g) the Provost of Eton;

(h) the Poet Laureate;

(i) the Astronomer Royal.

(3) The Secretary of State may by regulations amend the list in sub-paragraph (2) to—

(a) remove an office, or

(b) add an office to which appointments are made by Her Majesty.

(4) Regulations under sub-paragraph (3) are subject to the affirmative resolution procedure.

PART 3 — Restriction for the protection of rights of others

Protection of the rights of others: general

16

(1) Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers), and Article 5 of the UK GDPR so far as its provisions correspond to the rights and obligations provided for in Article 15(1) to (3), do not oblige a controller to disclose information to the data subject to the extent that doing so would involve disclosing information relating to another individual who can be identified from the information.

(2) Sub-paragraph (1) does not remove the controller's obligation where—

(a) the other individual has consented to the disclosure of the information to the data subject, or

(b) it is reasonable to disclose the information to the data subject without the consent of the other individual.

(3) In determining whether it is reasonable to disclose the information without consent, the controller must have regard to all the relevant circumstances, including—

(a) the type of information that would be disclosed,

(b) any duty of confidentiality owed to the other individual,

(d) whether the other individual is capable of giving consent, and

(e) any express refusal of consent by the other individual.

(4) For the purposes of this paragraph—

(a) “information relating to another individual” includes information identifying the other individual as the source of information;

(b) an individual can be identified from information to be provided to a data subject by a controller if the individual can be identified from—

(i) that information, or

(ii) that information and any other information that the controller reasonably believes the data subject is likely to possess or obtain.

Assumption of reasonableness for health workers, social workers and education workers

17

(1) For the purposes of paragraph 16(2)(b), it is to be considered reasonable for a controller to disclose information to a data subject without the consent of the other individual where—

(a) the health data test is met,

(b) the social work data test is met, or

(2) The health data test is met if—

(a) the information in question is contained in a health record, and

(b) the other individual is a health professional who has compiled or contributed to the health record or who, in his or her capacity as a health professional, has been involved in the diagnosis, care or treatment of the data subject.

(3) The social work data test is met if—

(a) the other individual is—

(i) a children's court officer,

(ii) a person who is or has been employed by a person or body referred to in paragraph 8 of Schedule 3 in connection with functions exercised in relation to the information, or

(iii) a person who has provided for reward a service that is similar to a service provided in the exercise of any relevant social services functions, and

(b) the information relates to the other individual in an official capacity or the other individual supplied the information—

(i) in an official capacity, or

(ii) in a case within paragraph (a)(iii), in connection with providing the service mentioned in paragraph (a)(iii).

(4) The education data test is met if—

(a) the other individual is an education-related worker, or

(b) the other individual is employed by an education authority (within the meaning of the Education (Scotland) Act 1980) in pursuance of its functions relating to education and—

(i) the information relates to the other individual in his or her capacity as such an employee, or

(ii) the other individual supplied the information in his or her capacity as such an employee.

(5) In this paragraph—

“children's court officer” means a person referred to in paragraph 8(1)(q), (r), (s), (t) or (u) of Schedule 3;

“education-related worker” means a person referred to in paragraph 14(4)(a) or (b) or 16(4)(a), (b) or (c) of Schedule 3 (educational records);

“relevant social services functions” means functions specified in paragraph 8(1)(a), (b), (c) or (d) of Schedule 3.

PART 4 — Restrictions as described in Article 23(1): restrictions of rules in Articles 13 to 15

GDPR provisions to be restricted: “the listed GDPR provisions”

18

(a) Article 13(1) to (3) (personal data collected from data subject: information to be provided);

(b) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);

(d) Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (a) to (c).

Legal professional privilege

19

The listed GDPR provisions do not apply to personal data that consists of—

(a) information in respect of which a claim to legal professional privilege or, in Scotland, confidentiality of communications, could be maintained in legal proceedings, or

(b) information in respect of which a duty of confidentiality is owed by a professional legal adviser to a client of the adviser.

Self incrimination

20

(1) A person need not comply with the listed GDPR provisions to the extent that compliance would, by revealing evidence of the commission of an offence, expose the person to proceedings for that offence.

(2) The reference to an offence in sub-paragraph (1) does not include an offence under—

(a) this Act,

(b) section 5 of the Perjury Act 1911 (false statements made otherwise than on oath),

(c) section 44(2) of the Criminal Law (Consolidation) (Scotland) Act 1995 (false statements made otherwise than on oath), or

(d) Article 10 of the Perjury (Northern Ireland) Order 1979 (S.I. 1979/1714 (N.I. 19)) (false statutory declarations and other false unsworn statements).

(3) Information disclosed by any person in compliance with Article 15 of the UK GDPR is not admissible against the person in proceedings for an offence under this Act.

Corporate finance

21

(1) The listed GDPR provisions do not apply to personal data processed for the purposes of or in connection with a corporate finance service provided by a relevant person to the extent that either Condition A or Condition B is met.

(2) Condition A is that the application of the listed GDPR provisions would be likely to affect the price of an instrument.

(3) Condition B is that—

(a) the relevant person reasonably believes that the application of the listed GDPR provisions to the personal data in question could affect a decision of a person—

(i) whether to deal in, subscribe for or issue an instrument, or

(ii) whether to act in a way likely to have an effect on a business activity (such as an effect on the industrial strategy of a person, the capital structure of an undertaking or the legal or beneficial ownership of a business or asset), and

(b) the application of the listed GDPR provisions to that personal data would have a prejudicial effect on the orderly functioning of financial markets or the efficient allocation of capital within the economy.

(4) In this paragraph—

“corporate finance service” means a service consisting in—underwriting in respect of issues of, or the placing of issues of, any instrument,services relating to such underwriting, oradvice to undertakings on capital structure, industrial strategy and related matters and advice and service relating to mergers and the purchase of undertakings;

“instrument” means an instrument listed in section C of Annex 1 to Directive 2004/39/EC of the European Parliament and of the Council of 21 April 2004 on markets in financial instruments, and references to an instrument include an instrument not yet in existence but which is to be or may be created;

“price” includes value;

“relevant person” means—a person who, by reason of a permission under Part 4A of the Financial Services and Markets Act 2000, is able to carry on a corporate finance service without contravening the general prohibition;an EEA firm of the kind mentioned in paragraph 5(a) or (b) of Schedule 3 to that Act which has qualified for authorisation under paragraph 12 of that Schedule, and may lawfully carry on a corporate finance service;a person who is exempt from the general prohibition in respect of any corporate finance service—as a result of an exemption order made under section 38(1) of that Act, orby reason of section 39(1) of that Act (appointed representatives);a person, not falling within paragraph (a), (b) or (c), who may lawfully carry on a corporate finance service without contravening the general prohibition;a person who, in the course of employment, provides to their employer a service falling within paragraph (b) or (c) of the definition of “corporate finance service”;a partner who provides to other partners in the partnership a service falling within either of those paragraphs.

(5) In the definition of “relevant person” in sub-paragraph (4), references to “the general prohibition” are to the general prohibition within the meaning of section 19 of the Financial Services and Markets Act 2000.

Management forecasts

22

The listed GDPR provisions do not apply to personal data processed for the purposes of management forecasting or management planning in relation to a business or other activity to the extent that the application of those provisions would be likely to prejudice the conduct of the business or activity concerned.

Negotiations

23

The listed GDPR provisions do not apply to personal data that consists of records of the intentions of the controller in relation to any negotiations with the data subject to the extent that the application of those provisions would be likely to prejudice those negotiations.

Confidential references

24

The listed GDPR provisions do not apply to personal data consisting of a reference given (or to be given) in confidence for the purposes of—

(a) the education, training or employment (or prospective education, training or employment) of the data subject,

(b) the placement (or prospective placement) of the data subject as a volunteer,

(d) the provision (or prospective provision) by the data subject of any service.

Exam scripts and exam marks

25

(1) The listed GDPR provisions do not apply to personal data consisting of information recorded by candidates during an exam.

(2) Where personal data consists of marks or other information processed by a controller—

(a) for the purposes of determining the results of an exam, or

(b) in consequence of the determination of the results of an exam,

the duty in Article 12(3) or (4) of the UK GDPR for the controller to provide information requested by the data subject within a certain time period, as it applies to Article 15 of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers), is modified as set out in sub-paragraph (3).

(3) Where a question arises as to whether the controller is obliged by Article 15 of the UK GDPR to disclose personal data, and the question arises before the day on which the exam results are announced, the controller must provide the information mentioned in Article 12(3) or (4)—

(a) before the end of the period of 5 months beginning when the question arises, or

(b) if earlier, before the end of the period of 40 days beginning with the announcement of the results.

(4) In this paragraph, “exam” means an academic, professional or other examination used for determining the knowledge, intelligence, skill or ability of a candidate and may include an exam consisting of an assessment of the candidate's performance while undertaking work or any other activity.

(5) For the purposes of this paragraph, the results of an exam are treated as announced when they are first published or, if not published, first communicated to the candidate.

PART 5 — Exemptions etc ... for reasons of freedom of expression and information

Journalistic, academic, artistic and literary purposes

26

(1) In this paragraph, “the special purposes” means one or more of the following—

(a) the purposes of journalism;

(b) academic purposes;

(d) literary purposes.

(2) Sub-paragraph (3) applies to the processing of personal data carried out for the special purposes if—

(a) the processing is being carried out with a view to the publication by a person of journalistic, academic, artistic or literary material, and

(b) the controller reasonably believes that the publication of the material would be in the public interest.

(3) The listed GDPR provisions do not apply to the extent that the controller reasonably believes that the application of those provisions would be incompatible with the special purposes.

(4) In determining whether publication would be in the public interest the controller must take into account the special importance of the public interest in the freedom of expression and information.

(5) In determining whether it is reasonable to believe that publication would be in the public interest, the controller must have regard to any of the codes of practice or guidelines listed in sub-paragraph (6) that is relevant to the publication in question.

(6) The codes of practice and guidelines are—

(a) BBC Editorial Guidelines;

(b) Ofcom Broadcasting Code;

(7) The Secretary of State may by regulations amend the list in sub-paragraph (6).

(8) Regulations under sub-paragraph (7) are subject to the affirmative resolution procedure.

(9) For the purposes of this paragraph, the listed GDPR provisions are the following provisions of the UK GDPR (which may be exempted or derogated from by virtue of Article 85(2) of the UK GDPR)—

(a) in Chapter II of the UK GDPR (principles)—

(i) Article 5(1)(a) to (e) (principles relating to processing);

(ii) Article 6 (lawfulness);

(iii) Article 7 (conditions for consent);

(iv) Article 8(1) and (2) (child's consent);

(v) Article 9 (processing of special categories of data);

(vi) Article 10 (data relating to criminal convictions etc);

(vii) Article 11(2) (processing not requiring identification);

(b) in Chapter III of the UK GDPR (rights of the data subject)—

(i) Article 13(1) to (3) (personal data collected from data subject: information to be provided);

(ii) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);

(iii) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);

(iv) Article 16 (right to rectification);

(v) Article 17(1) and (2) (right to erasure);

(vi) Article 18(1)(a), (b) and (d) (restriction of processing);

(vii) Article 19 (notification obligation regarding rectification or erasure of personal data or restriction of processing);

(viii) Article 20(1) and (2) (right to data portability);

(ix) Article 21(1) (objections to processing);

(i) Article 34(1) and (4) (communication of personal data breach to the data subject);

(ii) Article 36 (requirement for controller to consult Commissioner prior to high risk processing);

(d) in Chapter V of the UK GDPR (transfers of data to third countries etc), Article 44A (general principles for transfers);

(e) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

PART 6 — Derogations etc ... for research, statistics and archiving

Research and statistics

27

(1) The listed GDPR provisions do not apply to personal data processed for—

(a) scientific or historical research purposes, or

(b) statistical purposes,

to the extent that the application of those provisions would prevent or seriously impair the achievement of the purposes in question.

This is subject to sub-paragraphs (3) and (4).

(2) For the purposes of this paragraph, the listed GDPR provisions are the following provisions of the UK GDPR—

(a) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);

(b) Article 16 (right to rectification);

(d) Article 21(1) (objections to processing).

(3) The exemption in sub-paragraph (1) is available only where—

(a) the personal data is processed in accordance with Article 84B of the UK GDPR, and

(b) as regards the disapplication of Article 15(1) to (3), the results of the research or any resulting statistics are not made available in a form which identifies a data subject.

(4) Where processing for a purpose described in sub-paragraph (1) serves at the same time another purpose, the exemption in sub-paragraph (1) is available only where the personal data is processed for a purpose referred to in that sub-paragraph.

Archiving in the public interest

28

(1) The listed GDPR provisions do not apply to personal data processed for archiving purposes in the public interest to the extent that the application of those provisions would prevent or seriously impair the achievement of those purposes.

This is subject to sub-paragraphs (3) and (4).

(2) For the purposes of this paragraph, the listed GDPR provisions are the following provisions of the UK GDPR—

(a) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);

(b) Article 16 (right to rectification);

(d) Article 19 (notification obligation regarding rectification or erasure of personal data or restriction of processing);

(e) Article 20(1) (right to data portability);

(f) Article 21(1) (objections to processing).

(3) The exemption in sub-paragraph (1) is available only where the personal data is processed in accordance with Article 84B of the UK GDPR.

(4) Where processing for a purpose described in sub-paragraph (1) serves at the same time another purpose, the exemption in sub-paragraph (1) is available only where the personal data is processed for a purpose referred to in that sub-paragraph.

SCHEDULE 3

PART 1 — UK GDPR provisions to be restricted

1

In this Schedule “the listed GDPR provisions” means the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR)—

(a) Article 13(1) to (3) (personal data collected from data subject: information to be provided);

(b) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);

(d) Article 16 (right to rectification);

(e) Article 17(1) and (2) (right to erasure);

(f) Article 18(1) (restriction of processing);

(g) Article 20(1) and (2) (right to data portability);

(h) Article 21(1) (objections to processing);

(i) Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (a) to (h).

PART 2 — Health data

Definitions

2

(1) In this Part of this Schedule—

“the appropriate health professional”, in relation to a question as to whether the serious harm test is met with respect to data concerning health, means—the health professional who is currently or was most recently responsible for the diagnosis, care or treatment of the data subject in connection with the matters to which the data relates,where there is more than one such health professional, the health professional who is the most suitable to provide an opinion on the question, ora health professional who has the necessary experience and qualifications to provide an opinion on the question, where—there is no health professional available falling within paragraph (a) or (b), orthe controller is the Secretary of State and data is processed in connection with the exercise of the functions conferred on the Secretary of State by or under the Child Support Act 1991 and the Child Support Act 1995, or the Secretary of State's functions in relation to social security or war pensions, orthe controller is the Department for Communities in Northern Ireland and data is processed in connection with the exercise of the functions conferred on the Department by or under the Child Support (Northern Ireland) Order 1991 (S.I. 1991/2628 (N.I. 23)) and the Child Support (Northern Ireland) Order 1995 (S.I. 1995/2702 (N.I. 13));

“war pension” has the same meaning as in section 25 of the Social Security Act 1989 (establishment and functions of war pensions committees).

(2) For the purposes of this Part of this Schedule, the “serious harm test” is met with respect to data concerning health if the application of Article 15 of the UK GDPR to the data would be likely to cause serious harm to the physical or mental health of the data subject or another individual.

Exemption from the listed GDPR provisions: data processed by a court

3

(1) The listed GDPR provisions do not apply to data concerning health if—

(a) it is processed by a court,

(b) it consists of information supplied in a report or other evidence given to the court in the course of proceedings to which rules listed in subparagraph (2) apply, and

(2) Those rules are—

(a) the Magistrates' Courts (Children and Young Persons) Rules (Northern Ireland) 1969 (S.R. (N.I.) 1969 No. 221);

(b) the Magistrates' Courts (Children and Young Persons) Rules 1992 (S.I. 1992/2071 (L. 17));

(d) the Magistrates' Courts (Children (Northern Ireland) Order 1995) Rules (Northern Ireland) 1996 (S.R. (N. I.) 1996 No. 323);

(e) the Act of Sederunt (Child Care and Maintenance Rules) 1997 (S.I. 1997/291 (S. 19));

(f) the Sheriff Court Adoption Rules 2009;

(g) the Family Procedure Rules 2010 (S.I. 2010/2955 (L. 17));

(h) the Children's Hearings (Scotland) Act 2011 (Rules of Procedure in Children's Hearings) Rules 2013 (S.S.I. 2013/194).

Exemption from the listed GDPR provisions: data subject’s expectations and wishes

4

(1) This paragraph applies where a request for data concerning health is made in exercise of a power conferred by an enactment or rule of law and—

(a) in relation to England and Wales or Northern Ireland, the data subject is an individual aged under 18 and the person making the request has parental responsibility for the data subject,

(b) in relation to Scotland, the data subject is an individual aged under 16 and the person making the request has parental responsibilities for the data subject, or

(c) the data subject is incapable of managing his or her own affairs and the person making the request has been appointed by a court to manage those affairs.

(2) The listed GDPR provisions do not apply to data concerning health to the extent that complying with the request would disclose information—

(a) which was provided by the data subject in the expectation that it would not be disclosed to the person making the request,

(b) which was obtained as a result of any examination or investigation to which the data subject consented in the expectation that the information would not be so disclosed, or

(3) The exemptions under sub-paragraph (2)(a) and (b) do not apply if the data subject has expressly indicated that he or she no longer has the expectation mentioned there.

Exemption from Article 15 of the GDPR: serious harm

5

(1) Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not apply to data concerning health to the extent that the serious harm test is met with respect to the data.

(2) A controller who is not a health professional may not rely on sub-paragraph (1) to withhold data concerning health unless the controller has obtained an opinion from the person who appears to the controller to be the appropriate health professional to the effect that the serious harm test is met with respect to the data.

(3) An opinion does not count for the purposes of sub-paragraph (2) if—

(a) it was obtained before the beginning of the relevant period, or

(b) it was obtained during that period but it is reasonable in all the circumstances to re-consult the appropriate health professional.

(4) In this paragraph, “the relevant period” means the period of 6 months ending with the day on which the opinion would be relied on.

Restriction of Article 15 of the GDPR: prior opinion of appropriate health professional

6

(1) Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not permit the disclosure of data concerning health by a controller who is not a health professional unless the controller has obtained an opinion from the person who appears to the controller to be the appropriate health professional to the effect that the serious harm test is not met with respect to the data.

(2) Sub-paragraph (1) does not apply to the extent that the controller is satisfied that the data concerning health has already been seen by, or is within the knowledge of, the data subject.

(3) An opinion does not count for the purposes of sub-paragraph (1) if—

(a) it was obtained before the beginning of the relevant period, or

(b) it was obtained during that period but it is reasonable in all the circumstances to re-consult the appropriate health professional.

(4) In this paragraph, “the relevant period” means the period of 6 months ending with the day on which the opinion would be relied on.

PART 3 — Social work data

Definitions

7

(1) In this Part of this Schedule—

“education data” has the meaning given by paragraph 17 of this Schedule;

“Health and Social Care trust” means a Health and Social Care trust established under the Health and Personal Social Services (Northern Ireland) Order 1991 (S.I. 1991/194 (N.I. 1));

“Principal Reporter” means the Principal Reporter appointed under the Children's Hearings (Scotland) Act 2011 (asp 1), or an officer of the Scottish Children's Reporter Administration to whom there is delegated under paragraph 10(1) of Schedule 3 to that Act any function of the Principal Reporter;

“social work data” means personal data which—is data to which paragraph 8 applies, butis not education data or data concerning health.

(2) For the purposes of this Part of this Schedule, the “serious harm test” is met with respect to social work data if the application of Article 15 of the UK GDPR to the data would be likely to prejudice carrying out social work, because it would be likely to cause serious harm to the physical or mental health of the data subject or another individual.

(3) In sub-paragraph (2), “carrying out social work” is to be taken to include doing any of the following—

(a) the exercise of any functions mentioned in paragraph 8(1)(a), (d), (f) to (j), (m), (p), (s), (t), (u), (v) or (w);

(b) the provision of any service mentioned in paragraph 8(1)(b), (c) or (k);

(c) the exercise of the functions of a body mentioned in paragraph 8(1)(e) or a person mentioned in paragraph 8(1)(q) or (r).

(4) In this Part of this Schedule, a reference to a local authority, in relation to data processed or formerly processed by it, includes a reference to the Council of the Isles of Scilly, in relation to data processed or formerly processed by the Council in connection with any functions mentioned in paragraph 8(1)(a)(ii) which are or have been conferred on the Council by an enactment.

8

(1) This paragraph applies to personal data falling within any of the following descriptions—

(a) data processed by a local authority—

(i) in connection with its social services functions (within the meaning of the Local Authority Social Services Act 1970 or the Social Services and Well-being (Wales) Act 2014 (anaw 4)) or any functions exercised by local authorities under the Social Work (Scotland) Act 1968 or referred to in section 5(1B) of that Act, or

(ii) in the exercise of other functions but obtained or consisting of information obtained in connection with any of the functions mentioned in sub-paragraph (i);

(b) data processed by the Department of Health in Northern Ireland or any person or body exercising functions by virtue of paragraph 22A of Schedule 3 to the Health and Personal Social Services (Northern Ireland) Order 1991—

(i) in connection with the provision of social care within the meaning of section 2(5) of the Health and Social Care (Reform) Act (Northern Ireland) 2009 (c. 1 (N.I.)), or

(ii) in the exercise of other functions but obtained or consisting of information obtained in connection with the provision of that care;

(i) in the exercise of social care and children functions within the meaning of Article 10A of the Health and Personal Social Services (Northern Ireland) Order 1991,

(ia) in connection with the provision of social care within the meaning of section 2(5) of the Health and Social Care (Reform) Act (Northern Ireland) 2009 (c. 1 (N.I.)) by virtue of a delegation direction under Article 10B of the Health and Personal Social Services (Northern Ireland) Order 1991, or

(ii) in the exercise of other functions but obtained or consisting of information obtained in connection with the provision of that care;

(d) data processed by a council in the exercise of its functions under Part 2 of Schedule 9 to the Health and Social Services and Social Security Adjudications Act 1983;

(e) data processed by—

(i) a probation trust established under section 5 of the Offender Management Act 2007, or

(ii) the Probation Board for Northern Ireland established by the Probation Board (Northern Ireland) Order 1982 (S.I. 1982/713 (N.I. 10));

(f) data processed by a local authority in the exercise of its functions under section 36 of the Children Act 1989 or Chapter 2 of Part 6 of the Education Act 1996, so far as those functions relate to ensuring that children of compulsory school age (within the meaning of section 8 of the Education Act 1996) receive suitable education whether by attendance at school or otherwise;

(g) data processed by the Education Authority in the exercise of its functions under Article 55 of the Children (Northern Ireland) Order 1995 (S.I. 1995/755 (N.I. 2)) or Article 45 of, and Schedule 13 to, the Education and Libraries (Northern Ireland) Order 1986 (S.I. 1986/594 (N.I. 3)), so far as those functions relate to ensuring that children of compulsory school age (within the meaning of Article 46 of the Education and Libraries (Northern Ireland) Order 1986) receive efficient full-time education suitable to their age, ability and aptitude and to any special educational needs they may have, either by regular attendance at school or otherwise;

(h) data processed by an education authority in the exercise of its functions under sections 35 to 42 of the Education (Scotland) Act 1980 so far as those functions relate to ensuring that children of school age (within the meaning of section 31 of the Education (Scotland) Act 1980) receive efficient education suitable to their age, ability and aptitude, whether by attendance at school or otherwise;

(i) data relating to persons detained in a hospital at which high security psychiatric services are provided under section 4 of the National Health Service Act 2006 and processed by a Special Health Authority established under section 28 of that Act in the exercise of any functions similar to any social services functions of a local authority;

(j) data relating to persons detained in special accommodation provided under Article 110 of the Mental Health (Northern Ireland) Order 1986 (S.I. 1986/595 (N.I. 4)) and processed by a Health and Social Care trust in the exercise of any functions similar to any social services functions of a local authority;

(k) data which—

(i) is processed by the National Society for the Prevention of Cruelty to Children, or by any other voluntary organisation or other body designated under this paragraph by the Secretary of State or the Department of Health in Northern Ireland, and

(ii) appears to the Secretary of State or the Department, as the case may be, to be processed for the purposes of the provision of any service similar to a service provided in the exercise of any functions specified in paragraph (a), (b), (c) or (d);

(l) data processed by a body mentioned in sub-paragraph (2)—

(i) which was obtained, or consists of information which was obtained, from an authority or body mentioned in any of paragraphs (a) to (k) or from a government department, and

(ii) in the case of data obtained, or consisting of information obtained, from an authority or body mentioned in any of paragraphs (a) to (k), fell within any of those paragraphs while processed by the authority or body;

(m) data processed by a National Health Service trust first established under section 25 of the National Health Service Act 2006, section 18 of the National Health Service (Wales) Act 2006 or section 5 of the National Health Service and Community Care Act 1990 in the exercise of any functions similar to any social services functions of a local authority;

(n) data processed by an NHS foundation trust in the exercise of any functions similar to any social services functions of a local authority;

(o) data processed by a government department—

(i) which was obtained, or consists of information which was obtained, from an authority or body mentioned in any of paragraphs (a) to (n), and

(ii) which fell within any of those paragraphs while processed by that authority or body;

(p) data processed for the purposes of the functions of the Secretary of State pursuant to section 82(5) of the Children Act 1989;

(q) data processed by—

(i) a children's guardian appointed under Part 16 of the Family Procedure Rules 2010 (S.I. 2010/2955 (L. 17)),

(ii) a guardian ad litem appointed under Article 60 of the Children (Northern Ireland) Order 1995 (S.I. 1995/755 (N.I. 2)) or Article 66 of the Adoption (Northern Ireland) Order 1987 (S.I. 1987/2203 (N.I. 22)), or

(iii) a safeguarder appointed under section 30(2) or 31(3) of the Children's Hearings (Scotland) Act 2011 (asp 1);

(r) data processed by the Principal Reporter;

(s) data processed by an officer of the Children and Family Court Advisory and Support Service for the purpose of the officer's functions under section 7 of the Children Act 1989 or Part 16 of the Family Procedure Rules 2010 (S.I. 2010/2955 (L. 17));

(t) data processed by the Welsh family proceedings officer for the purposes of the functions under section 7 of the Children Act 1989 or Part 16 of the Family Procedure Rules 2010;

(u) data processed by an officer of the service appointed as guardian ad litem under Part 16 of the Family Procedure Rules 2010;

(v) data processed by the Children and Family Court Advisory and Support Service for the purpose of its functions under section 12(1) and (2) and section 13(1), (2) and (4) of the Criminal Justice and Court Services Act 2000;

(w) data processed by the Welsh Ministers for the purposes of their functions under section 35(1) and (2) and section 36(1), (2), (4), (5) and (6) of the Children Act 2004;

(x) data processed for the purposes of the functions of the appropriate Minister pursuant to section 12 of the Adoption and Children Act 2002 (independent review of determinations).

(2) The bodies referred to in sub-paragraph (1)(l) are—

(a) a National Health Service trust first established under section 25 of the National Health Service Act 2006 or section 18 of the National Health Service (Wales) Act 2006;

(b) a National Health Service trust first established under section 5 of the National Health Service and Community Care Act 1990;

(d) an integrated care board established under section 14Z25 of the National Health Service Act 2006;

(e) NHS England;

(f) a Local Health Board established under section 11 of the National Health Service (Wales) Act 2006;

(g) a Health Board established under section 2 of the National Health Service (Scotland) Act 1978.

Exemption from the listed GDPR provisions: data processed by a court

9

(1) The listed GDPR provisions do not apply to data that is not education data or data concerning health if—

(a) it is processed by a court,

(b) it consists of information supplied in a report or other evidence given to the court in the course of proceedings to which rules listed in subparagraph (2) apply, and

(c) in accordance with any of those rules, the data may be withheld by the court in whole or in part from the data subject.

(2) Those rules are—

(a) the Magistrates' Courts (Children and Young Persons) Rules (Northern Ireland) 1969 (S.R. (N.I.) 1969 No. 221);

(b) the Magistrates' Courts (Children and Young Persons) Rules 1992 (S.I. 1992/2071 (L. 17));

(d) the Magistrates' Courts (Children (Northern Ireland) Order 1995) Rules (Northern Ireland) 1996 (S.R. (N. I.) 1996 No. 323);

(e) the Act of Sederunt (Child Care and Maintenance Rules) 1997 (S.I. 1997/291 (S. 19));

(f) the Sheriff Court Adoption Rules 2009;

(g) the Family Procedure Rules 2010 (S.I. 2010/2955 (L. 17));

(h) the Children's Hearings (Scotland) Act 2011 (Rules of Procedure in Children's Hearings) Rules 2013 (S.S.I. 2013/194).

Exemption from the listed GDPR provisions: data subject’s expectations and wishes

10

(1) This paragraph applies where a request for social work data is made in exercise of a power conferred by an enactment or rule of law and—

(a) in relation to England and Wales or Northern Ireland, the data subject is an individual aged under 18 and the person making the request has parental responsibility for the data subject,

(b) in relation to Scotland, the data subject is an individual aged under 16 and the person making the request has parental responsibilities for the data subject, or

(c) the data subject is incapable of managing his or her own affairs and the person making the request has been appointed by a court to manage those affairs.

(2) The listed GDPR provisions do not apply to social work data to the extent that complying with the request would disclose information—

(a) which was provided by the data subject in the expectation that it would not be disclosed to the person making the request,

(b) which was obtained as a result of any examination or investigation to which the data subject consented in the expectation that the information would not be so disclosed, or

(3) The exemptions under sub-paragraph (2)(a) and (b) do not apply if the data subject has expressly indicated that he or she no longer has the expectation mentioned there.

Exemption from Article 15 of the GDPR: serious harm

11

Article 15 (1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not apply to social work data to the extent that the serious harm test is met with respect to the data.

Restriction of Article 15 of the GDPR: prior opinion of Principal Reporter

12

(1) This paragraph applies where—

(a) a question arises as to whether a controller who is a social work authority is obliged by Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) to disclose social work data, and

(b) the data—

(i) originated from or was supplied by the Principal Reporter acting in pursuance of the Principal Reporter's statutory duties, and

(ii) is not data which the data subject is entitled to receive from the Principal Reporter.

(2) The controller must inform the Principal Reporter of the fact that the question has arisen before the end of the period of 14 days beginning when the question arises.

(3) Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not permit the controller to disclose the data to the data subject unless the Principal Reporter has informed the controller that, in the opinion of the Principal Reporter, the serious harm test is not met with respect to the data.

(4) In this paragraph “social work authority” means a local authority for the purposes of the Social Work (Scotland) Act 1968.

PART 4 — Education data

Educational records

13

In this Part of this Schedule “educational record” means a record to which paragraph 14, 15 or 16 applies.

14

(1) This paragraph applies to a record of information which—

(a) is processed by or on behalf of the proprietor of, or a teacher at, a school in England and Wales specified in sub-paragraph (3),

(b) relates to an individual who is or has been a pupil at the school, and

(2) But this paragraph does not apply to information which is processed by a teacher solely for the teacher's own use.

(3) The schools referred to in sub-paragraph (1)(a) are—

(a) a school maintained by a local authority;

(b) an Academy school;

(d) an independent school that is not an Academy school or an alternative provision Academy;

(e) a non-maintained special school.

(4) The persons referred to in sub-paragraph (1)(c) are—

(a) an employee of the local authority which maintains the school;

(b) in the case of—

(i) a voluntary aided, foundation or foundation special school (within the meaning of the School Standards and Framework Act 1998),

(ii) an Academy school,

(iii) an alternative provision Academy,

(iv) an independent school that is not an Academy school or an alternative provision Academy, or

(v) a non-maintained special school,

a teacher or other employee at the school (including an educational psychologist engaged by the proprietor under a contract for services);

(d) a parent, as defined by section 576(1) of the Education Act 1996, of that pupil.

(5) In this paragraph—

“independent school” has the meaning given by section 463 of the Education Act 1996;

“local authority” has the same meaning as in that Act (see sections 579(1) and 581 of that Act);

“non-maintained special school” has the meaning given by section 337A of that Act;

“proprietor” has the meaning given by section 579(1) of that Act.

15

(1) This paragraph applies to a record of information which is processed—

(a) by an education authority in Scotland, and

(b) for the purpose of the relevant function of the authority.

(2) But this paragraph does not apply to information which is processed by a teacher solely for the teacher's own use.

(3) For the purposes of this paragraph, information processed by an education authority is processed for the purpose of the relevant function of the authority if the processing relates to the discharge of that function in respect of a person—

(a) who is or has been a pupil in a school provided by the authority, or

(b) who receives, or has received, further education provided by the authority.

(4) In this paragraph “the relevant function” means, in relation to each education authority, its function under section 1 of the Education (Scotland) Act 1980 and section 7(1) of the Self-Governing Schools etc. (Scotland) Act 1989.

16

(1) This paragraph applies to a record of information which—

(a) is processed by or on behalf of the Board of Governors, proprietor or trustees of, or a teacher at, a school in Northern Ireland specified in sub-paragraph (3),

(b) relates to an individual who is or has been a pupil at the school, and

(2) But this paragraph does not apply to information which is processed by a teacher solely for the teacher's own use.

(3) The schools referred to in sub-paragraph (1)(a) are—

(a) a grant-aided school;

(b) an independent school.

(4) The persons referred to in sub-paragraph (1)(c) are—

(a) a teacher at the school;

(b) an employee of the Education Authority, other than a teacher at the school;

(d) the pupil to whom the record relates;

(e) a parent, as defined by Article 2(2) of the Education and Libraries (Northern Ireland) Order 1986 (S.I. 1986/594 (N.I. 3)).

(5) In this paragraph, “grant-aided school”, “independent school”, “proprietor” and “trustees” have the same meaning as in the Education and Libraries (Northern Ireland) Order 1986 (S.I. 1986/594 (N.I. 3)).

Other definitions

17

(1) In this Part of this Schedule—

“education authority” and “further education” have the same meaning as in the Education (Scotland) Act 1980;

“education data” means personal data consisting of information which—constitutes an educational record, butis not data concerning health;

“Principal Reporter” means the Principal Reporter appointed under the Children's Hearings (Scotland) Act 2011 (asp 1), or an officer of the Scottish Children's Reporter Administration to whom there is delegated under paragraph 10(1) of Schedule 3 to that Act any function of the Principal Reporter;

“pupil” means—in relation to a school in England and Wales, a registered pupil within the meaning of the Education Act 1996,in relation to a school in Scotland, a pupil within the meaning of the Education (Scotland) Act 1980, andin relation to a school in Northern Ireland, a registered pupil within the meaning of the Education and Libraries (Northern Ireland) Order 1986 (S.I. 1986/594 (N.I. 3));

“school”—in relation to England and Wales, has the same meaning as in the Education Act 1996,in relation to Scotland, has the same meaning as in the Education (Scotland) Act 1980, andin relation to Northern Ireland, has the same meaning as in the Education and Libraries (Northern Ireland) Order 1986;

“teacher” includes—in Great Britain, head teacher, andin Northern Ireland, the principal of a school.

(2) For the purposes of this Part of this Schedule, the “serious harm test” is met with respect to education data if the application of Article 15 of the UK GDPR to the data would be likely to cause serious harm to the physical or mental health of the data subject or another individual.

Exemption from the listed GDPR provisions: data processed by a court

18

(1) The listed GDPR provisions do not apply to education data if—

(a) it is processed by a court,

(b) it consists of information supplied in a report or other evidence given to the court in the course of proceedings to which rules listed in subparagraph (2) apply, and

(2) Those rules are—

(a) the Magistrates' Courts (Children and Young Persons) Rules (Northern Ireland) 1969 (S.R. (N.I.) 1969 No. 221);

(b) the Magistrates' Courts (Children and Young Persons) Rules 1992 (S.I. 1992/2071 (L. 17));

(d) the Magistrates' Courts (Children (Northern Ireland) Order 1995) Rules (Northern Ireland) 1996 (S.R. (N. I.) 1996 No. 323);

(e) the Act of Sederunt (Child Care and Maintenance Rules) 1997 (S.I. 1997/291 (S. 19));

(f) the Sheriff Court Adoption Rules 2009;

(g) the Family Procedure Rules 2010 (S.I. 2010/2955 (L. 17));

(h) the Children's Hearings (Scotland) Act 2011 (Rules of Procedure in Children's Hearings) Rules 2013 (S.S.I. 2013/194).

Exemption from Article 15 of the GDPR: serious harm

19

Article 15 (1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not apply to education data to the extent that the serious harm test is met with respect to the data.

Restriction of Article 15 of the GDPR: prior opinion of Principal Reporter

20

(1) This paragraph applies where—

(a) a question arises as to whether a controller who is an education authority is obliged by Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) to disclose education data, and

(b) the controller believes that the data—

(i) originated from or was supplied by or on behalf of the Principal Reporter acting in pursuance of the Principal Reporter's statutory duties, and

(ii) is not data which the data subject is entitled to receive from the Principal Reporter.

(2) The controller must inform the Principal Reporter of the fact that the question has arisen before the end of the period of 14 days beginning when the question arises.

(3) Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not permit the controller to disclose the data to the data subject unless the Principal Reporter has informed the controller that, in the opinion of the Principal Reporter, the serious harm test is not met with respect to the data.

PART 5 — Child abuse data

Exemption from Article 15 of the GDPR: child abuse data

21

(1) This paragraph applies where a request for child abuse data is made in exercise of a power conferred by an enactment or rule of law and—

(a) the data subject is an individual aged under 18 and the person making the request has parental responsibility for the data subject, or

(b) the data subject is incapable of managing his or her own affairs and the person making the request has been appointed by a court to manage those affairs.

(2) Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not apply to child abuse data to the extent that the application of that provision would not be in the best interests of the data subject.

(3) “Child abuse data” is personal data consisting of information as to whether the data subject is or has been the subject of, or may be at risk of, child abuse.

(4) For this purpose, “child abuse” includes physical injury (other than accidental injury) to, and physical and emotional neglect, ill-treatment and sexual abuse of, an individual aged under 18.

(5) This paragraph does not apply in relation to Scotland.

SCHEDULE 4

GDPR provisions to be restricted: “the listed GDPR provisions”

1

In this Schedule “the listed GDPR provisions” means the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR)—

(a) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);

(b) Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in Article 15(1) to (3).

Human fertilisation and embryology information

2

The listed GDPR provisions do not apply to personal data consisting of information the disclosure of which is prohibited or restricted by any of sections 31, 31ZA to 31ZE and 33A to 33D of the Human Fertilisation and Embryology Act 1990.

Adoption records and reports

3

(1) The listed GDPR provisions do not apply to personal data consisting of information the disclosure of which is prohibited or restricted by an enactment listed in sub-paragraph (2), (3) or (4).

(2) The enactments extending to England and Wales are—

(a) regulation 14 of the Adoption Agencies Regulations 1983 (S.I. 1983/1964);

(b) regulation 41 of the Adoption Agencies Regulations 2005 (S.I. 2005/389);

(d) rules 5, 6, 9, 17, 18, 21, 22 and 53 of the Adoption Rules 1984 (S.I. 1984/265);

(e) rules 24, 29, 30, 65, 72, 73, 77, 78 and 83 of the Family Procedure (Adoption) Rules 2005 (S.I. 2005/2795 (L. 22));

(f) in the Family Procedure Rules 2010 (S.I. 2010/2955 (L. 17)), rules 14.6, 14.11, 14.12, 14.13, 14.14, 14.24, 16.20 (so far as it applies to a children's guardian appointed in proceedings to which Part 14 of those Rules applies), 16.32 and 16.33 (so far as it applies to a children and family reporter in proceedings to which Part 14 of those Rules applies).

(3) The enactments extending to Scotland are—

(a) regulation 23 of the Adoption Agencies (Scotland) Regulations 1996 (S.I. 1996/3266 (S. 254));

(b) rule 67.3 of the Act of Sederunt (Rules of the Court of Session 1994) 1994 (S.I. 1994/1443 (S. 69));

(c) rules 10.3, 17.2, 21, 25, 39, 43.3, 46.2 and 47 of the Act of Sederunt (Sheriff Court Rules Amendment) (Adoption and Children (Scotland) Act 2007) 2009 (S.S.I. 2009/284);

(d) sections 53 and 55 of the Adoption and Children (Scotland) Act 2007 (asp 4);

(e) regulation 28 of the Adoption Agencies (Scotland) Regulations 2009 (S.S.I. 2009/154);

(f) regulation 3 of the Adoption (Disclosure of Information and Medical Information about Natural Parents) (Scotland) Regulations 2009 (S.S.I. 2009/268).

(4) The enactments extending to Northern Ireland are—

(a) Articles 50 and 54 of the Adoption (Northern Ireland) Order 1987 (S.I. 1987/2203 (N.I. 22));

(b) rule 53 of Order 84 of the Rules of the Court of Judicature (Northern Ireland) 1980 (S.R. (N.I.) 1980 No. 346);

(c) rules 4A.4(5), 4A.5(1), 4A.6(6), 4A.22(5) and 4C.7 of Part IVA of the Family Proceedings Rules (Northern Ireland) 1996 (S.R. (N.I.) 1996 No. 322).

Statements of special educational needs

4

(1) The listed GDPR provisions do not apply to personal data consisting of information the disclosure of which is prohibited or restricted by an enactment listed in sub-paragraph (2).

(2) The enactments are—

(a) regulation 17 of the Special Educational Needs and Disability Regulations 2014 (S.I. 2014/1530);

(b) regulation 10 of the Additional Support for Learning (Co-ordinated Support Plan) (Scotland) Amendment Regulations 2005 (S.S.I. 2005/518);

(c) regulation 22 of the Education (Special Educational Needs) Regulations (Northern Ireland) 2005 (S.R. (N.I.) 2005 No. 384).

Parental order records and reports

5

(1) The listed GDPR provisions do not apply to personal data consisting of information the disclosure of which is prohibited or restricted by an enactment listed in sub-paragraph (2), (3) or (4).

(2) The enactments extending to England and Wales are—

(a) sections 60, 77, 78 and 79 of the Adoption and Children Act 2002, as applied with modifications by regulation 2 of and Schedule 1 to the Human Fertilisation and Embryology (Parental Orders) Regulations 2010 (S.I. 2010/985) in relation to parental orders made under—

(i) section 30 of the Human Fertilisation and Embryology Act 1990, or

(ii) section 54 of the Human Fertilisation and Embryology Act 2008;

(b) rules made under section 144 of the Magistrates' Courts Act 1980 by virtue of section 141(1) of the Adoption and Children Act 2002, as applied with modifications by regulation 2 of and Schedule 1 to the Human Fertilisation and Embryology (Parental Orders) Regulations 2010, so far as the rules relate to—

(i) the appointment and duties of the parental order reporter, and

(ii) the keeping of registers and the custody, inspection and disclosure of documents and information relating to parental order proceedings or related proceedings;

(c) rules made under section 75 of the Courts Act 2003 by virtue of section 141(1) of the Adoption and Children Act 2002, as applied with modifications by regulation 2 of Schedule 1 to the Human Fertilisation and Embryology (Parental Orders) Regulations 2010 (S.I. 2010/985), so far as the rules relate to—

(i) the appointment and duties of the parental order reporter, and

(ii) the keeping of registers and the custody, inspection and disclosure of documents and information relating to parental order proceedings or related proceedings.

(3) The enactments extending to Scotland are—

(a) sections 53 and 55 of the Adoption and Children (Scotland) Act 2007 (asp 4), as applied with modifications by regulation 4 of and Schedule 3 to the Human Fertilisation and Embryology (Parental Orders) Regulations 2010 (S.I. 2010/985) in relation to parental orders made under—

(i) section 30 of the Human Fertilisation and Embryology Act 1990, or

(ii) section 54 of the Human Fertilisation and Embryology Act 2008;

(b) rules 2.47 and 2.59 of the Act of Sederunt (Child Care and Maintenance Rules) 1997 (S.I. 1997/291 (S. 19));

(4) The enactments extending to Northern Ireland are—

(a) Articles 50 and 54 of the Adoption (Northern Ireland) Order 1987 (S.I. 1987/2203 (N.I. 22)), as applied with modifications by regulation 3 of and Schedule 2 to the Human Fertilisation and Embryology (Parental Orders) Regulations 2010 in respect of parental orders made under—

(i) section 30 of the Human Fertilisation and Embryology Act 1990, or

(ii) section 54 of the Human Fertilisation and Embryology Act 2008;

(b) rules 4, 5 and 16 of Order 84A of the Rules of the Court of Judicature (Northern Ireland) 1980 (S.R. (N.I.) 1980 No. 346);

Information provided by Principal Reporter for children’s hearing

6

The listed GDPR provisions do not apply to personal data consisting of information the disclosure of which is prohibited or restricted by any of the following enactments—

(a) section 178 of the Children's Hearings (Scotland) Act 2011 (asp 1);

(b) the Children's Hearings (Scotland) Act 2011 (Rules of Procedure in Children's Hearings) Rules 2013 (S.S.I. 2013/194).

SCHEDULE 5

Introduction

1

(1) This Schedule applies where—

(a) a person (“the applicant”) applies to an accreditation authority for accreditation as a certification provider, and

(b) is dissatisfied with the decision on that application.

(2) In this Schedule—

“accreditation authority” means—the Commissioner, orthe UK national accreditation body;

“certification provider” and “UK national accreditation body” have the same meaning as in section 17.

Review

2

(1) The applicant may ask the accreditation authority to review the decision.

(2) The request must be made in writing before the end of the period of 28 days beginning with the day on which the person receives written notice of the accreditation authority's decision.

(3) The request must specify—

(a) the decision to be reviewed, and

(b) the reasons for asking for the review.

(4) The request may be accompanied by additional documents which the applicant wants the accreditation authority to take into account for the purposes of the review.

(5) If the applicant makes a request in accordance with sub-paragraphs (1) to (4), the accreditation authority must—

(a) review the decision, and

(b) inform the applicant of the outcome of the review in writing before the end of the period of 28 days beginning with the day on which the request for a review is received.

Right to appeal

3

(1) If the applicant is dissatisfied with the decision on the review under paragraph 2, the applicant may ask the accreditation authority to refer the decision to an appeal panel constituted in accordance with paragraph 4.

(2) The request must be made in writing before the end of the period of 3 months beginning with the day on which the person receives written notice of the decision on the review.

(3) A request must specify—

(a) the decision to be referred to the appeal panel, and

(b) the reasons for asking for it to be referred.

(4) The request may be accompanied by additional documents which the applicant wants the appeal panel to take into account.

(5) The applicant may discontinue an appeal at any time by giving notice in writing to the accreditation authority.

Appeal panel

4

(1) If the applicant makes a request in accordance with paragraph 3, an appeal panel must be established in accordance with this paragraph.

(2) An appeal panel must consist of a chair and at least two other members.

(3) Where the request relates to a decision of the Commissioner—

(a) the Secretary of State may appoint one person to be a member of the appeal panel other than the chair, and

(b) subject to paragraph (a), the Commissioner must appoint the members of the appeal panel.

(4) Where the request relates to a decision of the UK national accreditation body—

(a) the Secretary of State—

(i) may appoint one person to be a member of the appeal panel other than the chair, or

(ii) may direct the Commissioner to appoint one person to be a member of the appeal panel other than the chair, and

(b) subject to paragraph (a), the chair of the UK national accreditation body must appoint the members of the appeal panel.

(5) A person may not be a member of an appeal panel if the person—

(a) has a commercial interest in the decision referred to the panel,

(b) has had any prior involvement in any matters relating to the decision, or

(6) The Commissioner may not be a member of an appeal panel to which a decision of the Commissioner is referred.

(7) The applicant may object to all or any of the members of the appeal panel appointed under sub-paragraph (3) or (4).

(8) If the applicant objects to a member of the appeal panel under sub-paragraph (7), the person who appointed that member must appoint a replacement.

(9) The applicant may not object to a member of the appeal panel appointed under sub-paragraph (8).

Hearing

5

(1) If the appeal panel considers it necessary, a hearing must be held at which both the applicant and the accreditation authority may be represented.

(2) Any additional documents which the applicant or the accreditation authority want the appeal panel to take into account must be submitted to the chair of the appeal panel at least 5 working days before the hearing.

(3) The appeal panel may allow experts and witnesses to give evidence at a hearing.

Decision following referral to appeal panel

6

(1) The appeal panel must, before the end of the period of 28 days beginning with the day on which the appeal panel is established in accordance with paragraph 4—

(a) make a reasoned recommendation in writing to the accreditation authority, and

(b) give a copy of the recommendation to the applicant.

(2) For the purposes of sub-paragraph (1), where there is an objection under paragraph 4(7), an appeal panel is not to be taken to be established in accordance with paragraph 4 until the replacement member is appointed (or, if there is more than one objection, until the last replacement member is appointed).

(3) The accreditation authority must, before the end of the period of 3 working days beginning with the day on which the authority receives the recommendation—

(a) make a reasoned final decision in writing, and

(b) give a copy of the decision to the applicant.

(4) Where the accreditation authority is the UK national accreditation body, the recommendation must be given to, and the final decision must be made by, the chief executive of that body.

Meaning of “working day”

7

In this Schedule, “working day” means any day other than—

(a) Saturday or Sunday,

(b) Christmas Day or Good Friday, or

SCHEDULE 6

PART 1 — Modifications to the GDPR

Introductory

1

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

References to the GDPR and its provisions

2

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

References to Union law and Member State law

3

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

References to the Union and to Member States

4

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

References to supervisory authorities

5

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

References to the national parliament

6

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Chapter I of the GDPR (general provisions)

7

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

8

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

9

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Chapter II of the GDPR (principles)

10

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

11

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

12

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

13

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Section 1 of Chapter III of the GDPR (rights of the data subject: transparency and modalities)

14

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Section 2 of Chapter III of the GDPR (rights of the data subject: information and access to personal data)

15

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

16

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Section 3 of Chapter III of the GDPR (rights of the data subject: rectification and erasure)

17

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

18

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Section 4 of Chapter III of the GDPR (rights of the data subject: right to object and automated individual decision-making)

19

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

20

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Section 5 of Chapter III of the GDPR (rights of the data subject: restrictions)

21

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Section 1 of Chapter IV of the GDPR (controller and processor: general obligations)

22

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

23

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

24

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

25

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

26

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Section 3 of Chapter IV of the GDPR (controller and processor: data protection impact assessment and prior consultation)

27

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

28

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Section 4 of Chapter IV of the GDPR (controller and processor: data protection officer)

29

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

30

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Section 5 of Chapter IV of the GDPR (controller and processor: codes of conduct and certification)

31

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

32

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

33

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

34

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Chapter V of the GDPR (transfers of data to third countries or international organisations)

35

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

36

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

37

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

38

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

39

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Section 1 of Chapter VI of the GDPR (independent supervisory authorities: independent status)

40

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

41

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

42

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

43

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Section 2 of Chapter VI of the GDPR (independent supervisory authorities: competence, tasks and powers)

44

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

45

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

46

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

47

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

48

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Chapter VII of the GDPR (co-operation and consistency)

49

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Chapter VIII of the GDPR (remedies, liability and penalties)

50

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

51

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

52

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

53

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

54

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

55

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

56

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

57

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Chapter IX of the GDPR (provisions relating to specific processing situations)

58

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

59

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

60

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

61

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

62

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

63

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

64

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Chapter X of the GDPR (delegated acts and implementing acts)

65

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

66

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Chapter XI of the GDPR (final provisions)

67

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

68

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

69

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

70

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

71

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

72

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

PART 2 — Modifications to Chapter 2 of Part 2

Introductory

73

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

General modifications

74

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Exemptions

75

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

SCHEDULE 7

1

Any United Kingdom government department other than a non-ministerial government department.

2

The Scottish Ministers.

3

Any Northern Ireland department.

4

The Welsh Ministers.

Chief officers of police and other policing bodies

5

The chief constable of a police force maintained under section 2 of the Police Act 1996.

6

The Commissioner of Police of the Metropolis.

7

The Commissioner of Police for the City of London.

8

The Chief Constable of the Police Service of Northern Ireland.

9

The chief constable of the Police Service of Scotland.

10

The chief constable of the British Transport Police.

11

The chief constable of the Civil Nuclear Constabulary.

12

The chief constable of the Ministry of Defence Police.

13

The Provost Marshal of the Royal Navy Police.

14

The Provost Marshal of the Royal Military Police.

15

The Provost Marshal of the Royal Air Force Police.

16

The chief officer of—

(a) a body of constables appointed under provision incorporating section 79 of the Harbours, Docks, and Piers Clauses Act 1847;

(b) a body of constables appointed under an order made under section 14 of the Harbours Act 1964;

17

A body established in accordance with a collaboration agreement under section 22A of the Police Act 1996.

18

The Director General of the Independent Office for Police Conduct.

19

The Police Investigations and Review Commissioner.

20

The Police Ombudsman for Northern Ireland.

Other authorities with investigatory functions

21

The Commissioners for Her Majesty's Revenue and Customs.

22

The Welsh Revenue Authority.

23

Revenue Scotland.

24

The Director General of the National Crime Agency.

25

The Director of the Serious Fraud Office.

26

The Director of Border Revenue.

27

The Financial Conduct Authority.

28

The Health and Safety Executive.

29

The Competition and Markets Authority.

30

The Gas and Electricity Markets Authority.

31

The Food Standards Agency.

32

Food Standards Scotland.

33

Her Majesty's Land Registry.

34

The Criminal Cases Review Commission.

35

The Scottish Criminal Cases Review Commission.

Authorities with functions relating to offender management

36

A provider of probation services (other than the Secretary of State), acting in pursuance of arrangements made under section 3(2) of the Offender Management Act 2007.

37

The Youth Justice Board for England and Wales.

38

The Parole Board for England and Wales.

39

The Parole Board for Scotland.

40

The Parole Commissioners for Northern Ireland.

41

The Probation Board for Northern Ireland.

42

The Prisoner Ombudsman for Northern Ireland.

43

A person who has entered into a contract for the running of, or part of—

(a) a prison or young offender institution under section 84 of the Criminal Justice Act 1991, or

(b) a secure training centre under section 7 of the Criminal Justice and Public Order Act 1994.

44

A person who has entered into a contract with the Secretary of State—

(a) under section 80 of the Criminal Justice Act 1991 for the purposes of prisoner escort arrangements, or

(b) under paragraph 1 of Schedule 1 to the Criminal Justice and Public Order Act 1994 for the purposes of escort arrangements.

45

A person who is, under or by virtue of any enactment, responsible for securing the electronic monitoring of an individual.

46

A youth offending team established under section 39 of the Crime and Disorder Act 1998.

Other authorities

47

The Director of Public Prosecutions.

48

The Director of Public Prosecutions for Northern Ireland.

49

The Lord Advocate.

50

A Procurator Fiscal.

51

The Director of Service Prosecutions.

52

The Information Commissioner.

53

The Scottish Information Commissioner.

54

The Scottish Courts and Tribunal Service.

55

The Crown agent.

56

A court or tribunal.

SCHEDULE 8

Statutory etc purposes

1

This condition is met if the processing—

(a) is necessary for the exercise of a function conferred on a person by an enactment or rule of law, and

(b) is necessary for reasons of substantial public interest.

Administration of justice

2

This condition is met if the processing is necessary for the administration of justice.

Protecting individual’s vital interests

3

This condition is met if the processing is necessary to protect the vital interests of the data subject or of another individual.

Safeguarding of children and of individuals at risk

4

(1) This condition is met if—

(a) the processing is necessary for the purposes of—

(i) protecting an individual from neglect or physical, mental or emotional harm, or

(ii) protecting the physical, mental or emotional well-being of an individual,

(b) the individual is—

(i) aged under 18, or

(ii) aged 18 or over and at risk,

(c) the processing is carried out without the consent of the data subject for one of the reasons listed in sub-paragraph (2), and

(d) the processing is necessary for reasons of substantial public interest.

(2) The reasons mentioned in sub-paragraph (1)(c) are—

(a) in the circumstances, consent to the processing cannot be given by the data subject;

(b) in the circumstances, the controller cannot reasonably be expected to obtain the consent of the data subject to the processing;

(c) the processing must be carried out without the consent of the data subject because obtaining the consent of the data subject would prejudice the provision of the protection mentioned in sub-paragraph (1)(a).

(3) For the purposes of this paragraph, an individual aged 18 or over is “at risk” if the controller has reasonable cause to suspect that the individual—

(a) has needs for care and support,

(b) is experiencing, or at risk of, neglect or physical, mental or emotional harm, and

(4) In sub-paragraph (1)(a), the reference to the protection of an individual or of the well-being of an individual includes both protection relating to a particular individual and protection relating to a type of individual.

Personal data already in the public domain

5

This condition is met if the processing relates to personal data which is manifestly made public by the data subject.

Legal claims

6

This condition is met if the processing—

(a) is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings),

(b) is necessary for the purpose of obtaining legal advice, or

Judicial acts

7

This condition is met if the processing is necessary when a court or other judicial authority is acting in its judicial capacity.

Preventing fraud

8

(1) This condition is met if the processing—

(a) is necessary for the purposes of preventing fraud or a particular kind of fraud, and

(b) consists of—

(i) the disclosure of personal data by a competent authority as a member of an anti-fraud organisation,

(ii) the disclosure of personal data by a competent authority in accordance with arrangements made by an anti-fraud organisation,

(iia) the processing of personal data carried out in preparation for disclosure described in sub-paragraph (i) or (ii), or

(iii) the processing of personal data disclosed as described in sub-paragraph (i) or (ii).

(2) In this paragraph, “anti-fraud organisation” has the same meaning as in section 68 of the Serious Crime Act 2007.

Archiving etc

9

This condition is met if the processing is necessary—

(a) for archiving purposes in the public interest,

(b) for scientific or historical research purposes, or

SCHEDULE 9

1

The data subject has given consent to the processing.

2

The processing is necessary—

(a) for the performance of a contract to which the data subject is a party, or

(b) in order to take steps at the request of the data subject prior to entering into a contract.

3

The processing is necessary for compliance with a legal obligation to which the controller is subject, other than an obligation imposed by contract.

4

The processing is necessary in order to protect the vital interests of the data subject or of another individual.

5

The processing is necessary—

(a) for the administration of justice,

(b) for the exercise of any functions of either House of Parliament,

(d) for the exercise of any functions of the Crown, a Minister of the Crown or a government department, or

(e) for the exercise of any other functions of a public nature exercised in the public interest by a person.

6

(1) The processing is necessary for the purposes of legitimate interests pursued by—

(a) the controller, or

(b) the third party or parties to whom the data is disclosed.

(2) Sub-paragraph (1) does not apply where the processing is unwarranted in any particular case because of prejudice to the rights and freedoms or legitimate interests of the data subject.

(3) In this paragraph, “third party”, in relation to personal data, means a person other than the data subject, the controller or a processor or other person authorised to process personal data for the controller or processor.

SCHEDULE 10

Consent to particular processing

1

The data subject has given consent to the processing.

Right or obligation relating to employment

2

The processing is necessary for the purposes of exercising or performing any right or obligation which is conferred or imposed by an enactment or rule of law on the controller in connection with employment.

Vital interests of a person

3

The processing is necessary—

(a) in order to protect the vital interests of the data subject or of another person, in a case where—

(i) consent cannot be given by or on behalf of the data subject, or

(ii) the controller cannot reasonably be expected to obtain the consent of the data subject, or

(b) in order to protect the vital interests of another person, in a case where consent by or on behalf of the data subject has been unreasonably withheld.

Safeguarding of children and of individuals at risk

4

(1) This condition is met if—

(a) the processing is necessary for the purposes of—

(i) protecting an individual from neglect or physical, mental or emotional harm, or

(ii) protecting the physical, mental or emotional well-being of an individual,

(b) the individual is—

(i) aged under 18, or

(ii) aged 18 or over and at risk,

(c) the processing is carried out without the consent of the data subject for one of the reasons listed in sub-paragraph (2), and

(d) the processing is necessary for reasons of substantial public interest.

(2) The reasons mentioned in sub-paragraph (1)(c) are—

(a) in the circumstances, consent to the processing cannot be given by the data subject;

(b) in the circumstances, the controller cannot reasonably be expected to obtain the consent of the data subject to the processing;

(c) the processing must be carried out without the consent of the data subject because obtaining the consent of the data subject would prejudice the provision of the protection mentioned in sub-paragraph (1)(a).

(3) For the purposes of this paragraph, an individual aged 18 or over is “at risk” if the controller has reasonable cause to suspect that the individual—

(a) has needs for care and support,

(b) is experiencing, or at risk of, neglect or physical, mental or emotional harm, and

(4) In sub-paragraph (1)(a), the reference to the protection of an individual or of the well-being of an individual includes both protection relating to a particular individual and protection relating to a type of individual.

Data already published by data subject

5

The information contained in the personal data has been made public as a result of steps deliberately taken by the data subject.

Legal proceedings etc

6

The processing—

(a) is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings),

(b) is necessary for the purpose of obtaining legal advice, or

Administration of justice, parliamentary, statutory etc and government purposes

7

The processing is necessary—

(a) for the administration of justice,

(b) for the exercise of any functions of either House of Parliament,

(d) for the exercise of any functions of the Crown, a Minister of the Crown or a government department.

Medical purposes

8

(1) The processing is necessary for medical purposes and is undertaken by—

(a) a health professional, or

(b) a person who in the circumstances owes a duty of confidentiality which is equivalent to that which would arise if that person were a health professional.

(2) In this paragraph, “medical purposes” includes the purposes of preventative medicine, medical diagnosis, medical research, the provision of care and treatment and the management of healthcare services.

Equality

9

(1) The processing—

(a) is of sensitive personal data consisting of information as to racial or ethnic origin,

(b) is necessary for the purpose of identifying or keeping under review the existence or absence of equality of opportunity or treatment between persons of different racial or ethnic origins, with a view to enabling such equality to be promoted or maintained, and

(2) In this paragraph, “sensitive personal data” means personal data the processing of which constitutes sensitive processing (see section 86(7)).

SCHEDULE 11

Preliminary

1

In this Schedule, “the listed provisions” means—

(a) Chapter 2 of Part 4 (the data protection principles), except section 86(1)(a) and (2) and Schedules 9 and 10;

(b) Chapter 3 of Part 4 (rights of data subjects);

Crime

2

The listed provisions do not apply to personal data processed for any of the following purposes—

(a) the prevention , investigation and detection of crime, or

(b) the apprehension and prosecution of offenders,

to the extent that the application of the listed provisions would be likely to prejudice any of the matters mentioned in paragraph (a) or (b).

Information required to be disclosed by law etc or in connection with legal proceedings

3

(1) The listed provisions do not apply to personal data consisting of information that the controller is obliged by an enactment to make available to the public, to the extent that the application of the listed provisions would prevent the controller from complying with that obligation.

(2) The listed provisions do not apply to personal data where disclosure of the data is required by an enactment, a rule of law or the order of a court, to the extent that the application of the listed provisions would prevent the controller from making the disclosure.

(3) The listed provisions do not apply to personal data where disclosure of the data—

(a) is necessary for the purpose of, or in connection with, legal proceedings (including prospective legal proceedings),

(b) is necessary for the purpose of obtaining legal advice, or

to the extent that the application of the listed provisions would prevent the controller from making the disclosure.

Parliamentary privilege

4

The listed provisions do not apply to personal data where this is required for the purpose of avoiding an infringement of the privileges of either House of Parliament.

Judicial proceedings

5

The listed provisions do not apply to personal data to the extent that the application of the listed provisions would be likely to prejudice judicial proceedings.

Crown honours and dignities

6

The listed provisions do not apply to personal data processed for the purposes of the conferring by the Crown of any honour or dignity.

Armed forces

7

The listed provisions do not apply to personal data to the extent that the application of the listed provisions would be likely to prejudice the combat effectiveness of any of the armed forces of the Crown.

Economic well-being

8

The listed provisions do not apply to personal data to the extent that the application of the listed provisions would be likely to prejudice the economic well-being of the United Kingdom.

Legal professional privilege

9

The listed provisions do not apply to personal data that consists of—

(a) information in respect of which a claim to legal professional privilege or, in Scotland, confidentiality of communications, could be maintained in legal proceedings, or

(b) information in respect of which a duty of confidentiality is owed by a professional legal adviser to a client of the adviser.

Negotiations

10

The listed provisions do not apply to personal data that consists of records of the intentions of the controller in relation to any negotiations with the data subject to the extent that the application of the listed provisions would be likely to prejudice the negotiations.

Confidential references given by the controller

11

The listed provisions do not apply to personal data consisting of a reference given (or to be given) in confidence by the controller for the purposes of—

(a) the education, training or employment (or prospective education, training or employment) of the data subject,

(b) the appointment (or prospective appointment) of the data subject to any office, or

Exam scripts and marks

12

(1) The listed provisions do not apply to personal data consisting of information recorded by candidates during an exam.

(2) Where personal data consists of marks or other information processed by a controller—

(a) for the purposes of determining the results of an exam, or

(b) in consequence of the determination of the results of an exam,

section 94 has effect subject to sub-paragraph (3).

(3) Where the relevant time falls before the results of the exam are announced, the period mentioned in section 94(10)(b) is extended until the earlier of—

(a) the end of the period of 5 months beginning with the relevant time, and

(b) the end of the period of 40 days beginning with the announcement of the results.

(4) In this paragraph—

“exam” means an academic, professional or other examination used for determining the knowledge, intelligence, skill or ability of a candidate and may include an exam consisting of an assessment of the candidate's performance while undertaking work or any other activity;

“the relevant time” has the same meaning as in section 94.

(5) For the purposes of this paragraph, the results of an exam are treated as announced when they are first published or, if not published, first communicated to the candidate.

Research and statistics

13

(1) The listed provisions do not apply to personal data processed for—

(a) scientific or historical research purposes, or

(b) statistical purposes,

to the extent that the application of those provisions would prevent or seriously impair the achievement of the purposes in question.

(2) The exemption in sub-paragraph (1) is available only where—

(a) the personal data is processed subject to appropriate safeguards for the rights and freedoms of data subjects, and

(b) the results of the research or any resulting statistics are not made available in a form which identifies a data subject.

Archiving in the public interest

14

(1) The listed provisions do not apply to personal data processed for archiving purposes in the public interest to the extent that the application of those provisions would prevent or seriously impair the achievement of those purposes.

(2) The exemption in sub-paragraph (1) is available only where the personal data is processed subject to appropriate safeguards for the rights and freedoms of data subjects.

SCHEDULE 12

Status and capacity

1

(1) The Commissioner is to continue to be a corporation sole.

(2) The Commissioner and the Commissioner's officers and staff are not to be regarded as servants or agents of the Crown.

Appointment

2

(1) The Commissioner is to be appointed by Her Majesty by Letters Patent.

(2) No recommendation may be made to Her Majesty for the appointment of a person as the Commissioner unless the person concerned has been selected on merit on the basis of fair and open competition.

(3) The Commissioner is to hold office for such term not exceeding 7 years as may be determined at the time of the Commissioner's appointment, subject to paragraph 3.

(4) A person cannot be appointed as the Commissioner more than once.

Resignation and removal

3

(1) The Commissioner may be relieved of office by Her Majesty at the Commissioner's own request.

(2) The Commissioner may be removed from office by Her Majesty on an Address from both Houses of Parliament.

(3) No motion is to be made in either House of Parliament for such an Address unless a Minister of the Crown has presented a report to that House stating that the Minister is satisfied that one or both of the following grounds is made out—

(a) the Commissioner is guilty of serious misconduct;

(b) the Commissioner no longer fulfils the conditions required for the performance of the Commissioner's functions.

Salary etc

4

(1) The Commissioner is to be paid such salary as may be specified by a resolution of the House of Commons.

(2) There is to be paid in respect of the Commissioner such pension as may be specified by a resolution of the House of Commons.

(3) A resolution for the purposes of this paragraph may—

(a) specify the salary or pension,

(b) specify the salary or pension and provide for it to be increased by reference to such variables as may be specified in the resolution, or

(c) provide that the salary or pension is to be the same as, or calculated on the same basis as, that payable to, or in respect of, a person employed in a specified office under, or in a specified capacity in the service of, the Crown.

(4) A resolution for the purposes of this paragraph may take effect from—

(a) the date on which it is passed, or

(b) from an earlier date or later date specified in the resolution.

(5) A resolution for the purposes of this paragraph may make different provision in relation to the pension payable to, or in respect of, different holders of the office of Commissioner.

(6) A salary or pension payable under this paragraph is to be charged on and issued out of the Consolidated Fund.

(7) In this paragraph, “pension” includes an allowance or gratuity and a reference to the payment of a pension includes a reference to the making of payments towards the provision of a pension.

Officers and staff

5

(1) The Commissioner—

(a) must appoint one or more deputy commissioners, and

(b) may appoint other officers and staff.

(2) The Commissioner is to determine the remuneration and other conditions of service of people appointed under this paragraph.

(3) The Commissioner may pay pensions, allowances or gratuities to, or in respect of, people appointed under this paragraph, including pensions, allowances or gratuities paid by way of compensation in respect of loss of office or employment.

(4) The references in sub-paragraph (3) to paying pensions, allowances or gratuities includes making payments towards the provision of pensions, allowances or gratuities.

(5) In making appointments under this paragraph, the Commissioner must have regard to the principle of selection on merit on the basis of fair and open competition.

(6) The Employers' Liability (Compulsory Insurance) Act 1969 does not require insurance to be effected by the Commissioner.

Carrying out of the Commissioner’s functions by officers and staff

6

(1) The functions of the Commissioner are to be carried out by the deputy commissioner or deputy commissioners if—

(a) there is a vacancy in the office of the Commissioner, or

(b) the Commissioner is for any reason unable to act.

(2) When the Commissioner appoints a second or subsequent deputy commissioner, the Commissioner must specify which deputy commissioner is to carry out which of the Commissioner's functions in the circumstances referred to in sub-paragraph (1).

(3) A function of the Commissioner may, to the extent authorised by the Commissioner, be carried out by any of the Commissioner's officers or staff.

Authentication of the seal of the Commissioner

7

The application of the seal of the Commissioner is to be authenticated by—

(a) the Commissioner's signature, or

(b) the signature of another person authorised for the purpose.

Presumption of authenticity of documents issued by the Commissioner

8

A document purporting to be an instrument issued by the Commissioner and to be—

(a) duly executed under the Commissioner's seal, or

(b) signed by or on behalf of the Commissioner,

is to be received in evidence and is to be deemed to be such an instrument unless the contrary is shown.

Money

9

The Secretary of State may make payments to the Commissioner out of money provided by Parliament.

Fees etc and other sums

10

(1) All fees, charges, penalties and other sums received by the Commissioner in carrying out the Commissioner's functions are to be paid by the Commissioner to the Secretary of State.

(2) Sub-paragraph (1) does not apply where the Secretary of State, with the consent of the Treasury, otherwise directs.

(3) Any sums received by the Secretary of State under sub-paragraph (1) are to be paid into the Consolidated Fund.

Accounts

11

(1) The Commissioner must—

(a) keep proper accounts and other records in relation to the accounts, and

(b) prepare in respect of each financial year a statement of account in such form as the Secretary of State may direct.

(2) The Commissioner must send a copy of the statement to the Comptroller and Auditor General—

(a) on or before 31 August next following the end of the year to which the statement relates, or

(b) on or before such earlier date after the end of that year as the Treasury may direct.

(3) The Comptroller and Auditor General must examine, certify and report on the statement.

(4) The Commissioner must arrange for copies of the statement and the Comptroller and Auditor General's report to be laid before Parliament.

(5) In this paragraph, “financial year” means a period of 12 months beginning with 1 April.

Scotland

12

Paragraphs 1(1), 7 and 8 do not extend to Scotland.

SCHEDULE 13

General tasks

1

(1) The Commissioner must—

(a) monitor and enforce Parts 3 and 4 of this Act;

(b) promote public awareness and understanding of the risks, rules, safeguards and rights in relation to processing of personal data to which those Parts apply;

(c) advise Parliament, the government and other institutions and bodies on legislative and administrative measures relating to the protection of individuals' rights and freedoms with regard to processing of personal data to which those Parts apply;

(d) promote the awareness of controllers and processors of their obligations under Parts 3 and 4 of this Act;

(e) on request, provide information to a data subject concerning the exercise of the data subject's rights under Parts 3 and 4 of this Act and, if appropriate, co-operate with ... foreign designated authorities to provide such information;

(f) co-operate with ... foreign designated authorities with a view to ensuring the consistency of application and enforcement of ... the Data Protection Convention, including by sharing information and providing mutual assistance;

(g) conduct investigations on the application of Parts 3 and 4 of this Act, including on the basis of information received from ... a foreign designated authority or another public authority;

(h) monitor relevant developments to the extent that they have an impact on the protection of personal data, including the development of information and communication technologies;

(i) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(2) Section 3(14)(c) does not apply to the reference to personal data in sub-paragraph (1)(h).

General powers

2

The Commissioner has the following investigative, corrective, authorisation and advisory powers in relation to processing of personal data to which Part 3 or 4 of this Act applies—

(a) to notify the controller or the processor of an alleged infringement of Part 3 or 4 of this Act;

(b) to issue warnings to a controller or processor that intended processing operations are likely to infringe provisions of Part 3 or 4 of this Act;

(c) to issue reprimands to a controller or processor where processing operations have infringed provisions of Part 3 or 4 of this Act;

(d) to issue, on the Commissioner's own initiative or on request, opinions to Parliament, the government or other institutions and bodies as well as to the public on any issue related to the protection of personal data.

Definitions

3

In this Schedule—

“foreign designated authority” means an authority designated for the purposes of Article 13 of the Data Protection Convention by a party, other than the United Kingdom, which is bound by that Convention;

SCHEDULE 14

PART 1 — Law Enforcement Directive

Co-operation

1

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Requests for information and assistance from LED supervisory authorities

2

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Fees

3

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Restrictions on use of information

4

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

LED supervisory authority

5

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

PART 2 — Data Protection Convention

Co-operation between the Commissioner and foreign designated authorities

6

(1) The Commissioner must, at the request of a foreign designated authority—

(a) provide that authority with such information referred to in Article 13(3)(a) of the Data Protection Convention (information on law and administrative practice in the field of data protection) as is the subject of the request, and

(b) take appropriate measures in accordance with Article 13(3)(b) of the Data Protection Convention for providing that authority with information relating to the processing of personal data in the United Kingdom.

(2) The Commissioner may ask a foreign designated authority—

(a) to provide the Commissioner with information referred to in Article 13(3) of the Data Protection Convention, or

(b) to take appropriate measures to provide such information.

Assisting persons resident outside the UK with requests under Article 14 of the Convention

7

(1) This paragraph applies where a request for assistance in exercising any of the rights referred to in Article 8 of the Data Protection Convention in the United Kingdom is made by a person resident outside the United Kingdom, including where the request is forwarded to the Commissioner through the Secretary of State or a foreign designated authority.

(2) The Commissioner must take appropriate measures to assist the person to exercise those rights.

Assisting UK residents with requests under Article 8 of the Convention

8

(1) This paragraph applies where a request for assistance in exercising any of the rights referred to in Article 8 of the Data Protection Convention in a country or territory (other than the United Kingdom) specified in the request is—

(a) made by a person resident in the United Kingdom, and

(b) submitted through the Commissioner under Article 14(2) of the Convention.

(2) If the Commissioner is satisfied that the request contains all necessary particulars referred to in Article 14(3) of the Data Protection Convention, the Commissioner must send the request to the foreign designated authority in the specified country or territory.

(3) Otherwise, the Commissioner must, where practicable, notify the person making the request of the reasons why the Commissioner is not required to assist.

Restrictions on use of information

9

Where the Commissioner receives information from a foreign designated authority as a result of—

(a) a request made by the Commissioner under paragraph 6(2), or

(b) a request received by the Commissioner under paragraph 6(1) or 7,

the Commissioner may use the information only for the purposes specified in the request.

Foreign designated authority

10

In this Part of this Schedule, “foreign designated authority” means an authority designated for the purposes of Article 13 of the Data Protection Convention by a party, other than the United Kingdom, which is bound by that Data Protection Convention.

SCHEDULE 15

Issue of warrants in connection with non-compliance and offences

1

(1) This paragraph applies if a judge of the High Court, a circuit judge or a District Judge (Magistrates' Courts) is satisfied by information on oath supplied by the Commissioner that—

(a) there are reasonable grounds for suspecting that—

(i) a controller or processor has failed or is failing as described in section 149(2), or

(ii) an offence under this Act has been or is being committed, and

(b) there are reasonable grounds for suspecting that evidence of the failure or of the commission of the offence is to be found on premises specified in the information or is capable of being viewed using equipment on such premises.

(2) The judge may grant a warrant to the Commissioner.

Issue of warrants in connection with assessment notices

2

(1) This paragraph applies if a judge of the High Court, a circuit judge or a District Judge (Magistrates' Courts) is satisfied by information on oath supplied by the Commissioner that a controller or processor has failed to comply with a requirement imposed by an assessment notice.

(2) The judge may, for the purpose of enabling the Commissioner to determine whether the controller or processor has complied or is complying with the data protection legislation, grant a warrant to the Commissioner in relation to premises that were specified in the assessment notice.

Restrictions on issuing warrants: processing for the special purposes

3

A judge must not issue a warrant under this Schedule in respect of personal data processed for the special purposes unless a determination under section 174 with respect to the data or the processing has taken effect.

Restrictions on issuing warrants: procedural requirements

4

(1) A judge must not issue a warrant under this Schedule unless satisfied that—

(a) the conditions in sub-paragraphs (2) to (4) are met,

(b) compliance with those conditions would defeat the object of entry to the premises in question, or

(2) The first condition is that the Commissioner has given 7 days' notice in writing to the occupier of the premises in question demanding access to the premises.

(3) The second condition is that—

(a) access to the premises was demanded at a reasonable hour and was unreasonably refused, or

(b) entry to the premises was granted but the occupier unreasonably refused to comply with a request by the Commissioner or the Commissioner's officers or staff to be allowed to do any of the things referred to in paragraph 5.

(4) The third condition is that, since the refusal, the occupier of the premises—

(a) has been notified by the Commissioner of the application for the warrant, and

(b) has had an opportunity to be heard by the judge on the question of whether or not the warrant should be issued.

(5) In determining whether the first condition is met, an assessment notice given to the occupier is to be disregarded.

Content of warrants

5

(1) A warrant issued under this Schedule must authorise the Commissioner or any of the Commissioner's officers or staff—

(a) to enter the premises,

(b) to search the premises, and

(c) to inspect, examine, operate and test any equipment found on the premises which is used or intended to be used for the processing of personal data.

(2) A warrant issued under paragraph 1 must authorise the Commissioner or any of the Commissioner's officers or staff—

(a) to inspect and seize any documents or other material found on the premises which may be evidence of the failure or offence mentioned in that paragraph,

(b) to require any person on the premises to provide, in an appropriate form, a copy of information capable of being viewed using equipment on the premises which may be evidence of that failure or offence,

(c) to require any person on the premises to provide an explanation of any document or other material found on the premises and of any information capable of being viewed using equipment on the premises, and

(d) to require any person on the premises to provide such other information as may reasonably be required for the purpose of determining whether the controller or processor has failed or is failing as described in section 149(2).

(3) A warrant issued under paragraph 2 must authorise the Commissioner or any of the Commissioner's officers or staff—

(a) to inspect and seize any documents or other material found on the premises which may enable the Commissioner to determine whether the controller or processor has complied or is complying with the data protection legislation,

(b) to require any person on the premises to provide, in an appropriate form, a copy of information capable of being viewed using equipment on the premises which may enable the Commissioner to make such a determination,

(c) to require any person on the premises to provide an explanation of any document or other material found on the premises and of any information capable of being viewed using equipment on the premises, and

(d) to require any person on the premises to provide such other information as may reasonably be required for the purpose of determining whether the controller or processor has complied or is complying with the data protection legislation.

(4) A warrant issued under this Schedule must authorise the Commissioner or any of the Commissioner's officers or staff to do the things described in sub-paragraphs (1) to (3) at any time in the period of 7 days beginning with the day on which the warrant is issued.

(5) For the purposes of this paragraph, a copy of information is in an “appropriate form” if —

(a) it can be taken away, and

(b) it is visible and legible or it can readily be made visible and legible.

Copies of warrants

6

A judge who issues a warrant under this Schedule must—

(a) issue two copies of it, and

(b) certify them clearly as copies.

Execution of warrants: reasonable force

7

A person executing a warrant issued under this Schedule may use such reasonable force as may be necessary.

Execution of warrants: time when executed

8

A warrant issued under this Schedule may be executed only at a reasonable hour, unless it appears to the person executing it that there are grounds for suspecting that exercising it at a reasonable hour would defeat the object of the warrant.

Execution of warrants: occupier of premises

9

(1) If an occupier of the premises in respect of which a warrant is issued under this Schedule is present when the warrant is executed, the person executing the warrant must—

(a) show the occupier the warrant, and

(b) give the occupier a copy of it.

(2) Otherwise, a copy of the warrant must be left in a prominent place on the premises.

Execution of warrants: seizure of documents etc

10

(1) This paragraph applies where a person executing a warrant under this Schedule seizes something.

(2) The person must, on request—

(a) give a receipt for it, and

(b) give an occupier of the premises a copy of it.

(3) Sub-paragraph (2)(b) does not apply if the person executing the warrant considers that providing a copy would result in undue delay.

(4) Anything seized may be retained for so long as is necessary in all the circumstances.

Matters exempt from inspection and seizure: privileged communications

11

(1) The powers of inspection and seizure conferred by a warrant issued under this Schedule are not exercisable in respect of a communication which is made—

(a) between a professional legal adviser and the adviser's client, and

(b) in connection with the giving of legal advice to the client with respect to obligations, liabilities or rights under the data protection legislation.

(2) The powers of inspection and seizure conferred by a warrant issued under this Schedule are not exercisable in respect of a communication which is made—

(a) between a professional legal adviser and the adviser's client or between such an adviser or client and another person,

(b) in connection with or in contemplation of proceedings under or arising out of the data protection legislation, and

(3) Sub-paragraphs (1) and (2) do not prevent the exercise of powers conferred by a warrant issued under this Schedule in respect of—

(a) anything in the possession of a person other than the professional legal adviser or the adviser's client, or

(b) anything held with the intention of furthering a criminal purpose.

(4) The references to a communication in sub-paragraphs (1) and (2) include—

(a) a copy or other record of the communication, and

(b) anything enclosed with or referred to in the communication if made as described in sub-paragraph (1)(b) or in sub-paragraph (2)(b) and (c).

(5) In sub-paragraphs (1) to (3), the references to the client of a professional legal adviser include a person acting on behalf of such a client.

Matters exempt from inspection and seizure: Parliamentary privilege

12

The powers of inspection and seizure conferred by a warrant issued under this Schedule are not exercisable where their exercise would involve an infringement of the privileges of either House of Parliament.

Partially exempt material

13

(1) This paragraph applies if a person in occupation of premises in respect of which a warrant is issued under this Schedule objects to the inspection or seizure of any material under the warrant on the grounds that it consists partly of matters in respect of which those powers are not exercisable.

(2) The person must, if the person executing the warrant so requests, provide that person with a copy of so much of the material as is not exempt from those powers.

Return of warrants

14

(1) Where a warrant issued under this Schedule is executed—

(a) it must be returned to the court from which it was issued after being executed, and

(b) the person by whom it is executed must write on the warrant a statement of the powers that have been exercised under the warrant.

(2) Where a warrant issued under this Schedule is not executed, it must be returned to the court from which it was issued within the time authorised for its execution.

Offences

15

(1) It is an offence for a person—

(a) intentionally to obstruct a person in the execution of a warrant issued under this Schedule, or

(b) to fail without reasonable excuse to give a person executing such a warrant such assistance as the person may reasonably require for the execution of the warrant.

(2) It is an offence for a person—

(a) to make a statement in response to a requirement under paragraph 5(2)(c) or (d) or (3)(c) or (d) which the person knows to be false in a material respect, or

(b) recklessly to make a statement in response to such a requirement which is false in a material respect.

Self-incrimination

16

(1) An explanation given, or information provided, by a person in response to a requirement under paragraph 5(2)(c) or (d) or (3)(c) or (d) may only be used in evidence against that person—

(a) on a prosecution for an offence under a provision listed in sub-paragraph (2), or

(b) on a prosecution for any other offence where—

(i) in giving evidence that person makes a statement inconsistent with that explanation or information, and

(ii) evidence relating to that explanation or information is adduced, or a question relating to it is asked, by that person or on that person's behalf.

(2) Those provisions are—

(a) paragraph 15,

(b) section 5 of the Perjury Act 1911 (false statements made otherwise than on oath),

(c) section 44(2) of the Criminal Law (Consolidation) (Scotland) Act 1995 (false statements made otherwise than on oath), or

(d) Article 10 of the Perjury (Northern Ireland) Order 1979 (S.I. 1979/1714 (N.I. 19)) (false statutory declarations and other false unsworn statements).

Vessels, vehicles etc

17

In this Schedule—

(a) “premises” includes a vehicle, vessel or other means of transport, and

(b) references to the occupier of premises include the person in charge of a vehicle, vessel or other means of transport.

Scotland

18

In the application of this Schedule to Scotland—

(a) references to a judge of the High Court have effect as if they were references to a judge of the Court of Session,

(b) references to a circuit judge have effect as if they were references to the sheriff or the summary sheriff,

(d) references to the court from which the warrant was issued have effect as if they were references to the sheriff clerk.

Northern Ireland

19

In the application of this Schedule to Northern Ireland—

(a) references to a circuit judge have effect as if they were references to a county court judge, and

(b) references to information on oath have effect as if they were references to a complaint on oath.

SCHEDULE 16

Meaning of “penalty”

1

In this Schedule, “penalty” means a penalty imposed by a penalty notice.

Notice of intent to impose penalty

2

(1) Before giving a person a penalty notice, the Commissioner must, by written notice (a “notice of intent”) inform the person that the Commissioner intends to give a penalty notice.

(2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Contents of notice of intent

3

(1) A notice of intent must contain the following information—

(a) the name and address of the person to whom the Commissioner proposes to give a penalty notice;

(b) the reasons why the Commissioner proposes to give a penalty notice (see sub-paragraph (2));

(c) an indication of the amount of the penalty the Commissioner proposes to impose, including any aggravating or mitigating factors that the Commissioner proposes to take into account.

(2) The information required under sub-paragraph (1)(b) includes—

(a) a description of the circumstances of the failure, and

(b) where the notice is given in respect of a failure described in section 149(2), the nature of the personal data involved in the failure.

(3) A notice of intent must also—

(a) state that the person may make written representations about the Commissioner's intention to give a penalty notice, and

(b) specify the period within which such representations may be made.

(4) The period specified for making written representations must be a period of not less than 21 days beginning when the notice of intent is given.

(5) If the Commissioner considers that it is appropriate for the person to have an opportunity to make oral representations about the Commissioner's intention to give a penalty notice, the notice of intent must also—

(a) state that the person may make such representations, and

(b) specify the arrangements for making such representations and the time at which, or the period within which, they may be made.

Giving a penalty notice

4

(A1) This paragraph applies where the Commissioner gives a notice of intent to a person.

(A2) Within the period of 6 months beginning when the notice is given, or as soon as reasonably practicable thereafter, the Commission must give to the person—

(a) a penalty notice, or

(b) written notice that the Commissioner has decided not to give a penalty notice to the person.

(1) But the Commissioner may not give a penalty notice to the person before a time, or before the end of a period, specified in the notice of intent for making oral or written representations.

(2) When deciding whether to give a penalty notice to the person and determining the amount of the penalty, the Commissioner must consider any oral or written representations made by the person in accordance with the notice of intent.

Contents of penalty notice

5

(1) A penalty notice must contain the following information—

(a) the name and address of the person to whom it is addressed;

(b) details of the notice of intent given to the person;

(d) the reasons why the Commissioner proposes to impose the penalty (see sub-paragraph (2));

(e) the reasons for the amount of the penalty, including any aggravating or mitigating factors that the Commissioner has taken into account;

(f) details of how the penalty is to be paid;

(g) details of the rights of appeal under section 162;

(h) details of the Commissioner's enforcement powers under this Schedule.

(2) The information required under sub-paragraph (1)(d) includes—

(a) a description of the circumstances of the failure, and

(b) where the notice is given in respect of a failure described in section 149(2), the nature of the personal data involved in the failure.

Period for payment of penalty

6

(1) A penalty must be paid to the Commissioner within the period specified in the penalty notice.

(2) The period specified must be a period of not less than 28 days beginning when the penalty notice is given.

Variation of penalty

7

(1) The Commissioner may vary a penalty notice by giving written notice (a “penalty variation notice”) to the person to whom it was given.

(2) A penalty variation notice must specify—

(a) the penalty notice concerned, and

(b) how it is varied.

(3) A penalty variation notice may not—

(a) reduce the period for payment of the penalty;

(b) increase the amount of the penalty;

(4) If—

(a) a penalty variation notice reduces the amount of the penalty, and

(b) when that notice is given, an amount has already been paid that exceeds the amount of the reduced penalty,

the Commissioner must repay the excess.

Cancellation of penalty

8

(1) The Commissioner may cancel a penalty notice by giving written notice to the person to whom it was given.

(2) If a penalty notice is cancelled, the Commissioner—

(a) may not take any further action under section 155 or this Schedule in relation to the failure to which that notice relates, and

(b) must repay any amount that has been paid in accordance with that notice.

Enforcement of payment

9

(1) The Commissioner must not take action to recover a penalty unless—

(a) the period specified in accordance with paragraph 6 has ended,

(b) any appeals against the penalty notice have been decided or otherwise ended,

(c) if the penalty notice has been varied, any appeals against the penalty variation notice have been decided or otherwise ended, and

(d) the period for the person to whom the penalty notice was given to appeal against the penalty, and any variation of it, has ended.

(2) In England and Wales, a penalty is recoverable—

(a) if the county court so orders, as if it were payable under an order of that court;

(b) if the High Court so orders, as if it were payable under an order of that court.

(3) In Scotland, a penalty may be enforced in the same manner as an extract registered decree arbitral bearing a warrant for execution issued by the sheriff court of any sheriffdom in Scotland.

(4) In Northern Ireland, a penalty is recoverable—

(a) if a county court so orders, as if it were payable under an order of that court;

(b) if the High Court so orders, as if it were payable under an order of that court.

SCHEDULE 17

Interpretation

1

In this Schedule—

“relevant period” means—the period of 18 months beginning when the Commissioner starts the first review under section 178, andthe period of 12 months beginning when the Commissioner starts a subsequent review under that section;

“the relevant review”, in relation to a relevant period, means the review under section 178 which the Commissioner must produce a report about by the end of that period.

Information notices

2

(1) This paragraph applies where the Commissioner gives an information notice during a relevant period.

(2) If the information notice—

(a) states that, in the Commissioner's opinion, the information is required for the purposes of the relevant review, and

(b) gives the Commissioner's reasons for reaching that opinion,

subsections (5) and (6) of section 142 do not apply but the notice must not require the information to be provided before the end of the period of 24 hours beginning when the notice is given.

Assessment notices

3

(1) Sub-paragraph (2) applies where the Commissioner gives an assessment notice to a person during a relevant period.

(2) If the assessment notice—

(a) states that, in the Commissioner's opinion, it is necessary for the controller or processor to comply with a requirement in the notice for the purposes of the relevant review, and

(b) gives the Commissioner's reasons for reaching that opinion,

subsections (6) and (7) of section 146 do not apply but the notice must not require the controller or processor to comply with the requirement before the end of the period of 7 days beginning when the notice is given.

(3) During a relevant period, section 147 has effect as if for subsection (5) there were substituted—

(5) The Commissioner may not give a controller or processor an assessment notice with respect to the processing of personal data for the special purposes unless a determination under section 174 with respect to the data or the processing has taken effect.

Applications in respect of urgent notices

4

Section 164 applies where an information notice , assessment notice or interview notice contains a statement under paragraph 2(2)(a) , 3(2)(a) or 3A(2)(a) as it applies where such a notice contains a statement under section 142(7)(a) , 146(8)(a) or 148A(8)(a).

SCHEDULE 18

Relevant records

1

(1) In section 184, “relevant record” means—

(a) a relevant health record (see paragraph 2),

(b) a relevant record relating to a conviction or caution (see paragraph 3), or

(2) A record is not a “relevant record” to the extent that it relates, or is to relate, only to personal data which falls within Article 2(1A) of the UK GDPR (manual unstructured personal data held by FOI public authorities).

Relevant health records

2

“Relevant health record” means a health record which has been or is to be obtained by a data subject in the exercise of a data subject access right.

Relevant records relating to a conviction or caution

3

(1) “Relevant record relating to a conviction or caution” means a record which—

(a) has been or is to be obtained by a data subject in the exercise of a data subject access right from a person listed in sub-paragraph (2), and

(b) contains information relating to a conviction or caution.

(2) Those persons are—

(a) the chief constable of a police force maintained under section 2 of the Police Act 1996;

(b) the Commissioner of Police of the Metropolis;

(d) the Chief Constable of the Police Service of Northern Ireland;

(e) the chief constable of the Police Service of Scotland;

(f) the Director General of the National Crime Agency;

(fa) the Independent Commission for Reconciliation and Information Recovery;

(g) the Secretary of State.

(3) In this paragraph—

“caution” means a caution given to a person in England and Wales or Northern Ireland in respect of an offence which, at the time when the caution is given, is admitted;

“conviction” has the same meaning as in the Rehabilitation of Offenders Act 1974 or the Rehabilitation of Offenders (Northern Ireland) Order 1978 (S.I. 1978/1908 (N.I. 27)).

Relevant records relating to statutory functions

4

(1) “Relevant record relating to statutory functions” means a record which—

(a) has been or is to be obtained by a data subject in the exercise of a data subject access right from a person listed in sub-paragraph (2), and

(b) contains information relating to a relevant function in relation to that person.

(2) Those persons are—

(a) the Secretary of State;

(b) the Department for Communities in Northern Ireland;

(d) the Scottish Ministers;

(e) the Disclosure and Barring Service;

(f) the independent reviewer appointed under section 12 of the Age of Criminal Responsibility (Scotland) Act 2019.

(3) In relation to the Secretary of State, the “relevant functions” are—

(a) the Secretary of State's functions in relation to a person sentenced to detention under—

(i) section 92 of the Powers of Criminal Courts (Sentencing) Act 2000,

(ia) section 260 of the Sentencing Code,

(ii) section 205(2) or 208 of the Criminal Procedure (Scotland) Act 1995, or

(iii) Article 45 of the Criminal Justice (Children) (Northern Ireland) Order 1998 (S.I. 1998/1504 (N.I. 9));

(b) the Secretary of State's functions in relation to a person imprisoned or detained under—

(i) the Prison Act 1952,

(ii) the Prisons (Scotland) Act 1989, or

(iii) the Prison Act (Northern Ireland) 1953 (c. 18 (N.I.));

(i) the Social Security Contributions and Benefits Act 1992,

(ii) the Social Security Administration Act 1992,

(iii) the Jobseekers Act 1995,

(iv) Part 5 of the Police Act 1997,

(v) Part 1 of the Welfare Reform Act 2007, or

(vi) Part 1 of the Welfare Reform Act 2012.

(4) In relation to the Department for Communities in Northern Ireland, the “relevant functions” are its functions under—

(a) the Social Security Contributions and Benefits (Northern Ireland) Act 1992,

(b) the Social Security Administration (Northern Ireland) Act 1992,

(d) Part 1 of the Welfare Reform Act (Northern Ireland) 2007 (c. 2 (N.I.)).

(5) In relation to the Department of Justice in Northern Ireland, the “relevant functions” are its functions under Part 5 of the Police Act 1997.

(6) In relation to the Scottish Ministers, the “relevant functions” are their functions under

(a) Part 1 of the Disclosure (Scotland) Act 2020, or

(b) Parts 1 and 2 of the Protection of Vulnerable Groups (Scotland) Act 2007 (asp 14).

(7) In relation to the Disclosure and Barring Service, the “relevant functions” are its functions under—

(a) Part 5 of the Police Act 1997,

(b) the Safeguarding Vulnerable Groups Act 2006, or

(8) In relation to the independent reviewer mentioned in sub-paragraph (2)(f), the “relevant functions” are the reviewer’s functions under Part 2 of the Age of Criminal Responsibility (Scotland) Act 2019.

Data subject access right

5

In this Schedule, “data subject access right” means a right under—

(a) Article 15 of the UK GDPR (right of access by the data subject);

(b) Article 20 of the UK GDPR (right to data portability);

(d) section 94 of this Act (intelligence services processing: right of access by the data subject).

Records stating that personal data is not processed

6

For the purposes of this Schedule, a record which states that a controller is not processing personal data relating to a particular matter is to be taken to be a record containing information relating to that matter.

Power to amend

7

(1) The Secretary of State may by regulations amend this Schedule.

(2) Regulations under this paragraph are subject to the affirmative resolution procedure.

SCHEDULE 19

PART 1 — Amendments of primary legislation

Registration Service Act 1953 (c. 37)

1

(1) Section 19AC of the Registration Service Act 1953 (codes of practice) is amended as follows.

(2) In subsection (2), for “issued under section 52B (data-sharing code) of the Data Protection Act 1998” substitute “ prepared under section 121 of the Data Protection Act 2018 (data-sharing code) and issued under section 125(4) of that Act ”.

(3) In subsection (11), for “section 51(3) of the Data Protection Act 1998” substitute “ section 128 of the Data Protection Act 2018 ”.

Veterinary Surgeons Act 1966 (c. 36)

2

(1) Section 1A of the Veterinary Surgeons Act 1966 (functions of the Royal College of Veterinary Surgeons as competent authority) is amended as follows.

(2) In subsection (8)—

(a) omit “personal data protection legislation in the United Kingdom that implements”,

(b) for paragraph (a) substitute—

(a) the GDPR; and

, and

(3) In subsection (9), after “section” insert

— “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018;

Parliamentary Commissioner Act 1967 (c. 13)

3

In section 11AA(1) of the Parliamentary Commissioner Act 1967 (disclosure of information by Parliamentary Commissioner to Information Commissioner)—

(a) in paragraph (a), for sub-paragraph (i) substitute—

(i) sections 142 to 154, 160 to 164 or 174 to 176 of, or Schedule 15 to, the Data Protection Act 2018 (certain provisions relating to enforcement),

, and

(b) for paragraph (b) substitute—

(b) the commission of an offence under— (i) a provision of the Data Protection Act 2018 other than paragraph 15 of Schedule 15 (obstruction of execution of warrant etc), or (ii) section 77 of the Freedom of Information Act 2000 (offence of altering etc records with intent to prevent disclosure).

Local Government Act 1974 (c. 7)

4

The Local Government Act 1974 is amended as follows.

5

In section 33A(1) (disclosure of information by Local Commissioner to Information Commissioner)—

(a) in paragraph (a), for sub-paragraph (i) substitute—

(i) sections 142 to 154, 160 to 164 or 174 to 176 of, or Schedule 15 to, the Data Protection Act 2018 (certain provisions relating to enforcement),

, and

(b) for paragraph (b) substitute—

(b) the commission of an offence under— (i) a provision of the Data Protection Act 2018 other than paragraph 15 of Schedule 15 (obstruction of execution of warrant etc), or (ii) section 77 of the Freedom of Information Act 2000 (offence of altering etc records with intent to prevent disclosure).

6

In section 34O(1) (disclosure of information by Local Commissioner to Information Commissioner)—

(a) in paragraph (a), for sub-paragraph (i) substitute—

(i) sections 142 to 154, 160 to 164 or 174 to 176 of, or Schedule 15 to, the Data Protection Act 2018 (certain provisions relating to enforcement),

, and

(b) for paragraph (b) substitute—

(b) the commission of an offence under— (i) a provision of the Data Protection Act 2018 other than paragraph 15 of Schedule 15 (obstruction of execution of warrant etc), or (ii) section 77 of the Freedom of Information Act 2000 (offence of altering etc records with intent to prevent disclosure).

Consumer Credit Act 1974 (c. 39)

7

The Consumer Credit Act 1974 is amended as follows.

8

In section 157(2A) (duty to disclose name etc of agency)—

(a) in paragraph (a), for “the Data Protection Act 1998” substitute “ the GDPR ”, and

(b) in paragraph (b), after “any” insert “ other ”.

9

In section 159(1)(a) (correction of wrong information) for “section 7 of the Data Protection Act 1998” substitute “ Article 15(1) to (3) of the GDPR (confirmation of processing, access to data and safeguards for third country transfers) ”.

10

In section 189(1) (definitions), at the appropriate place insert—

“the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act);

Pharmacy (Northern Ireland) Order 1976 (S.I. 1976/1213 (N.I. 22))

11

The Pharmacy (Northern Ireland) Order 1976 is amended as follows.

12

In article 2(2) (interpretation), omit the definition of “Directive 95/46/EC”.

13

In article 8D (European professional card), after paragraph (3) insert—

(4) In Schedule 2C, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018.

14

In article 22A(6) (Directive 2005/36/EC: functions of competent authority etc.), before sub-paragraph (a) insert—

(za) “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018;

15

(1) Schedule 2C (Directive 2005/36/EC: European professional card) is amended as follows.

(2) In paragraph 8(1) (access to data), for “Directive 95/46/EC” substitute “ the GDPR ”.

(3) In paragraph 9 (processing data), omit sub-paragraph (2) (deeming the Society to be the controller for the purposes of Directive 95/46/EC).

16

(1) The table in Schedule 2D (functions of the Society under Directive 2005/36/EC) is amended as follows.

(2) In the entry for Article 56(2), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.

(3) In the entry for Article 56a(4), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.

17

(1) Paragraph 2 of Schedule 3 (fitness to practice: disclosure of information) is amended as follows.

(2) In sub-paragraph (2)(a), after “provision” insert “ or the GDPR ”.

(3) For sub-paragraph (3) substitute—

(3) In determining for the purposes of sub-paragraph (2)(a) whether a disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this paragraph.

(4) After sub-paragraph (4) insert—

(5) In this paragraph, “the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).

Representation of the People Act 1983 (c. 2)

18

(1) Schedule 2 to the Representation of the People Act 1983 (provisions which may be contained in regulations as to registration etc) is amended as follows.

(2) In paragraph 1A(5), for “the Data Protection Act 1998” substitute “ Parts 5 to 7 of the Data Protection Act 2018 (see section 3(4) and (14) of that Act) ”.

(3) In paragraph 8C(2), for “the Data Protection Act 1998” substitute “ Parts 5 to 7 of the Data Protection Act 2018 (see section 3(4) and (14) of that Act) ”.

(4) In paragraph 11A—

(a) in sub-paragraph (1) for “who are data users to supply data, or documents containing information extracted from data and” substitute “ to supply information ”, and

(b) omit sub-paragraph (2).

Medical Act 1983 (c. 54)

19

The Medical Act 1983 is amended as follows.

20

(1) Section 29E (evidence) is amended as follows.

(2) In subsection (5), after “enactment” insert “ or the GDPR ”.

(3) For subsection (7) substitute—

(7) In determining for the purposes of subsection (5) whether a disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this section.

(4) In subsection (9), at the end insert—

“the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).

21

(1) Section 35A (General Medical Council's power to require disclosure of information) is amended as follows.

(2) In subsection (4), after “enactment” insert “ or the GDPR ”.

(3) For subsection (5A) substitute—

(5A) In determining for the purposes of subsection (4) whether a disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this section.

(4) In subsection (7), at the end insert—

“the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).

22

In section 49B(7) (Directive 2005/36: designation of competent authority etc.), after “Schedule 4A” insert

— “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018;

23

In section 55(1) (interpretation), omit the definition of “Directive 95/46/EC”.

24

(1) Paragraph 9B of Schedule 1 (incidental powers of the General Medical Council) is amended as follows.

(2) In sub-paragraph (2)(a), after “enactment” insert “ or the GPDR ”.

(3) After sub-paragraph (3) insert—

(4) In this paragraph, “the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act).

25

(1) Paragraph 5A of Schedule 4 (professional performance assessments and health assessments) is amended as follows.

(2) In sub-paragraph (8), after “enactment” insert “ or the GDPR ”.

(3) For sub-paragraph (8A) substitute—

(8A) In determining for the purposes of sub-paragraph (8) whether a disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this paragraph.

(4) After sub-paragraph (13) insert—

(14) In this paragraph, “the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).

26

(1) The table in Schedule 4A (functions of the General Medical Council as competent authority under Directive 2005/36) is amended as follows.

(2) In the entry for Article 56(2), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.

(3) In the entry for Article 56a(4), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.

Dentists Act 1984 (c. 24)

27

The Dentists Act 1984 is amended as follows.

28

(1) Section 33B (the General Dental Council's power to require disclosure of information: the dental profession) is amended as follows.

(2) In subsection (3), after “enactment” insert “ or relevant provision of the GDPR ”.

(3) For subsection (4) substitute—

(4) For the purposes of subsection (3)— - “relevant enactment” means any enactment other than— 1. this Act, or 2. the listed provisions in paragraph 1 of Schedule 11 to the Data Protection Act 2018 (exemptions to Part 4 : disclosures required by law); - “relevant provision of the GDPR” means any provision of the GDPR apart from the listed GDPR provisions in paragraph 1 of Schedule 2 to the Data Protection Act 2018 (GDPR provisions to be adapted or restricted: disclosures required by law).

(4) After subsection (10) insert—

(11) In this section, “the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).

29

In section 36ZA(6) (Directive 2005/36: designation of competent authority etc), after “Schedule 4ZA—” insert—

“the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018;

30

(1) Section 36Y (the General Dental Council's power to require disclosure of information: professions complementary to dentistry) is amended as follows.

(2) In subsection (3), after “enactment” insert “ or relevant provision of the GDPR ”.

(3) For subsection (4) substitute—

(4) For the purposes of subsection (3)— - “relevant enactment” means any enactment other than— 1. this Act, or 2. the listed provisions in paragraph 1 of Schedule 11 to the Data Protection Act 2018 (exemptions to Part 4 : disclosures required by law); - “relevant provision of the GDPR” means any provision of the GDPR apart from the listed GDPR provisions in paragraph 1 of Schedule 2 to the Data Protection Act 2018 (GDPR provisions to be adapted or restricted: disclosures required by law).

(4) After subsection (10) insert—

(11) In this section, “the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).

31

In section 53(1) (interpretation), omit the definition of “Directive 95/46/EC”.

32

(1) The table in Schedule 4ZA (Directive 2005/36: functions of the General Dental Council under section 36ZA(3)) is amended as follows.

(2) In the entry for Article 56(2), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.

(3) In the entry for Article 56a(4), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.

Companies Act 1985 (c. 6)

33

In section 449(11) of the Companies Act 1985 (provision for security of information obtained), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

Access to Medical Reports Act 1988 (c. 28)

34

In section 2(1) of the Access to Medical Reports Act 1988 (interpretation), for the definition of “health professional” substitute—

“health professional” has the same meaning as in the Data Protection Act 2018 (see section 204 of that Act);

Opticians Act 1989 (c. 44)

35

(1) Section 13B of the Opticians Act 1989 (the Council's power to require disclosure of information) is amended as follows.

(2) In subsection (3), after “enactment” insert “ or the GDPR ”.

(3) For subsection (4) substitute—

(4) In determining for the purposes of subsection (3) whether a disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this section.

(4) After subsection (9) insert—

(10) In this section, “the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).

Access to Health Records Act 1990 (c. 23)

36

The Access to Health Records Act 1990 is amended as follows.

37

For section 2 substitute—

(2) In this Act, “health professional” has the same meaning as in the Data Protection Act 2018 (see section 204 of that Act).

38

(1) Section 3 (right of access to health records) is amended as follows.

(2) In subsection (2), omit “Subject to subsection (4) below,”.

(3) In subsection (4), omit from “other than the following” to the end.

Human Fertilisation and Embryology Act 1990 (c. 37)

39

(1) Section 33D of the Human Fertilisation and Embryology Act 1990 (disclosure for the purposes of medical or other research) is amended as follows.

(2) In subsection (6), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) In subsection (9), at the appropriate place insert—

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Trade Union and Labour Relations (Consolidation) Act 1992 (c. 52)

40

(1) Section 251B of the Trade Union and Labour Relations (Consolidation) Act 1992 (prohibition on disclosure of information) is amended as follows.

(2) In subsection (3), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) After subsection (6) insert—

(7) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Tribunals and Inquiries Act 1992 (c. 53)

41

In the table in Part 1 of Schedule 1 to the Tribunals and Inquiries Act 1992 (tribunals to which the Act applies), in the second column, in paragraph 14(a), for “section 6 of the Data Protection Act 1998” substitute “ section 114 of the Data Protection Act 2018 ”.

Industrial Relations (Northern Ireland) Order 1992 (S.I. 1992/807 (N.I. 5))

42

(1) Article 90B of the Industrial Relations (Northern Ireland) Order 1992 (prohibition on disclosure of information held by the Labour Relations Agency) is amended as follows.

(2) In paragraph (3), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) After paragraph (6) insert—

(7) In this Article, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Health Service Commissioners Act 1993 (c. 46)

43

In section 18A(1) of the Health Service Commissioners Act 1993 (power to disclose information)—

(a) in paragraph (a), for sub-paragraph (i) substitute—

(i) sections 142 to 154, 160 to 164 or 174 to 176 of, or Schedule 15 to, the Data Protection Act 2018 (certain provisions relating to enforcement),

, and

(b) for paragraph (b) substitute—

(b) the commission of an offence under— (i) a provision of the Data Protection Act 2018 other than paragraph 15 of Schedule 15 (obstruction of execution of warrant etc), or (ii) section 77 of the Freedom of Information Act 2000 (offence of altering etc records with intent to prevent disclosure).

Data Protection Act 1998 (c. 29)

44

The Data Protection Act 1998 is repealed, with the exception of section 62 and paragraphs 13, 15, 16, 18 and 19 of Schedule 15 (which amend other enactments).

Crime and Disorder Act 1998 (c. 37)

45

In section 17A(4) of the Crime and Disorder Act 1998 (sharing of information), for “(within the meaning of the Data Protection Act 1998)” substitute “ (within the meaning of Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act)) ”.

Food Standards Act 1999 (c. 28)

46

(1) Section 19 of the Food Standards Act 1999 (publication etc by the Food Standards Agency of advice and information) is amended as follows.

(2) In subsection (2), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) In subsection (8), after “section” insert

— “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

Immigration and Asylum Act 1999 (c. 33)

47

(1) Section 13 of the Immigration and Asylum Act 1999 (proof of identity of persons to be removed or deported) is amended as follows.

(2) For subsection (4) substitute—

(4) For the purposes of Article 49(1)(d) of the GDPR, the provision under this section of identification data is a transfer of personal data which is necessary for important reasons of public interest.

(3) After subsection (4) insert—

(4A) “The GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act).

Financial Services and Markets Act 2000 (c. 8)

48

The Financial Services and Markets Act 2000 is amended as follows.

49

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

50

In section 391A(6)(b) (publication: special provisions relating to the capital requirements directive), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

51

In section 391C(7)(a) (publication: special provisions relating to the UCITS directive), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

52

In section 391D(9)(a) (publication: special provisions relating to the markets in financial instruments directive), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

53

In section 417 (definitions), at the appropriate place insert—

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

Terrorism Act 2000 (c. 11)

54

In section 21F(2)(d) of the Terrorism Act 2000 (other permitted disclosures between institutions etc) for “(within the meaning of section 1 of the Data Protection Act 1998)” substitute “ (within the meaning of Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act)) ”.

Freedom of Information Act 2000 (c. 36)

55

The Freedom of Information Act 2000 is amended as follows.

56

In section 2(3) (absolute exemptions), for paragraph (f) substitute—

(f) section 40(1), (fa) section 40(2) so far as relating to cases where the first condition referred to in that subsection is satisfied,

57

In section 18 (the Information Commissioner), omit subsection (1).

58

(1) Section 40 (personal information) is amended as follows.

(2) In subsection (2)—

(a) in paragraph (a), for “do” substitute “ does ”, and

(b) in paragraph (b), for “either the first or the second” substitute “ the first, second or third ”.

(3) For subsection (3) substitute—

(3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act— (a) would contravene any of the data protection principles, or (b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded. (3B) The second condition is that the disclosure of the information to a member of the public otherwise than under this Act would contravene Article 21 of the GDPR (general processing: right to object to processing).

(4) For subsection (4) substitute—

(4A) The third condition is that— (a) on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018, or (b) on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section.

(5) For subsection (5) substitute—

(5A) The duty to confirm or deny does not arise in relation to information which is (or if it were held by the public authority would be) exempt information by virtue of subsection (1). (5B) The duty to confirm or deny does not arise in relation to other information if or to the extent that any of the following applies— (a) giving a member of the public the confirmation or denial that would have to be given to comply with section 1(1)(a)— (i) would (apart from this Act) contravene any of the data protection principles, or (ii) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded; (b) giving a member of the public the confirmation or denial that would have to be given to comply with section 1(1)(a) would (apart from this Act) contravene Article 21 of the GDPR (general processing: right to object to processing); (c) on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for confirmation of whether personal data is being processed, the information would be withheld in reliance on a provision listed in subsection (4A)(a); (d) on a request under section 45(1)(a) of the Data Protection Act 2018 (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section.

(6) Omit subsection (6).

(7) For subsection (7) substitute—

(7) In this section— - “the data protection principles” means the principles set out in— 1. Article 5(1) of the GDPR, and 2. section 34(1) of the Data Protection Act 2018; - “data subject” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act); - “the GDPR”, “personal data”, “processing” and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(2), (4), (10), (11) and (14) of that Act). (8) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.

59

Omit section 49 (reports to be laid before Parliament).

60

For section 61 (appeal proceedings) substitute—

(61) (1) Tribunal Procedure Rules may make provision for regulating the exercise of rights of appeal conferred by sections 57(1) and (2) and 60(1) and (4). (2) In relation to appeals under those provisions, Tribunal Procedure Rules may make provision about— (a) securing the production of material used for the processing of personal data, and (b) the inspection, examination, operation and testing of equipment or material used in connection with the processing of personal data. (3) Subsection (4) applies where— (a) a person does something, or fails to do something, in relation to proceedings before the First-tier Tribunal on an appeal under those provisions, and (b) if those proceedings were proceedings before a court having power to commit for contempt, the act or omission would constitute contempt of court. (4) The First-tier Tribunal may certify the offence to the Upper Tribunal. (5) Where an offence is certified under subsection (4), the Upper Tribunal may— (a) inquire into the matter, and (b) deal with the person charged with the offence in any manner in which it could deal with the person if the offence had been committed in relation to the Upper Tribunal. (6) Before exercising the power under subsection (5)(b), the Upper Tribunal must— (a) hear any witness who may be produced against or on behalf of the person charged with the offence, and (b) hear any statement that may be offered in defence. (7) In this section, “personal data” and “processing” have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) and (14) of that Act).

61

In section 76(1) (disclosure of information between Commissioner and ombudsmen), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

62

After section 76A insert—

(76B) (1) No enactment or rule of law prohibiting or restricting the disclosure of information precludes a person from providing the First-tier Tribunal or the Upper Tribunal with information necessary for the discharge of their functions in connection with appeals under section 60 of this Act. (2) But this section does not authorise the making of a disclosure which is prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016. (3) Until the repeal of Part 1 of the Regulation of Investigatory Powers Act 2000 by paragraphs 45 and 54 of Schedule 10 to the Investigatory Powers Act 2016 is fully in force, subsection (2) has effect as if it included a reference to that Part.

63

In section 77(1)(b) (offence of altering etc records with intent to prevent disclosure), omit “or section 7 of the Data Protection Act 1998,”.

64

In section 84 (interpretation), at the appropriate place insert—

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

Political Parties, Elections and Referendums Act 2000 (c. 41)

65

(1) Paragraph 28 of Schedule 19C to the Political Parties, Elections and Referendums Act 2000 (civil sanctions: disclosure of information) is amended as follows.

(2) In sub-paragraph (4)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) After sub-paragraph (5) insert—

(6) In this paragraph, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Public Finance and Accountability (Scotland) Act 2000 (asp 1)

66

The Public Finance and Accountability (Scotland) Act 2000 is amended as follows.

67

In section 26B(3)(a) (voluntary disclosure of data to Audit Scotland), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

68

In section 26C(3)(a) (power to require disclosure of data), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

69

In section 29(1) (interpretation), at the appropriate place insert—

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

Criminal Justice and Police Act 2001 (c. 16)

70

The Criminal Justice and Police Act 2001 is amended as follows.

71

In section 57(1) (retention of seized items)—

(a) omit paragraph (m), and

(b) after paragraph (s) insert—

(t) paragraph 10 of Schedule 15 to the Data Protection Act 2018;

72

In section 65(7) (meaning of “legal privilege”)—

(a) for “paragraph 1 of Schedule 9 to the Data Protection Act 1998 (c. 29)” substitute “ paragraphs 1 and 2 of Schedule 15 to the Data Protection Act 2018 ”, and

(b) for “paragraph 9” substitute “ paragraph 11 (matters exempt from inspection and seizure: privileged communications) ”.

73

In Schedule 1 (powers of seizure)—

(a) omit paragraph 65, and

(b) after paragraph 73T insert—

(73T) The power of seizure conferred by paragraphs 1 and 2 of Schedule 15 to the Data Protection Act 2018 (powers of entry and inspection).

Anti-terrorism, Crime and Security Act 2001 (c.24)

74

The Anti-terrorism, Crime and Security Act 2001 is amended as follows.

75

(1) Section 19 (disclosure of information held by revenue departments) is amended as follows.

(2) In subsection (7), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) In subsection (9), after “section” insert

— “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

76

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Health and Personal Social Services Act (Northern Ireland) 2001 (c. 3 (N.I.))

77

(1) Section 7A of the Health and Personal Social Services Act (Northern Ireland) 2001 (power to obtain information etc) is amended as follows.

(2) In subsection (3), after “provision” insert “ or the GDPR ”.

(3) For subsection (5) substitute—

(5) In determining for the purposes of subsection (3) whether a disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this section.

(4) After subsection (7) insert—

(8) In this section, “the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).

Justice (Northern Ireland) Act 2002 (c. 26)

78

(1) Section 5A of the Justice (Northern Ireland) Act 2002 (disclosure of information to the Commission) is amended as follows.

(2) In subsection (3)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) After subsection (9) insert—

(10) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Proceeds of Crime Act 2002 (c. 29)

79

The Proceeds of Crime Act 2002 is amended as follows.

80

In section 333C(2)(d) (other permitted disclosures between institutions etc), for “(within the meaning of section 1 of the Data Protection Act 1998)” substitute “ (within the meaning of Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act)) ”.

81

In section 436(3)(a) (disclosure of information to certain Directors), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

82

In section 438(8)(a) (disclosure of information by certain Directors), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

83

In section 439(3)(a) (disclosure of information to Lord Advocate and to Scottish Ministers), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

84

In section 441(7)(a) (disclosure of information by Lord Advocate and Scottish Ministers), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

85

After section 442 insert—

(442A) In this Part, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Enterprise Act 2002 (c. 40)

86

(1) Section 237 of the Enterprise Act 2002 (general restriction on disclosure) is amended as follows.

(2) In subsection (4), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) After subsection (6) insert—

(7) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Scottish Public Services Ombudsman Act 2002 (asp 11)

87

(1) In Schedule 5 to the Scottish Public Services Ombudsman Act 2002 (disclosure of information by the Ombudsman), the entry for the Information Commissioner is amended as follows.

(2) In paragraph 1, for sub-paragraph (a) substitute—

(a) sections 142 to 154, 160 to 164 or 174 to 176 of, or Schedule 15 to, the Data Protection Act 2018 (certain provisions relating to enforcement),

(3) For paragraph 2 substitute—

(2) The commission of an offence under— (a) a provision of the Data Protection Act 2018 other than paragraph 15 of Schedule 15 (obstruction of execution of warrant etc), or (b) section 77 of the Freedom of Information Act 2000 (offence of altering etc records with intent to prevent disclosure).

Freedom of Information (Scotland) Act 2002 (asp 13)

88

The Freedom of Information (Scotland) Act 2002 is amended as follows.

89

In section 2(2)(e)(ii) (absolute exemptions), omit “by virtue of subsection (2)(a)(i) or (b) of that section”.

90

(1) Section 38 (personal information) is amended as follows.

(2) In subsection (1), for paragraph (b) substitute—

(b) personal data and the first, second or third condition is satisfied (see subsections (2A) to (3A));

(3) For subsection (2) substitute—

(2A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act— (a) would contravene any of the data protection principles, or (b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded. (2B) The second condition is that the disclosure of the information to a member of the public otherwise than under this Act would contravene Article 21 of the GDPR (general processing: right to object to processing).

(4) For subsection (3) substitute—

(3A) The third condition is that— (a) on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018, or (b) on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section.

(5) Omit subsection (4).

(6) In subsection (5), for the definitions of “the data protection principles” and of “data subject” and “personal data” substitute—

“the data protection principles” means the principles set out in— (a) Article 5(1) of the GDPR, and (b) section 34(1) of the Data Protection Act 2018; “data subject” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act); “the GDPR”, “personal data”, “processing” and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(2), (4), (10), (11) and (14) of that Act);

(7) After that subsection insert—

(5A) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.

Courts Act 2003 (c. 39)

91

Schedule 5 to the Courts Act 2003 (collection of fines) is amended as follows.

92

(1) Paragraph 9C (disclosure of information in connection with making of attachment of earnings orders or applications for benefit deductions: supplementary) is amended as follows.

(2) In sub-paragraph (5), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) After sub-paragraph (5) insert—

(6) In this paragraph, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

93

(1) Paragraph 10A (attachment of earnings orders (Justice Act (Northern Ireland) 2016): disclosure of information) is amended as follows.

(2) In sub-paragraph (7), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) In sub-paragraph (8), at the appropriate place insert—

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

Sexual Offences Act 2003 (c. 42)

94

(1) Section 94 of the Sexual Offences Act 2003 (Part 2: supply of information to the Secretary of State etc for verification) is amended as follows.

(2) In subsection (6), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) In subsection (8), at the appropriate place insert—

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

Criminal Justice Act 2003 (c. 44)

95

The Criminal Justice Act 2003 is amended as follows.

96

In section 327A(9) (disclosure of information about convictions etc of child sex offenders to members of the public), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

97

In section 327B (disclosure of information about convictions etc of child sex offenders to members of the public: interpretation), after subsection (4) insert—

(4A) “The data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Mental Health (Care and Treatment) (Scotland) Act 2003 (asp 13)

98

(1) Section 279 of the Mental Health (Care and Treatment) (Scotland) Act 2003 (information for research) is amended as follows.

(2) In subsection (2), for “research purposes within the meaning given by section 33 of the Data Protection Act 1998 (c. 29) (research, history and statistics)” substitute “ purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics) ”.

(3) After subsection (9) insert—

(10) In this section, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

Public Audit (Wales) Act 2004 (c. 23)

99

(1) Section 64C of the Public Audit (Wales) Act 2004 (voluntary provision of data) is amended as follows.

(2) In subsection (3)(a), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) In subsection (5), at the beginning insert

In this section— “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

Companies (Audit, Investigations and Community Enterprise) Act 2004 (c. 27)

100

The Companies (Audit, Investigations and Community Enterprise) Act 2004 is amended as follows.

101

(1) Section 15A (disclosure of information by tax authorities) is amended as follows.

(2) In subsection (2)—

(a) omit “within the meaning of the Data Protection Act 1998”, and

(b) for “that Act” substitute “ the data protection legislation ”.

(3) After subsection (7) insert—

(8) In this section— - “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act); - “personal data” has the same meaning as in Parts 5 to 7 of that Act (see section 3(2) and (14) of that Act).

102

(1) Section 15D (permitted disclosure of information obtained under compulsory powers) is amended as follows.

(2) In subsection (7), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) After subsection (7) insert—

(8) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Domestic Violence, Crime and Victims Act 2004 (c. 28)

103

(1) Section 54 of the Domestic Violence, Crime and Victims Act 2004 (disclosure of information) is amended as follows.

(2) In subsection (7), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) After subsection (8) insert—

(9) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Children Act 2004 (c. 31)

104

The Children Act 2004 is amended as follows.

105

(1) Section 12 (information databases) is amended as follows.

(2) In subsection (13)(e) for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) After subsection (13) insert—

(14) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

106

(1) Section 29 (information databases: Wales) is amended as follows.

(2) In subsection (14)(e) for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) After subsection (14) insert—

(15) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Constitutional Reform Act 2005 (c. 4)

107

(1) Section 107 of the Constitutional Reform Act 2005 (disclosure of information to the Commission) is amended as follows.

(2) In subsection (3)(a), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) After subsection (9) insert—

(10) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Mental Capacity Act 2005 (c. 9)

108

In section 64 of the Mental Capacity Act 2005 (interpretation), for the definition of “health record” substitute—

“health record” has the same meaning as in the Data Protection Act 2018 (see section 205 of that Act);

Public Services Ombudsman (Wales) Act 2005 (c. 10)

109

(1) Section 34X of the Public Services Ombudsman (Wales) Act 2005 (disclosure of information) is amended as follows.

(2) In subsection (4), for paragraph (a) substitute—

(a) sections 142 to 154, 160 to 164 or 174 to 176 of, or Schedule 15 to, the Data Protection Act 2018 (certain provisions relating to enforcement);

(3) For subsection (5) substitute—

(5) The offences are those under— (a) a provision of the Data Protection Act 2018 other than paragraph 15 of Schedule 15 (obstruction of execution of warrant etc); (b) section 77 of the Freedom of Information Act 2000 (offence of altering etc records with intent to prevent disclosure).

Commissioners for Revenue and Customs Act 2005 (c. 11)

110

(1) Section 22 of the Commissioners for Revenue and Customs Act 2005 (data protection, etc) is amended as follows.

(2) The existing text becomes subsection (1).

(3) In that subsection, in paragraph (a), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(4) After that subsection insert—

(2) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Gambling Act 2005 (c. 19)

111

(1) Section 352 of the Gambling Act 2005 (data protection) is amended as follows.

(2) The existing text becomes subsection (1).

(3) In that subsection, for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(4) After that subsection insert—

(2) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Commissioner for Older People (Wales) Act 2006 (c. 30)

112

(1) Section 18 of the Commissioner for Older People (Wales) Act 2006 (power to disclose information) is amended as follows.

(2) In subsection (7), for paragraph (a) substitute—

(a) sections 142 to 154, 160 to 164 or 174 to 176 of, or Schedule 15 to, the Data Protection Act 2018 (certain provisions relating to enforcement);

(3) For subsection (8) substitute—

(8) The offences are those under— (a) a provision of the Data Protection Act 2018 other than paragraph 15 of Schedule 15 (obstruction of execution of warrant etc); or (b) section 77 of the Freedom of Information Act 2000 (offence of altering etc records with intent to prevent disclosure).

National Health Service Act 2006 (c. 41)

113

The National Health Service Act 2006 is amended as follows.

114

(1) Section 251 (control of patient information) is amended as follows.

(2) In subsection (7), for “made by or under the Data Protection Act 1998 (c 29)” substitute “ of the data protection legislation ”.

(3) In subsection (13), at the appropriate place insert—

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

115

(1) Section 264C (provision and disclosure of information about health service products: supplementary) is amended as follows.

(2) In subsection (2), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) After subsection (3) insert—

(4) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

116

In paragraph 7B(3) of Schedule 1 (further provision about the Secretary of State and services under the Act), for “has the same meaning as in the Data Protection Act 1998” substitute “ has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(4) and (14) of that Act) ”.

National Health Service (Wales) Act 2006 (c. 42)

117

The National Health Service (Wales) Act 2006 is amended as follows.

118

(1) Section 201C (provision of information about medical supplies: supplementary) is amended as follows.

(2) In subsection (2), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) After subsection (3) insert—

(4) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

119

In paragraph 7B(3) of Schedule 1 (further provision about the Welsh Ministers and services under the Act), for “has the same meaning as in the Data Protection Act 1998” substitute “ has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(4) and (14) of that Act) ”.

Companies Act 2006 (c. 46)

120

The Companies Act 2006 is amended as follows.

121

In section 458(2) (disclosure of information by tax authorities)—

(a) for “within the meaning of the Data Protection Act 1998 (c. 29)” substitute “ within the meaning of Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act) ”, and

(b) for “that Act” substitute “ the data protection legislation ”.

122

In section 461(7) (permitted disclosure of information obtained under compulsory powers), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

123

In section 948(9) (restrictions on disclosure) for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

124

In section 1173(1) (minor definitions: general), at the appropriate place insert—

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

125

In section 1224A(7) (restrictions on disclosure), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

126

In section 1253D(3) (restriction on transfer of audit working papers to third countries), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

127

In section 1261(1) (minor definitions: Part 42), at the appropriate place insert—

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

128

In section 1262 (index of defined expressions: Part 42), at the appropriate place insert—

the data protection legislation	section 1261(1)

129

In Schedule 8 (index of defined expressions: general), at the appropriate place insert—

the data protection legislation	section 1173(1)

Tribunals, Courts and Enforcement Act 2007 (c. 15)

130

The Tribunals, Courts and Enforcement Act 2007 is amended as follows.

131

In section 11(5)(b) (right to appeal to Upper Tribunal), for “section 28(4) or (6) of the Data Protection Act 1998 (c. 29)” substitute “ section 27(3) or (5), 79(5) or (7) or 111(3) or (5) of the Data Protection Act 2018 ”.

132

In section 13(8)(a) (right to appeal to the Court of Appeal), for “section 28(4) or (6) of the Data Protection Act 1998 (c. 29)” substitute “ section 27(3) or (5), 79(5) or (7) or 111(3) or (5) of the Data Protection Act 2018 ”.

Statistics and Registration Service Act 2007 (c. 18)

133

The Statistics and Registration Service Act 2007 is amended as follows.

134

(1) Section 45 (information held by HMRC) is amended as follows.

(2) In subsection (4A), for “section 51(3) of the Data Protection Act 1998” substitute “ section 128 of the Data Protection Act 2018 ”.

(3) In subsection (4B), for “the Data Protection Act 1998” substitute “ the Data Protection Act 2018 ”.

135

(1) Section 45A (information held by other public authorities) is amended as follows.

(2) In subsection (8), for “section 51(3) of the Data Protection Act 1998” substitute “ section 128 of the Data Protection Act 2018 ”.

(3) In subsection (9), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(4) In subsection (12)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(5) In subsection 12(c), after the first “legislation” insert “ (which is not part of the data protection legislation) ”.

136

(1) Section 45B(3) (access to information held by Crown bodies etc) is amended as follows.

(2) In paragraph (a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) In paragraph (c), after the first “legislation” insert “ (which is not part of the data protection legislation) ”.

137

(1) Section 45C(13) (power to require disclosures by other public authorities) is amended as follows.

(2) In paragraph (b), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) In paragraph (d), after the first “legislation” insert “ (which is not part of the data protection legislation) ”.

138

In section 45D(9)(b) (power to require disclosure by undertakings), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

139

(1) Section 45E (further provision about powers in sections 45B, 45C and 45D) is amended as follows.

(2) In subsection (6), for “issued under section 52B (data-sharing code) of the Data Protection Act 1998” substitute “ prepared under section 121 of the Data Protection Act 2018 (data-sharing code) and issued under section 125(4) of that Act ”.

(3) In subsection (16), for “section 51(3) of the Data Protection Act 1998” substitute “ section 128 of the Data Protection Act 2018 ”.

(4) In subsection (17), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

140

(1) Section 53A (disclosure by the Statistics Board to devolved administrations) is amended as follows.

(2) In subsection (9), for “section 51(3) of the Data Protection Act 1998” substitute “ section 128 of the Data Protection Act 2018 ”.

(3) In subsection (10), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(4) In subsection (12)(b), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

141

(1) Section 54 (Data Protection Act 1998 and Human Rights Act 1998) is amended as follows.

(2) In the heading, omit “Data Protection Act 1998 and”.

(3) Omit paragraph (a) (together with the final “or”).

142

In section 67 (general interpretation: Part 1), at the appropriate place insert—

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

Serious Crime Act 2007 (c. 27)

143

The Serious Crime Act 2007 is amended as follows.

144

(1) Section 5A (verification and disclosure of information) is amended as follows.

(2) In subsection (6)—

(a) for “the Data Protection Act 1998” substitute “ the data protection legislation ”, and

(b) for “are” substitute “ is ”.

(3) After subsection (6) insert—

(7) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

145

(1) Section 68 (disclosure of information to prevent fraud) is amended as follows.

(2) In subsection (4)(a), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) In subsection (8), at the appropriate place insert—

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

146

(1) Section 85 (disclosure of information by Revenue and Customs) is amended as follows.

(2) In subsection (8)(a), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) In subsection (9), at the appropriate place insert—

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Legal Services Act 2007 (c. 29)

147

(1) Section 169 of the Legal Services Act 2007 (disclosure of information to the Legal Services Board) is amended as follows.

(2) In subsection (3)(a), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) After subsection (8) insert—

(9) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Adoption and Children (Scotland) Act 2007 (asp 4)

148

In section 74 of the Adoption and Children (Scotland) Act 2007 (disclosure of medical information about parents), for subsection (5) substitute—

(5) In subsection (4)(e), “processing” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(4) and (14) of that Act).

Criminal Justice and Immigration Act 2008 (c. 4)

149

The Criminal Justice and Immigration Act 2008 is amended as follows.

150

Omit—

(a) section 77 (power to alter penalty for unlawfully obtaining etc personal data), and

(b) section 78 (new defence for obtaining etc for journalism and other special purposes).

151

(1) Section 114 (supply of information to Secretary of State etc) is amended as follows.

(2) In subsection (5), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) After subsection (6) insert—

(6A) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Regulatory Enforcement and Sanctions Act 2008 (c. 13)

152

(1) Section 70 of the Regulatory Enforcement and Sanctions Act 2008 (disclosure of information) is amended as follows.

(2) In subsection (4)(a), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) After subsection (5) insert—

(6) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Health and Social Care Act 2008 (c. 14)

153

In section 20A(5) of the Health and Social Care Act 2008 (functions relating to processing of information by registered persons), in the definition of “processing”, for “the Data Protection Act 1998” substitute “ Parts 5 to 7 of the Data Protection Act 2018 (see section 3(4) and (14) of that Act); ”.

Counter-Terrorism Act 2008 (c. 28)

154

(1) Section 20 of the Counter-Terrorism Act 2008 (disclosure and the intelligence services: supplementary provisions) is amended as follows.

(2) In subsection (2)(a), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) After subsection (4) insert—

(5) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Public Health etc. (Scotland) Act 2008 (asp 5)

155

(1) Section 117 of the Public Health etc. (Scotland) Act 2008 (disclosure of information) is amended as follows.

(2) In subsection (6), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) After subsection (7) insert—

(7A) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Banking Act 2009 (c. 1)

156

(1) Section 83ZY of the Banking Act 2009 (special resolution regime: publication of notices etc) is amended as follows.

(2) In subsection (10), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) In subsection (11), after “section” insert

— “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

Borders, Citizenship and Immigration Act 2009 (c. 11)

157

(1) Section 19 of the Borders, Citizenship and Immigration Act 2009 (use and disclosure of customs information: application of statutory provisions) is amended as follows.

(2) In subsection (1)(a), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) After subsection (4) insert—

(5) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Marine and Coastal Access Act 2009 (c. 23)

158

The Marine and Coastal Access Act 2009 is amended as follows.

159

(1) Paragraph 13 of Schedule 7 (further provision about civil sanctions under Part 4: disclosure of information) is amended as follows.

(2) In sub-paragraph (5)(a), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) After sub-paragraph (6) insert—

(7) In this paragraph, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

160

(1) Paragraph 9 of Schedule 10 (further provision about fixed monetary penalties: disclosure of information) is amended as follows.

(2) In sub-paragraph (5)(a), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) After sub-paragraph (6) insert—

(7) In this paragraph, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Coroners and Justice Act 2009 (c. 25)

161

In Schedule 21 to the Coroners and Justice Act 2009 (minor and consequential amendments), omit paragraph 29(3).

Broads Authority Act 2009 (c. i)

162

(1) Section 38 of the Broads Authority Act 2009 (provision of information) is amended as follows.

(2) In subsection (3), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) In subsection (6), after “section” insert

— “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

Health and Social Care (Reform) Act (Northern Ireland) 2009 (c. 1 (N.I.))

163

(1) Section 13 of the Health and Social Care (Reform) Act (Northern Ireland) 2009 (functions of the Regional Agency) is amended as follows.

(2) In subsection (8), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) After subsection (8) insert—

(9) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Terrorist Asset-Freezing etc. Act 2010 (c. 38)

164

(1) Section 25 of the Terrorist Asset-Freezing etc. Act 2010 (application of provisions) is amended as follows.

(2) In subsection (2)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) In subsection (6), at the appropriate place insert—

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

Marine (Scotland) Act 2010 (asp 5)

165

(1) Paragraph 12 of Schedule 2 to the Marine (Scotland) Act 2010 (further provision about civil sanctions under Part 4: disclosure of information) is amended as follows.

(2) In sub-paragraph (5)(a), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) After sub-paragraph (6) insert—

(7) In this paragraph, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Charities Act 2011 (c. 25)

166

(1) Section 59 of the Charities Act 2011 (disclosure: supplementary) is amended as follows.

(2) The existing text becomes subsection (1).

(3) In that subsection, in paragraph (a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(4) After that subsection insert—

(2) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Welsh Language (Wales) Measure 2011 (nawm 1)

167

The Welsh Language (Wales) Measure 2011 is amended as follows.

168

(1) Section 22 (power to disclose information) is amended as follows.

(2) In subsection (4)—

(a) in the English language text, for paragraph (a) substitute—

(a) sections 142 to 154, 160 to 164 or 174 to 176 of, or Schedule 15 to, the Data Protection Act 2018 (certain provisions relating to enforcement);

, and

(b) in the Welsh language text, for paragraph (a) substitute—

(a) adrannau 142 i 154, 160 i 164, neu 174 i 176 o Ddeddf Diogelu Data 2018 neu Atodlen 15 i'r Ddeddf honno (darpariaethau penodol yn ymwneud â gorfodi);

(3) For subsection (5)—

(a) in the English language text substitute—

(5) The offences referred to under subsection (3)(b) are those under— (a) a provision of the Data Protection Act 2018 other than paragraph 15 of Schedule 15 (obstruction of exercise of warrant etc); or (b) section 77 of the Freedom of Information Act 2000 (offence of altering etc records with intent to prevent disclosure).

, and

(b) in the Welsh language text substitute—

(5) Y tramgwyddau y cyfeirir atynt yn is-adran (3)(b) yw'r rhai— (a) o dan ddarpariaeth yn Neddf Diogelu Data 2018 ac eithrio paragraff 15 o Atodlen 15 (rhwystro gweithredu gwarant etc); neu (b) o dan adran 77 o Ddeddf Rhyddid Gwybodaeth 2000 (trosedd o altro etc cofnodion gyda'r bwriad o atal datgelu).

(4) In subsection (8)—

(a) in the English language text, for “the Data Protection Act 1998” substitute “ the data protection legislation ”, and

(b) in the Welsh language text, for “gymhwyso Deddf Diogelu Data 1998” substitute “gymhwyso'r ddeddfwriaeth diogelu data”.

(5) In subsection (9)—

(a) at the appropriate place in the English language text insert—

“the data protection legislation” (“y ddeddfwriaeth diogelu data”) has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

, and

(b) at the appropriate place in the Welsh language text insert—

“mae i “y ddeddfwriaeth diogelu data” yr un ystyr ag a roddir i “the data protection legislation” yn Neddf Diogelu Data 2018 (gweler adran 3 o'r Ddeddf honno);

169

(1) Paragraph 8 of Schedule 2 (inquiries by the Commissioner: reports) is amended as follows.

(2) In sub-paragraph (7)—

(a) in the English language text, for “the Data Protection Act 1998” substitute “ the data protection legislation ”, and

(b) in the Welsh language text, for “gymhwyso Deddf Diogelu Data 1998” substitute “gymhwyso'r ddeddfwriaeth diogelu data”.

(3) In sub-paragraph (8)—

(a) in the English language text, after “this paragraph” insert

— “the data protection legislation” (“y ddeddfwriaeth diogelu data”) has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

, and

(b) in the Welsh language text, after “hwn” insert—

“mae i “y ddeddfwriaeth diogelu data” yr un ystyr ag a roddir i “the data protection legislation” yn Neddf Diogelu Data 2018 (gweler adran 3 o'r Ddeddf honno);

Safeguarding Board Act (Northern Ireland) 2011 (c. 7 (N.I))

170

(1) Section 10 of the Safeguarding Board Act (Northern Ireland) 2011 (duty to co-operate) is amended as follows.

(2) In subsection (3), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) After subsection (3) insert—

(4) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Health and Social Care Act 2012 (c. 7)

171

The Health and Social Care Act 2012 is amended as follows.

172

In section 250(7) (power to publish information standards), for the definition of “processing” substitute—

“processing” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(4) and (14) of that Act);

173

(1) Section 251A (consistent identifiers) is amended as follows.

(2) In subsection (7)(a), for “made by or under the Data Protection Act 1998” substitute “ of the data protection legislation ”.

(3) After subsection (8) insert—

(9) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

174

(1) Section 251B (duty to share information) is amended as follows.

(2) In subsection (5)(a), for “made by or under the Data Protection Act 1998” substitute “ of the data protection legislation ”.

(3) After subsection (6) insert—

(7) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Protection of Freedoms Act 2012 (c. 9)

175

The Protection of Freedoms Act 2012 is amended as follows.

176

(1) Section 27 (exceptions and further provision about consent and notification) is amended as follows.

(2) In subsection (5), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) After subsection (5) insert—

(6) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

177

In section 28(1) (interpretation: Chapter 2), for the definition of “processing” substitute—

“processing” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(4) and (14) of that Act);

178

In section 29(7) (code of practice for surveillance camera systems), for the definition of “processing” substitute—

“processing” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(4) and (14) of that Act);

HGV Road User Levy Act 2013 (c. 7)

179

(1) Section 14A of the HGV Road User Levy Act 2013 (disclosure of information by Revenue and Customs) is amended as follows.

(2) In subsection (5), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) After subsection (5) insert—

(6) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Crime and Courts Act 2013 (c. 22)

180

The Crime and Courts Act 2013 is amended as follows.

181

(1) Section 42 (other interpretive provisions) is amended as follows.

(2) In subsection (5)(a), for “section 13 of the Data Protection Act 1998 (damage or distress suffered as a result of a contravention of a requirement of that Act)” substitute “ Article 82 of the GDPR or section 168 or 169 of the Data Protection Act 2018 (compensation for contravention of the data protection legislation) ”.

(3) After subsection (5) insert—

(5A) In subsection (5)(a), “the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act).

182

(1) Paragraph 1 of Schedule 7 (statutory restrictions on disclosure) is amended as follows.

(2) The existing text becomes sub-paragraph (1).

(3) In that sub-paragraph, in paragraph (a)—

(a) for “the Data Protection Act 1998” substitute “ the data protection legislation ”, and

(b) for “are” substitute “ is ”.

(4) After that sub-paragraph, insert—

(2) In this paragraph, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Marine Act (Northern Ireland) 2013 (c. 10 (N.I.))

183

(1) Paragraph 8 of Schedule 2 to the Marine Act (Northern Ireland) 2013 (further provision about fixed monetary penalties under section 35: disclosure of information) is amended as follows.

(2) In sub-paragraph (5)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) After sub-paragraph (6) insert—

(7) In this paragraph, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Local Audit and Accountability Act 2014 (c. 2)

184

(1) Paragraph 3 of Schedule 9 to the Local Audit and Accountability Act 2014 (data matching: voluntary provision of data) is amended as follows.

(2) In sub-paragraph (3)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) After sub-paragraph (3) insert—

(3A) “The data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

(4) In sub-paragraph (4), for “comprise or include” substitute “ comprises or includes ”.

Anti-social Behaviour, Crime and Policing Act 2014 (c. 12)

185

(1) Paragraph 7 of Schedule 4 to the Anti-social Behaviour, Crime and Policing Act 2014 (anti-social behaviour case reviews: information) is amended as follows.

(2) In sub-paragraph (4)—

(a) for “the Data Protection Act 1998” substitute “ the data protection legislation ”, and

(b) for “are” substitute “ is ”.

(3) After sub-paragraph (5) insert—

(6) In this paragraph, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Immigration Act 2014 (c. 22)

186

(1) Paragraph 6 of Schedule 6 to the Immigration Act 2014 (information: limitation on powers) is amended as follows.

(2) The existing text becomes sub-paragraph (1).

(3) In that sub-paragraph, in paragraph (a)—

(a) for “the Data Protection Act 1998” substitute “ the data protection legislation ”, and

(b) for “are” substitute “ is ”.

(4) After that sub-paragraph insert—

(2) In this paragraph, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Care Act 2014 (c. 23)

187

In section 67(9) of the Care Act 2014 (involvement in assessment, plans etc), for paragraph (a) substitute—

(a) a health record (within the meaning given in section 205 of the Data Protection Act 2018),

Social Services and Well-being (Wales) Act 2014 (anaw 4)

188

In section 18(10)(b) of the Social Services and Well-being (Wales) Act 2014 (registers of sight-impaired, hearing-impaired and other disabled people)—

(a) in the English language text, for “(within the meaning of the Data Protection Act 1998)” substitute “ (within the meaning of Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act)) ”, and

(b) in the Welsh language text, for “(o fewn ystyr “personal data” yn Neddf Diogelu Data 1998)” substitute “(o fewn ystyr “ personal data ” yn Rhan 5 i 7 o Ddeddf Diogelu Data 2018 (gweler adran 3(2) a (14) o'r Ddeddf honno))”.

Counter-Terrorism and Security Act 2015 (c. 6)

189

(1) Section 38 of the Counter-Terrorism and Security Act 2015 (support etc for people vulnerable to being drawn into terrorism: co-operation) is amended as follows.

(2) In subsection (4)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) After subsection (4) insert—

(4A) “The data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Small Business, Enterprise and Employment Act 2015 (c. 26)

190

(1) Section 6 of the Small Business, Enterprise and Employment Act 2015 (application of listed provisions to designated credit reference agencies) is amended as follows.

(2) In subsection (7)—

(a) for paragraph (b) substitute—

(b) Article 15(1) to (3) of the GDPR (confirmation of processing, access to data and safeguards for third country transfers);

, and

(b) omit paragraph (c).

(3) After subsection (7) insert—

(7A) In subsection (7) “the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act).

Modern Slavery Act 2015 (c. 30)

191

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Human Trafficking and Exploitation (Criminal Justice and Support for Victims) Act (Northern Ireland) 2015 (c. 2 (N.I.))

192

The Human Trafficking and Exploitation (Criminal Justice and Support for Victims) Act (Northern Ireland) 2015 is amended as follows.

193

In section 13(5) (duty to notify National Crime Agency about suspected victims of certain offences) for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

194

In section 25(1) (interpretation of this Act), at the appropriate place insert—

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

195

In paragraph 18(5) of Schedule 3 (supply of information to relevant Northern Ireland departments, Secretary of State, etc) for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

Justice Act (Northern Ireland) 2015 (c. 9 (N.I.))

196

(1) Section 72 of the Justice Act (Northern Ireland) 2015 (supply of information to relevant Northern Ireland departments or Secretary of State) is amended as follows.

(2) In subsection (5), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) In subsection (7), at the appropriate place insert—

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

Immigration Act 2016 (c. 19)

197

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Investigatory Powers Act 2016 (c. 25)

198

The Investigatory Powers Act 2016 is amended as follows.

199

In section 1(5)(b), for sub-paragraph (ii) substitute—

(ii) in section 170 of the Data Protection Act 2018 (unlawful obtaining etc of personal data),

200

In section 199 (bulk personal datasets: interpretation), for subsection (2) substitute—

(2) In this Part, “personal data” means— (a) personal data within the meaning of section 3(2) of the Data Protection Act 2018 which is subject to processing described in section 82(1) of that Act, and (b) data relating to a deceased individual where the data would fall within paragraph (a) if it related to a living individual.

201

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

202

In section 206 (additional safeguards for health records), for subsection (7) substitute—

(7) In subsection (6)— - “health professional” has the same meaning as in the Data Protection Act 2018 (see section 204(1) of that Act); - “health service body” has meaning given by section 204(4) of that Act.

203

(1) Section 237 (information gateway) is amended as follows.

(2) In subsection (2), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) After subsection (2) insert—

(3) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Public Services Ombudsman Act (Northern Ireland) 2016 (c. 4 (N.I.))

204

(1) Section 49 of the Police Services Ombudsman Act (Northern Ireland) 2016 (disclosure of information) is amended as follows.

(2) In subsection (4), for paragraph (a) substitute—

(a) sections 142 to 154, 160 to 164 and 174 to 176 of, or Schedule 15 to, the Data Protection Act 2018 (certain provisions relating to enforcement),

(3) For subsection (5) substitute—

(5) The offences are those under— (a) any provision of the Data Protection Act 2018 other than paragraph 15 of Schedule 15 (powers of entry and inspection: offences), (b) section 77 of the Freedom of Information Act 2000 (offence of altering etc records with intent to prevent disclosure).

(4) After subsection (6) insert—

(7) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Health and Social Care (Control of Data Processing) Act (Northern Ireland) 2016 (c. 12 (N.I.))

205

(1) Section 1 of the Health and Social Care (Control of Data Processing) Act (Northern Ireland) 2016 (control of information of a relevant person) is amended as follows.

(2) In subsection (8), for “made by or under the Data Protection Act 1998” substitute “ of the data protection legislation ”.

(3) After subsection (12) insert—

(12A) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Mental Capacity Act (Northern Ireland) 2016 (c. 18 (N.I.))

206

In section 306(1) of the Mental Capacity Act (Northern Ireland) 2016 (definitions for purposes of Act), for the definition of “health record” substitute—

“health record” has the meaning given by section 205 of the Data Protection Act 2018;

Justice Act (Northern Ireland) 2016 (c. 21 (N.I.))

207

The Justice Act (Northern Ireland) 2016 is amended as follows.

208

(1) Section 17 (disclosure of information) is amended as follows.

(2) In subsection (7), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) In subsection (8), after “section” insert

— “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

209

In section 44(3) (disclosure of information)—

(a) in paragraph (a), for “Part 5 of the Data Protection Act 1998” substitute “ sections 142 to 154, 160 to 164 or 174 to 176 of, or Schedule 15 to, the Data Protection Act 2018 ”, and

(b) for paragraph (b) substitute—

(b) the commission of an offence under— (i) a provision of the Data Protection Act 2018 other than paragraph 15 of Schedule 15 (obstruction of execution of warrant etc); or (ii) section 77 of the Freedom of Information Act 2000 (offence of altering etc records with intent to prevent disclosure).

Policing and Crime Act 2017 (c. 3)

210

(1) Section 50 of the Policing and Crime Act 2017 (Freedom of Information Act etc: Police Federation for England and Wales) is amended as follows.

(2) The existing text becomes subsection (1).

(3) In that subsection, in paragraph (b), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(4) After that subsection, insert—

(2) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Children and Social Work Act 2017 (c. 12)

211

In Schedule 5 to the Children and Social Work Act 2017—

(a) in Part 1 (general amendments to do with social workers etc in England), omit paragraph 6, and

(b) in Part 2 (renaming of Health and Social Work Professions Order 2001), omit paragraph 47(g).

Higher Education and Research Act 2017 (c. 29)

212

The Higher Education and Research Act 2017 is amended as follows.

213

(1) Section 63 (cooperation and information sharing by the Office for Students) is amended as follows.

(2) In subsection (6), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) In subsection (7), at the appropriate place insert—

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

214

(1) Section 112 (cooperation and information sharing between the Office for Students and UKRI) is amended as follows.

(2) In subsection (6), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) After subsection (6) insert —

(7) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Digital Economy Act 2017 (c. 30)

215

The Digital Economy Act 2017 is amended as follows.

216

(1) Section 40 (further provisions about disclosures under sections 35 to 39) is amended as follows.

(2) In subsection (8)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) After subsection (10) insert—

(11) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

217

(1) Section 43 (codes of practice) is amended as follows.

(2) In subsection (2), for “issued under section 52B (data-sharing code) of the Data Protection Act 1998” substitute “ prepared under section 121 of the Data Protection Act 2018 (data-sharing code) and issued under section 125(4) of that Act ”.

(3) In subsection (13), for “section 51(3) of the Data Protection Act 1998” substitute “ section 128 of the Data Protection Act 2018 ”.

218

(1) Section 49 (further provision about disclosures under section 48) is amended as follows.

(2) In subsection (8)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) After subsection (10) insert—

(11) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

219

(1) Section 52 (code of practice) is amended as follows.

(2) In subsection (2), for “issued under section 52B (data-sharing code) of the Data Protection Act 1998” substitute “ prepared under section 121 of the Data Protection Act 2018 (data-sharing code) and issued under section 125(4) of that Act ”.

(3) In subsection (13), for “section 51(3) of the Data Protection Act 1998” substitute “ section 128 of the Data Protection Act 2018 (other codes of practice) ”.

220

(1) Section 57 (further provision about disclosures under section 56) is amended as follows.

(2) In subsection (8)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) After subsection (10) insert—

(11) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

221

(1) Section 60 (code of practice) is amended as follows.

(2) In subsection (2), for “issued under section 52B (data-sharing code) of the Data Protection Act 1998” substitute “ prepared under section 121 of the Data Protection Act 2018 (data-sharing code) and issued under section 125(4) of that Act ”.

(3) In subsection (13), for “section 51(3) of the Data Protection Act 1998” substitute “ section 128 of the Data Protection Act 2018 (other codes of practice) ”.

222

(1) Section 65 (supplementary provision about disclosures under section 64) is amended as follows.

(2) In subsection (2)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) After subsection (8) insert—

(9) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

223

(1) Section 70 (code of practice) is amended as follows.

(2) In subsection (2), for “issued under section 52B (data-sharing code) of the Data Protection Act 1998” substitute “ prepared under section 121 of the Data Protection Act 2018 (data-sharing code) and issued under section 125(4) of that Act ”.

(3) In subsection (15), for “section 51(3) of the Data Protection Act 1998” substitute “ section 128 of the Data Protection Act 2018 (other codes of practice) ”.

224

Omit sections 108 to 110 (charges payable to the Information Commissioner).

Landfill Disposals Tax (Wales) Act 2017 (anaw 3)

225

(1) Section 60 of the Landfill Disposals Tax (Wales) Act 2017 (disclosure of information to the Welsh Revenue Authority) is amended as follows.

(2) In subsection (4)(a)—

(a) in the English language text, for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”, and

(b) in the Welsh language text, for “torri Deddf Diogelu Data 1998 (p. 29)” substitute “torri'r ddeddfwriaeth diogelu data”.

(3) After subsection (7)—

(a) in the English language text insert—

(8) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

, and

(b) in the Welsh language text insert—

(8) Yn yr adran hon, mae i “y ddeddfwriaeth diogelu data” yr un ystyr ag a roddir i “the data protection legislation” yn Neddf Diogelu Data 2018 (gweler adran 3 o'r Ddeddf honno).

Additional Learning Needs and Educational Tribunal (Wales) Act 2018 (anaw 2)

226

(1) Section 4 of the Additional Learning Needs and Educational Tribunal (Wales) Act 2018 (additional learning needs code) is amended as follows.

(2) In the English language text—

(a) in subsection (9), omit from “and in this subsection” to the end, and

(b) after subsection (9) insert—

(9A) In subsection (9)— - “data subject” (“testun y data”) has the meaning given by section 3(5) of the Data Protection Act 2018; - “personal data” (“data personol”) has the same meaning as in Parts 5 to 7 of that Act (see section 3(2) and (14) of that Act).

(3) In the Welsh language text—

(a) in subsection (9), omit from “ac yn yr is-adran hon” to the end, and

(b) after subsection (9) insert—

(9A) Yn is-adran (9)— - mae i “data personol” yr un ystyr ag a roddir i “personal data” yn Rhannau 5 i 7 o Ddeddf Diogelu Data 2018 (gweler adran 3(2) a (14) o'r Ddeddf honno); - mae i “testun y data” yr ystyr a roddir i “data subject” gan adran 3(5) o'r Ddeddf honno.

This Act

227

(1) Section 204 of this Act (meaning of “health professional” and “social work professional”) is amended as follows (to reflect the arrangements for the registration of social workers in England under Part 2 of the Children and Social Work Act 2017).

(2) In subsection (1)(g)—

(a) omit “and Social Work”, and

(b) omit “, other than the social work profession in England”.

(3) In subsection (2), for paragraph (a) substitute—

(a) a person registered as a social worker in the register maintained by Social Work England under section 39(1) of the Children and Social Work Act 2017;

PART 2 — Amendments of other legislation

Estate Agents (Specified Offences) (No. 2) Order 1991 (S.I. 1991/1091)

228

In the table in the Schedule to the Estate Agents (Specified Offences) (No. 2) Order 1991 (specified offences), at the end insert—

Data Protection Act 2018	Section 144	False statements made in response to an information notice
Data Protection Act 2018	Section 148	Destroying or falsifying information and documents etc

Channel Tunnel (International Arrangements) Order 1993 (S.I. 1993/1813)

229

(1) Article 4 of the Channel Tunnel (International Arrangements) Order 1993 (application of enactments) is amended as follows.

(2) In paragraph (2)—

(a) for “section 5 of the Data Protection Act 1998 (“the 1998 Act”), data which are” substitute “ section 207 of the Data Protection Act 2018 (“the 2018 Act”), data which is ”,

(b) for “data controller” substitute “ controller ”,

(d) for “and the 1998 Act” substitute “ and the 2018 Act ”.

(3) In paragraph (3)—

(a) for “section 5 of the 1998 Act, data which are” substitute “ section 207 of the 2018 Act, data which is ”,

(b) for “data controller” substitute “ controller ”,

(d) for “and the 1998 Act” substitute “ and the 2018 Act ”.

Access to Health Records (Northern Ireland) Order 1993 (S.I. 1993/1250 (N.I. 4))

230

The Access to Health Records (Northern Ireland) Order 1993 is amended as follows.

231

In Article 4 (health professionals), for paragraph (1) substitute—

(1) In this Order, “health professional” has the same meaning as in the Data Protection Act 2018 (see section 204 of that Act).

232

In Article 5(4)(a) (fees for access to health records), for “under section 7 of the Data Protection Act 1998” substitute “ made by the Department ”.

Channel Tunnel (Miscellaneous Provisions) Order 1994 (S.I. 1994/1405)

233

In article 4 of the Channel Tunnel (Miscellaneous Provisions) Order 1994 (application of enactments), for paragraphs (2) and (3) substitute—

(2) For the purposes of section 207 of the Data Protection Act 2018 (“the 2018 Act”), data which is processed in a control zone in Belgium, in connection with the carrying out of frontier controls, by an officer belonging to the United Kingdom is to be treated as processed by a controller established in the United Kingdom in the context of the activities of that establishment (and accordingly the 2018 Act applies in respect of such data). (3) For the purposes of section 207 of the 2018 Act, data which is processed in a control zone in Belgium, in connection with the carrying out of frontier controls, by an officer belonging to the Kingdom of Belgium is to be treated as processed by a controller established in the Kingdom of Belgium in the context of the activities of that establishment (and accordingly the 2018 Act does not apply in respect of such data).

European Primary and Specialist Dental Qualifications Regulations 1998 (S.I. 1998/811)

234

The European Primary and Specialist Dental Qualifications Regulations 1998 are amended as follows.

235

(1) Regulation 2(1) (interpretation) is amended as follows.

(2) Omit the definition of “Directive 95/46/EC”.

(3) At the appropriate place insert—

“the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018;

236

(1) The table in Schedule A1 (functions of the GDC under Directive 2005/36) is amended as follows.

(2) In the entry for Article 56(2), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.

(3) In the entry for Article 56a(4), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.

Scottish Parliamentary Corporate Body (Crown Status) Order 1999 (S.I. 1999/677)

237

For article 7 of the Scottish Parliamentary Corporate Body (Crown Status) Order 1999 substitute—

(7) (1) The Parliamentary corporation is to be treated as a Crown body for the purposes of the Data Protection Act 2018 to the extent specified in this article. (2) The Parliamentary corporation is to be treated as a government department for the purposes of the following provisions— (a) section 8(d) (lawfulness of processing under the GDPR: public interest etc), (b) section 209 (application to the Crown), (c) paragraph 6 of Schedule 1 (statutory etc and government purposes), (d) paragraph 7 of Schedule 2 (exemptions from the GDPR: functions designed to protect the public etc), and (e) paragraph 8(1)(o) of Schedule 3 (exemptions from the GDPR: health data). (3) In the provisions mentioned in paragraph (4)— (a) references to employment by or under the Crown are to be treated as including employment as a member of staff of the Parliamentary corporation, and (b) references to a person in the service of the Crown are to be treated as including a person so employed. (4) The provisions are— (a) section 24(3) (exemption for certain data relating to employment under the Crown), and (b) section 209(6) (application of certain provisions to a person in the service of the Crown). (5) In this article, references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(14) of that Act).

Northern Ireland Assembly Commission (Crown Status) Order 1999 (S.I. 1999/3145)

238

For article 9 of the Northern Ireland Assembly Commission (Crown Status) Order 1999 substitute—

(9) (1) The Commission is to be treated as a Crown body for the purposes of the Data Protection Act 2018 to the extent specified in this article. (2) The Commission is to be treated as a government department for the purposes of the following provisions— (a) section 8(d) (lawfulness of processing under the GDPR: public interest etc), (b) section 209 (application to the Crown), (c) paragraph 6 of Schedule 1 (statutory etc and government purposes), (d) paragraph 7 of Schedule 2 (exemptions from the GDPR: functions designed to protect the public etc), and (e) paragraph 8(1)(o) of Schedule 3 (exemptions from the GDPR: health data). (3) In the provisions mentioned in paragraph (4)— (a) references to employment by or under the Crown are to be treated as including employment as a member of staff of the Commission, and (b) references to a person in the service of the Crown are to be treated as including a person so employed. (4) The provisions are— (a) section 24(3) (exemption for certain data relating to employment under the Crown), and (b) section 209(6) (application of certain provisions to a person in the service of the Crown). (5) In this article, references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(14) of that Act).

Data Protection (Corporate Finance Exemption) Order 2000 (S.I. 2000/184)

239

The Data Protection (Corporate Finance Exemption) Order 2000 is revoked.

Data Protection (Conditions under Paragraph 3 of Part II of Schedule 1) Order 2000 (S.I. 2000/185)

240

The Data Protection (Conditions under Paragraph 3 of Part II of Schedule 1) Order 2000 is revoked.

Data Protection (Functions of Designated Authority) Order 2000 (S.I. 2000/186)

241

The Data Protection (Functions of Designated Authority) Order 2000 is revoked.

Data Protection (International Co-operation) Order 2000 (S.I. 2000/190)

242

The Data Protection (International Co-operation) Order 2000 is revoked.

Data Protection (Subject Access) (Fees and Miscellaneous Provisions) Regulations 2000 (S.I. 2000/191)

243

The Data Protection (Subject Access) (Fees and Miscellaneous Provisions) Regulations 2000 are revoked.

Consumer Credit (Credit Reference Agency) Regulations 2000 (S.I. 2000/290)

244

In the Consumer Credit (Credit Reference Agency) Regulations 2000, regulation 4(1) and Schedule 1 (statement of rights under section 9(3) of the Data Protection Act 1998) are revoked.

Data Protection (Subject Access Modification) (Health) Order 2000 (S.I. 2000/413)

245

The Data Protection (Subject Access Modification) (Health) Order 2000 is revoked.

Data Protection (Subject Access Modification) (Education) Order 2000 (S.I. 2000/414)

246

The Data Protection (Subject Access Modification) (Education) Order 2000 is revoked.

Data Protection (Subject Access Modification) (Social Work) Order 2000 (S.I. 2000/415)

247

The Data Protection (Subject Access Modification) (Social Work) Order 2000 is revoked.

Data Protection (Crown Appointments) Order 2000 (S.I. 2000/416)

248

The Data Protection (Crown Appointments) Order 2000 is revoked.

Data Protection (Processing of Sensitive Personal Data) Order 2000 (S.I. 2000/417)

249

The Data Protection (Processing of Sensitive Personal Data) Order 2000 is revoked.

Data Protection (Miscellaneous Subject Access Exemptions) Order 2000 (S.I. 2000/419)

250

The Data Protection (Miscellaneous Subject Access Exemptions) Order 2000 is revoked.

Data Protection (Designated Codes of Practice) (No. 2) Order 2000 (S.I. 2000/1864)

251

The Data Protection (Designated Codes of Practice) (No. 2) Order 2000 is revoked.

Representation of the People (England and Wales) Regulations 2001 (S.I. 2001/341)

252

The Representation of the People (England and Wales) Regulations 2001 are amended as follows.

253

In regulation 3(1) (interpretation), at the appropriate places insert—

“Article 89 GDPR purposes” means the purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);

;

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

;

“the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation);

254

In regulation 26(3)(a) (applications for registration), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

255

In regulation 26A(2)(a) (application for alteration of register in respect of name under section 10ZD), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

256

In regulation 32ZA(3)(f) (annual canvass), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

257

In regulation 61A (conditions on the use, supply and inspection of absent voter records or lists), for paragraph (a) (but not the final “or”) substitute—

(a) Article 89 GDPR purposes;

258

(1) Regulation 92(2) (interpretation and application of Part VI etc) is amended as follows.

(2) After sub-paragraph (b) insert—

(ba) “relevant requirement” means the requirement under Article 89 of the GDPR, read with section 19 of the Data Protection Act 2018, that personal data processed for Article 89 GDPR purposes must be subject to appropriate safeguards.

(3) Omit sub-paragraphs (c) and (d).

259

In regulation 96(2A)(b)(i) (restriction on use of the full register), for “section 11(3) of the Data Protection Act 1998” substitute “ section 122(5) of the Data Protection Act 2018 ”.

260

In regulation 97(5) and (6) (supply of free copy of full register to the British Library and restrictions on use), for “research purposes in compliance with the relevant conditions” substitute “ Article 89 GDPR purposes in accordance with the relevant requirement ”.

261

In regulation 97A(7) and (8) (supply of free copy of full register to the National Library of Wales and restrictions on use), for “research purposes in compliance with the relevant conditions” substitute “ Article 89 GDPR purposes in accordance with the relevant requirement ”.

262

In regulation 99(6) and (7) (supply of free copy of full register etc to Statistics Board and restrictions on use), for “research purposes in compliance with the relevant conditions” substitute “ Article 89 GDPR purposes in accordance with the relevant requirement ”.

263

In regulation 109A(9) and (10) (supply of free copy of full register to public libraries and local authority archives services and restrictions on use), for “research purposes in compliance with the relevant conditions” substitute “ Article 89 GDPR purposes in accordance with the relevant requirement ”.

264

In regulation 119(2) (conditions on the use, supply and disclosure of documents open to public inspection), for sub-paragraph (i) (but not the final “or”) substitute—

(i) Article 89 GDPR purposes;

Representation of the People (Scotland) Regulations 2001 (S.I. 2001/497)

265

The Representation of the People (Scotland) Regulations 2001 are amended as follows.

266

In regulation 3(1) (interpretation), at the appropriate places, insert—

“Article 89 GDPR purposes” means the purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);

;

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

;

“the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation);

267

In regulation 26(3)(a) (applications for registration), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

268

In regulation 26A(2)(a) (application for alteration of register in respect of name under section 10ZD), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

269

In regulation 32ZA(3)(f) (annual canvass), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

270

In regulation 61(3) (records and lists kept under Schedule 4), for paragraph (a) (but not the final “or”) substitute—

(a) Article 89 GDPR purposes;

271

In regulation 61A (conditions on the use, supply and inspection of absent voter records or lists), for paragraph (a) (but not the final “or”) substitute—

(a) Article 89 GDPR purposes;

272

(1) Regulation 92(2) (interpretation of Part VI etc) is amended as follows.

(2) After sub-paragraph (b) insert—

(ba) “relevant requirement” means the requirement under Article 89 of the GDPR, read with section 19 of the Data Protection Act 2018, that personal data processed for Article 89 GDPR purposes must be subject to appropriate safeguards.

(3) Omit sub-paragraphs (c) and (d).

273

In regulation 95(3)(b)(i) (restriction on use of the full register), for “section 11(3) of the Data Protection Act 1998” substitute “ section 122(5) of the Data Protection Act 2018 ”.

274

In regulation 96(5) and (6) (supply of free copy of full register to the National Library of Scotland and the British Library and restrictions on use), for “research purposes in compliance with the relevant conditions” substitute “ Article 89 GDPR purposes in accordance with the relevant requirement ”.

275

In regulation 98(6) and (7) (supply of free copy of full register etc to Statistics Board and restrictions on use), for “research purposes in compliance with the relevant conditions” substitute “ Article 89 GDPR purposes in accordance with the relevant requirement ”.

276

In regulation 108A(9) and (10) (supply of full register to statutory library authorities and local authority archives services and restrictions on use), for “research purposes in compliance with the relevant conditions” substitute “ Article 89 GDPR purposes in accordance with the relevant requirement ”.

277

In regulation 119(2) (conditions on the use, supply and disclosure of documents open to public inspection), for sub-paragraph (i) (but not the final “or”) substitute—

(i) Article 89 GDPR purposes;

Financial Services and Markets Act 2000 (Disclosure of Confidential Information) Regulations 2001 (S.I. 2001/2188)

278

(1) Article 9 of the Financial Services and Markets 2000 (Disclosure of Confidential Information) Regulations 2001 (disclosure by regulators or regulator workers to certain other persons) is amended as follows.

(2) In paragraph (2B), for sub-paragraph (a) substitute—

(a) the disclosure is made in accordance with Chapter V of the GDPR;

(3) After paragraph (5) insert—

(6) In this article, “the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act).

Nursing and Midwifery Order 2001 (S.I. 2002/253)

279

The Nursing and Midwifery Order 2001 is amended as follows.

280

(1) Article 3 (the Nursing and Midwifery Council and its Committees) is amended as follows.

(2) In paragraph (18), after “enactment” insert “ or the GDPR ”.

(3) After paragraph (18) insert—

(19) In this paragraph, “the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act).

281

(1) Article 25 (the Council's power to require disclosure of information) is amended as follows.

(2) In paragraph (3), after “enactment” insert “ or the GDPR ”.

(3) In paragraph (6)—

(a) for “paragraph (5),” substitute “ paragraph (3)— ”, and

(b) at the appropriate place insert—

“the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act).

282

In article 39B (European professional card), after paragraph (2) insert—

(3) For the purposes of Schedule 2B, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018.

283

In article 40(6) (Directive 2005/36/EC: designation of competent authority etc), at the appropriate place insert—

“the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018;

284

(1) Schedule 2B (Directive 2005/36/EC: European professional card) is amended as follows.

(2) In paragraph 8(1) (access to data) for “Directive 95/46/EC” substitute “ the GDPR ”.

(3) In paragraph 9 (processing data), omit sub-paragraph (2) (deeming the Society to be the controller for the purposes of Directive 95/46/EC).

285

(1) The table in Schedule 3 (functions of the Council under Directive 2005/36) is amended as follows.

(2) In the entry for Article 56(2), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.

(3) In the entry for Article 56a(4), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.

286

In Schedule 4 (interpretation), omit the definition of “Directive 95/46/EC”.

Electronic Commerce (EC Directive) Regulations 2002 (S.I. 2002/2013)

287

Regulation 3 of the Electronic Commerce (EC Directive) Regulations 2002 (exclusions) is amended as follows.

288

In paragraph (1)(b) for “the Data Protection Directive and the Telecommunications Data Protection Directive” substitute “ the GDPR ”.

289

In paragraph (3)—

(a) omit the definitions of “Data Protection Directive” and “Telecommunications Data Protection Directive”, and

(b) at the appropriate place insert—

“the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation);

Data Protection (Processing of Sensitive Personal Data) (Elected Representatives) Order 2002 (S.I. 2002/2905)

290

The Data Protection (Processing of Sensitive Personal Data) (Elected Representatives) Order 2002 is revoked.

Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426)

291

The Privacy and Electronic Communications (EC Directive) Regulations 2003 are amended as follows.

292

In regulation 2(1) (interpretation), in the definition of “the Information Commissioner” and “the Commissioner”, for “section 6 of the Data Protection Act 1998” substitute “ the Data Protection Act 2018 ”.

293

(1) Regulation 4 (relationship between these Regulations and the Data Protection Act 1998) is amended as follows.

(2) The existing text becomes sub-paragraph (1).

(3) In that sub-paragraph, for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(4) After that sub-paragraph insert—

(2) In this regulation— - “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act); - “personal data” and “processing” have the same meaning as in Parts 5 to 7 of that Act (see section 3(2), (4) and (14) of that Act). (3) Regulation 2(2) and (3) (meaning of certain expressions) do not apply for the purposes of this regulation.

(5) In the heading of that regulation, for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

Nationality, Immigration and Asylum Act 2002 (Juxtaposed Controls) Order 2003 (S.I. 2003/2818)

294

The Nationality, Immigration and Asylum Act 2002 (Juxtaposed Controls) Order 2003 is amended as follows.

295

In article 8(2) (exercise of powers by French officers in a control zone in the United Kingdom: disapplication of law of England and Wales)—

(a) for “The Data Protection Act 1998” substitute “ The Data Protection Act 2018 ”, and

(b) for “are” substitute “ is ”.

296

In article 11(4) (exercise of powers by UK immigration officers and constables in a control zone in France: enactments having effect)—

(a) for “The Data Protection Act 1998” substitute “ The Data Protection Act 2018 ”,

(b) for “are” substitute “ is ”,

(d) for “data controller” substitute “ controller ”, and

(e) after “in the context of” insert “ the activities of ”.

Pupils’ Educational Records (Scotland) Regulations 2003 (S.S.I. 2003/581)

297

The Pupils' Educational Records (Scotland) Regulations 2003 are amended as follows.

298

(1) Regulation 2 (interpretation) is amended as follows.

(2) Omit the definition of “the 1998 Act”.

(3) At the appropriate place insert—

“the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018;

299

(1) Regulation 6 (circumstances where information should not be disclosed) is amended as follows.

(2) After “any information” insert “ to the extent that any of the following conditions are satisfied ”.

(3) For paragraphs (a) to (c) substitute—

(aa) the pupil to whom the information relates would have no right of access to the information under the GDPR; (ab) the information is personal data described in Article 9(1) or 10 of the GDPR (special categories of personal data and personal data relating to criminal convictions and offences);

(4) In paragraph (d), for “to the extent that its disclosure” substitute “ the disclosure of the information ”.

(5) In paragraph (e), for “that” substitute “ the information ”.

300

In regulation 9 (fees), for paragraph (1) substitute—

(1A) In complying with a request made under regulation 5(2), the responsible body may only charge a fee where Article 12(5) or Article 15(3) of the GDPR would permit the charging of a fee if the request had been made by the pupil to whom the information relates under Article 15 of the GDPR. (1B) Where paragraph (1A) permits the charging of a fee, the responsible body may not charge a fee that— (a) exceeds the cost of supply, or (b) exceeds any limit in regulations made under section 12 of the Data Protection Act 2018 that would apply if the request had been made by the pupil to whom the information relates under Article 15 of the GDPR.

European Parliamentary Elections (Northern Ireland) Regulations 2004 (S.I. 2004/1267)

301

Schedule 1 to the European Parliamentary Elections (Northern Ireland) Regulations 2004 (European Parliamentary elections rules) is amended as follows.

302

(1) Paragraph 74(1) (interpretation) is amended as follows.

(2) Omit the definitions of “relevant conditions” and “research purposes”.

(3) At the appropriate places insert—

“Article 89 GDPR purposes” means the purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);

;

“the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation);

303

In paragraph 77(2)(b) (conditions on the use, supply and disclosure of documents open to public inspection), for “research purposes” substitute “ Article 89 GDPR purposes ”.

Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004 (S.I. 2004/3244)

304

In regulation 3(1) of the Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004, omit “the appropriate limit referred to in section 9A(3) and (4) of the 1998 Act and”.

Environmental Information Regulations 2004 (S.I. 2004/3391)

305

The Environmental Information Regulations 2004 are amended as follows.

306

(1) Regulation 2 (interpretation) is amended as follows.

(2) In paragraph (1), at the appropriate places, insert—

“the data protection principles” means the principles set out in— (a) Article 5(1) of the GDPR, (b) section 34(1) of the Data Protection Act 2018, and (c) section 85(1) of that Act;

;

“data subject” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

;

“the GDPR” and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act);

;

“personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act);

(3) For paragraph (4) substitute—

(4A) In these Regulations, references to the Data Protection Act 2018 have effect as if in Chapter 3 of Part 2 of that Act (other general processing)— (a) the references to an FOI public authority were references to a public authority as defined in these Regulations, and (b) the references to personal data held by such an authority were to be interpreted in accordance with regulation 3(2).

307

(1) Regulation 13 (personal data) is amended as follows.

(2) For paragraph (1) substitute—

(1) To the extent that the information requested includes personal data of which the applicant is not the data subject, a public authority must not disclose the personal data if— (a) the first condition is satisfied, or (b) the second or third condition is satisfied and, in all the circumstances of the case, the public interest in not disclosing the information outweighs the public interest in disclosing it.

(3) For paragraph (2) substitute—

(2A) The first condition is that the disclosure of the information to a member of the public otherwise than under these Regulations— (a) would contravene any of the data protection principles, or (b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded. (2B) The second condition is that the disclosure of the information to a member of the public otherwise than under these Regulations would contravene— (a) Article 21 of the GDPR (general processing: right to object to processing), or (b) section 99 of the Data Protection Act 2018 (intelligence services processing: right to object to processing).

(4) For paragraph (3) substitute—

(3A) The third condition is that— (a) on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018, (b) on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section, or (c) on a request under section 94(1)(b) of that Act (intelligence services processing: rights of access by the data subject), the information would be withheld in reliance on a provision of Chapter 6 of Part 4 of that Act.

(5) Omit paragraph (4).

(6) For paragraph (5) substitute—

(5A) For the purposes of this regulation a public authority may respond to a request by neither confirming nor denying whether such information exists and is held by the public authority, whether or not it holds such information, to the extent that— (a) the condition in paragraph (5B)(a) is satisfied, or (b) a condition in paragraph (5B)(b) to (e) is satisfied and in all the circumstances of the case, the public interest in not confirming or denying whether the information exists outweighs the public interest in doing so. (5B) The conditions mentioned in paragraph (5A) are— (a) giving a member of the public the confirmation or denial— (i) would (apart from these Regulations) contravene any of the data protection principles, or (ii) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded; (b) giving a member of the public the confirmation or denial would (apart from these Regulations) contravene Article 21 of the GDPR or section 99 of the Data Protection Act 2018 (right to object to processing); (c) on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for confirmation of whether personal data is being processed, the information would be withheld in reliance on a provision listed in paragraph (3A)(a); (d) on a request under section 45(1)(a) of the Data Protection Act 2018 (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section; (e) on a request under section 94(1)(a) of that Act (intelligence services processing: rights of access by the data subject), the information would be withheld in reliance on a provision of Chapter 6 of Part 4 of that Act.

(7) After that paragraph insert—

(6) In determining for the purposes of this regulation whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.

308

In regulation 14 (refusal to disclose information), in paragraph (3)(b), for “regulations 13(2)(a)(ii) or 13(3)” substitute “ regulation 13(1)(b) or (5A) ”.

309

In regulation 18 (enforcement and appeal provisions), in paragraph (5), for “regulation 13(5)” substitute “ regulation 13(5A) ”.

Environmental Information (Scotland) Regulations 2004 (S.S.I. 2004/520)

310

The Environmental Information (Scotland) Regulations 2004 are amended as follows.

311

(1) Regulation 2 (interpretation) is amended as follows.

(2) In paragraph (1), at the appropriate places, insert—

“the data protection principles” means the principles set out in— (a) Article 5(1) of the GDPR, and (b) section 34(1) of the Data Protection Act 2018;”;

;

“data subject” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

;

“the GDPR” and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act);

;

“personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act);

(3) For paragraph (3) substitute—

(3A) In these Regulations, references to the Data Protection Act 2018 have effect as if in Chapter 3 of Part 2 of that Act (other general processing)— (a) the references to an FOI public authority were references to a Scottish public authority as defined in these Regulations, and (b) the references to personal data held by such an authority were to be interpreted in accordance with paragraph (2) of this regulation.

312

(1) Regulation 11 (personal data) is amended as follows.

(2) For paragraph (2) substitute—

(2) To the extent that environmental information requested includes personal data of which the applicant is not the data subject, a Scottish public authority must not make the personal data available if— (a) the first condition set out in paragraph (3A) is satisfied, or (b) the second or third condition set out in paragraph (3B) or (4A) is satisfied and, in all the circumstances of the case, the public interest in making the information available is outweighed by that in not doing so.

(3) For paragraph (3) substitute—

(3A) The first condition is that the disclosure of the information to a member of the public otherwise than under these Regulations— (a) would contravene any of the data protection principles, or (b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded. (3B) The second condition is that the disclosure of the information to a member of the public otherwise than under these Regulations would contravene Article 21 of the GDPR (general processing: right to object to processing).

(4) For paragraph (4) substitute—

(4A) The third condition is that any of the following applies to the information— (a) it is exempt from the obligation under Article 15(1) of the GDPR (general processing: right of access by the data subject) to provide access to, and information about, personal data by virtue of provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018, or (b) on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section.

(5) Omit paragraph (5).

(6) After paragraph (6) insert—

(7) In determining, for the purposes of this regulation, whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.

Licensing Act 2003 (Personal Licences) Regulations 2005 (S.I. 2005/41)

313

(1) Regulation 7 of the Licensing Act 2003 (Personal Licences) Regulations 2005 (application for grant of a personal licence) is amended as follows.

(2) In paragraph (1)(b)—

(a) for paragraph (iii) (but not the final “, and”) substitute—

(iii) the results of a request made under Article 15 of the GDPR or section 45 of the Data Protection Act 2018 (rights of access by the data subject) to the National Identification Service for information contained in the Police National Computer

, and

(b) in the words following paragraph (iii), omit “search”.

(3) After paragraph (2) insert—

(3) In this regulation, “the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act).

Education (Pupil Information) (England) Regulations 2005 (S.I. 2005/1437)

314

The Education (Pupil Information) (England) Regulations 2005 are amended as follows.

315

In regulation 3(5) (meaning of educational record) for “section 1(1) of the Data Protection Act 1998” substitute “ section 3(4) of the Data Protection Act 2018 ”.

316

(1) Regulation 5 (disclosure of curricular and educational records) is amended as follows.

(2) In paragraph (4)—

(a) in sub-paragraph (a), for “the Data Protection Act 1998” substitute “ the GDPR ”, and

(b) in sub-paragraph (b), for “that Act or by virtue of any order made under section 30(2) or section 38(1) of the Act” substitute “ the GDPR ”.

(3) After paragraph (6) insert—

(7) In this regulation, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018.

Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005 (S.I. 2005/2042)

317

(1) Regulation 45 of the Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005 (sensitive information) is amended as follows.

(2) In paragraph (1)(d)—

(a) omit “, within the meaning of section 1(1) of the Data Protection Act 1998”, and

(b) for “(2) or (3)” substitute “ (1A), (1B) or (1C) ”.

(3) After paragraph (1) insert—

(1A) The condition in this paragraph is that the disclosure of the information to a member of the public— (a) would contravene any of the data protection principles, or (b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded. (1B) The condition in this paragraph is that the disclosure of the information to a member of the public would contravene— (a) Article 21 of the GDPR (general processing: right to object to processing), or (b) section 99 of the Data Protection Act 2018 (intelligence services processing: right to object to processing). (1C) The condition in this paragraph is that— (a) on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018, (b) on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section, or (c) on a request under section 94(1)(b) of that Act (intelligence services processing: rights of access by the data subject), the information would be withheld in reliance on a provision of Chapter 6 of Part 4 of that Act. (1D) In this regulation— - “the data protection principles” means the principles set out in— 1. Article 5(1) of the GDPR, 2. section 34(1) of the Data Protection Act 2018, and 3. section 85(1) of that Act; - “the GDPR” and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act); - “personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act). (1E) In determining for the purposes of this regulation whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.

(4) Omit paragraphs (2) to (4).

Register of Judgments, Orders and Fines Regulations 2005 (S.I. 2005/3595)

318

In regulation 3 of the Register of Judgments, Orders and Fines Regulations 2005 (interpretation)—

(a) for the definition of “data protection principles” substitute—

“data protection principles” means the principles set out in Article 5(1) of the GDPR;

, and

(b) at the appropriate place insert—

“the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act);

Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005 (S.S.I. 2005/494)

319

The Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005 are amended as follows.

320

(1) Regulation 39 (sensitive information) is amended as follows.

(2) In paragraph (1)(d)—

(a) omit “, within the meaning of section 1(1) of the Data Protection Act 1998”, and

(b) for “(2) or (3)” substitute “ (1A), (1B) or (1C) ”.

(3) After paragraph (1) insert—

(1A) The condition in this paragraph is that the disclosure of the information to a member of the public— (a) would contravene any of the data protection principles, or (b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded. (1B) The condition in this paragraph is that the disclosure of the information to a member of the public would contravene— (a) Article 21 of the GDPR (general processing: right to object to processing), or (b) section 99 of the Data Protection Act 2018 (intelligence services processing: right to object to processing). (1C) The condition in this paragraph is that— (a) on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018, (b) on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section, or (c) on a request under section 94(1)(b) of that Act (intelligence services processing: rights of access by the data subject), the information would be withheld in reliance on a provision of Chapter 6 of Part 4 of that Act. (1D) In this regulation— - “the data protection principles” means the principles set out in— 1. Article 5(1) of the GDPR, 2. section 34(1) of the Data Protection Act 2018, and 3. section 85(1) of that Act; - “data subject” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act); - “the GDPR” and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act); - “personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act). (1E) In determining for the purposes of this regulation whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.

(4) Omit paragraphs (2) to (4).

Data Protection (Processing of Sensitive Personal Data) Order 2006 (S.I. 2006/2068)

321

The Data Protection (Processing of Sensitive Personal Data) Order 2006 is revoked.

National Assembly for Wales (Representation of the People) Order 2007 (S.I. 2007/236)

322

(1) Paragraph 14 of Schedule 1 to the National Assembly for Wales (Representation of the People) Order 2007 (absent voting at Assembly elections: conditions on the use, supply and inspection of absent vote records or lists) is amended as follows.

(2) The existing text becomes sub-paragraph (1).

(3) For paragraph (a) of that sub-paragraph (but not the final “or”) substitute—

(a) purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);

(4) After that sub-paragraph insert—

(2) In this paragraph, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

Mental Capacity Act 2005 (Loss of Capacity during Research Project) (England) Regulations 2007 (S.I. 2007/679)

323

In regulation 3 of the Mental Capacity Act 2005 (Loss of Capacity during Research Project) (England) Regulations 2007 (research which may be carried out despite a participant's loss of capacity), for paragraph (b) substitute—

(b) any material used consists of or includes human cells or human DNA,

National Assembly for Wales Commission (Crown Status) Order 2007 (S.I. 2007/1118)

324

For article 5 of the National Assembly for Wales Commission (Crown Status) Order 2007 substitute—

(5) (1) The Assembly Commission is to be treated as a Crown body for the purposes of the Data Protection Act 2018 to the extent specified in this article. (2) The Assembly Commission is to be treated as a government department for the purposes of the following provisions— (a) section 8(d) (lawfulness of processing under the GDPR: public interest etc), (b) section 209 (application to the Crown), (c) paragraph 6 of Schedule 1 (statutory etc and government purposes), (d) paragraph 7 of Schedule 2 (exemptions from the GDPR: functions designed to protect the public etc), and (e) paragraph 8(1)(o) of Schedule 3 (exemptions from the GDPR: health data). (3) In the provisions mentioned in paragraph (4)— (a) references to employment by or under the Crown are to be treated as including employment as a member of staff of the Assembly Commission, and (b) references to a person in the service of the Crown are to be treated as including a person so employed. (4) The provisions are— (a) section 24(3) (exemption for certain data relating to employment under the Crown), and (b) section 209(6) (application of certain provisions to a person in the service of the Crown). (5) In this article, references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(14) of that Act).

Mental Capacity Act 2005 (Loss of Capacity during Research Project) (Wales) Regulations 2007 (S.I. 2007/837 (W.72))

325

In regulation 3 of the Mental Capacity Act 2005 (Loss of Capacity during Research Project) (Wales) Regulations 2007 (research which may be carried out despite a participant's loss of capacity) —

(a) in the English language text, for paragraph (c) substitute—

(c) any material used consists of or includes human cells or human DNA; and

, and

(b) in the Welsh language text, for paragraph (c) substitute—

(c) os yw unrhyw ddeunydd a ddefnyddir yn gelloedd dynol neu'n DNA dynol neu yn eu cynnwys; ac

Representation of the People (Absent Voting at Local Elections) (Scotland) Regulations 2007 (S.S.I. 2007/170)

326

(1) Regulation 18 of the Representation of the People (Absent Voting at Local Elections) (Scotland) Regulations 2007 (conditions on the supply and inspection of absent voter records or lists) is amended as follows.

(2) In paragraph (1), for sub-paragraph (a) (but not the final “or”) substitute—

(a) purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);

(3) After paragraph (1) insert—

(2) In this regulation, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

Representation of the People (Post-Local Government Elections Supply and Inspection of Documents) (Scotland) Regulations 2007 (S.S.I. 2007/264)

327

In regulation 5 of the Representation of the People (Post-Local Government Elections Supply and Inspection of Documents) (Scotland) Regulations 2007 (conditions on the use, supply and disclosure of documents open to public inspection)—

(a) in paragraph (2), for sub-paragraph (i) (but not the final “or”) substitute—

(i) purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);

, and

(b) after paragraph (3) insert—

(4) In this regulation, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

Education (Pupil Records and Reporting) (Transitional) Regulations (Northern Ireland) 2007 (S.R. (N.I.) 2007 No. 43)

328

The Education (Pupil Records and Reporting) (Transitional) Regulations (Northern Ireland) 2007 are amended as follows.

329

In regulation 2 (interpretation), at the appropriate place insert—

“the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018;

330

In regulation 10(2) (duties of Boards of Governors), for “documents which are the subject of an order under section 30(2) of the Data Protection Act 1998” substitute “ information to which the pupil to whom the information relates would have no right of access under the GDPR ”.

Representation of the People (Northern Ireland) Regulations 2008 (S.I. 2008/1741)

331

In regulation 118 of the Representation of the People (Northern Ireland) Regulations 2008 (conditions on the use, supply and disclosure of documents open to public inspection)—

(a) in paragraph (2), for “research purposes within the meaning of that term in section 33 of the Data Protection Act 1998” substitute “ purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics) ”, and

(b) after paragraph (3) insert—

(4) In this regulation, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

Companies Act 2006 (Extension of Takeover Panel Provisions) (Isle of Man) Order 2008 (S.I. 2008/3122)

332

In paragraph 1(c) of the Schedule to the Companies Act 2006 (Extension of Takeover Panel Provisions) (Isle of Man) Order 2008 (modifications with which Chapter 1 of Part 28 of the Companies Act 2006 extends to the Isle of Man), for “the Data Protection Act 1998 (c 29)” substitute “ the data protection legislation ”.

Controlled Drugs (Supervision of Management and Use) (Wales) Regulations 2008 (S.I. 2008/3239 (W.286))

333

The Controlled Drugs (Supervision of Management and Use) (Wales) Regulations 2008 are amended as follows.

334

In regulation 2(1) (interpretation)—

(a) at the appropriate place in the English language text insert—

“the GDPR” (“y GDPR”) and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act);

, and

(b) at the appropriate place in the Welsh language text insert—

“mae i “y GDPR” a chyfeiriadau at Atodlen 2 i Ddeddf Diogelu Data 2018 yr un ystyr ag a roddir i “the GDPR” a chyfeiriadau at yr Atodlen honno yn Rhannau 5 i 7 o'r Ddeddf honno (gweler adran 3(10), (11) a (14) o'r Ddeddf honno);”.

335

(1) Regulation 25 (duty to co-operate by disclosing information as regards relevant persons) is amended as follows.

(2) In paragraph (7)—

(a) in the English language text, at the end insert “ or the GDPR ”, and

(b) in the Welsh language text, at the end insert “neu'r GDPR”.

(3) For paragraph (8)—

(a) in the English language text substitute—

(8) In determining for the purposes of paragraph (7) whether disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this regulation.

, and

(b) in the Welsh language text substitute—

(8) Wrth benderfynu at ddibenion paragraff (7) a yw datgeliad wedi'i wahardd, mae i'w dybied at ddibenion paragraff 5(2) o Atodlen 2 i Ddeddf Diogelu Data 2018 a pharagraff 3(2) o Atodlen 11 i'r Ddeddf honno (esemptiadau rhag darpariaethau penodol o'r ddeddfwriaeth diogelu data: datgeliadau sy'n ofynnol gan y gyfraith) bod y datgeliad yn ofynnol gan y rheoliad hwn.

336

(1) Regulation 26 (responsible bodies requesting additional information be disclosed about relevant persons) is amended as follows.

(2) In paragraph (6)—

(a) in the English language text, at the end insert “ or the GDPR ”, and

(b) in the Welsh language text, at the end insert “neu'r GDPR”.

(3) For paragraph (7)—

(a) in the English language text substitute—

(7) In determining for the purposes of paragraph (6) whether disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this regulation.

, and

(b) in the Welsh language text substitute—

(7) Wrth benderfynu at ddibenion paragraff (6) a yw datgeliad wedi'i wahardd, mae i'w dybied at ddibenion paragraff 5(2) o Atodlen 2 i Ddeddf Diogelu Data 2018 a pharagraff 3(2) o Atodlen 11 i'r Ddeddf honno (esemptiadau rhag darpariaethau penodol o'r ddeddfwriaeth diogelu data: datgeliadau sy'n ofynnol gan y gyfraith) bod y datgeliad yn ofynnol gan y rheoliad hwn.

337

(1) Regulation 29 (occurrence reports) is amended as follows.

(2) In paragraph (3)—

(a) in the English language text, at the end insert “ or the GDPR ”, and

(b) in the Welsh language text, at the end insert “neu'r GDPR”.

(3) For paragraph (4)—

(a) in the English language text substitute—

(4) In determining for the purposes of paragraph (3) whether disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this regulation.

, and

(b) in the Welsh language text substitute—

(4) Wrth benderfynu at ddibenion paragraff (3) a yw datgeliad wedi'i wahardd, mae i'w dybied at ddibenion paragraff 5(2) o Atodlen 2 i Ddeddf Diogelu Data 2018 a pharagraff 3(2) o Atodlen 11 i'r Ddeddf honno (esemptiadau rhag darpariaethau penodol o'r ddeddfwriaeth diogelu data: datgeliadau sy'n ofynnol gan y gyfraith) bod y datgeliad yn ofynnol gan y rheoliad hwn.

Energy Order 2003 (Supply of Information) Regulations (Northern Ireland) 2008 (S.R. (N.I.) 2008 No. 3)

338

(1) Regulation 5 of the Energy Order 2003 (Supply of Information) Regulations (Northern Ireland) 2008 (information whose disclosure would be affected by the application of other legislation) is amended as follows.

(2) In paragraph (3)—

(a) omit “within the meaning of section 1(1) of the Data Protection Act 1998”, and

(b) for the words from “where” to the end substitute “ if the condition in paragraph (3A) or (3B) is satisfied ”.

(3) After paragraph (3) insert—

(3A) The condition in this paragraph is that the disclosure of the information to a member of the public— (a) would contravene any of the data protection principles, or (b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded. (3B) The condition in this paragraph is that the disclosure of the information to a member of the public would contravene— (a) Article 21 of the GDPR (general processing: right to object to processing), or (b) section 99 of the Data Protection Act 2018 (intelligence services processing: right to object to processing).

(4) After paragraph (4) insert—

(5) In this regulation— - “the data protection principles” means the principles set out in— 1. Article 5(1) of the GDPR, 2. section 34(1) of the Data Protection Act 2018, and 3. section 85(1) of that Act; - “the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act); - “personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act).

Companies (Disclosure of Address) Regulations 2009 (S.I. 2009/214)

339

(1) Paragraph 6 of Schedule 2 to the Companies (Disclosure of Address) Regulations 2009 (conditions for permitted disclosure to a credit reference agency) is amended as follows.

(2) The existing text becomes sub-paragraph (1).

(3) In paragraph (b) of that sub-paragraph, for sub-paragraph (ii) substitute—

(ii) for the purposes of ensuring that it complies with its data protection obligations;

(4) In paragraph (c) of that sub-paragraph—

(a) omit “or” at the end of sub-paragraph (i), and

(b) at the end insert

; or (iii) section 144 of the Data Protection Act 2018 (false statements made in response to an information notice) or section 148 of that Act (destroying or falsifying information and documents etc);

(5) After paragraph (c) of that sub-paragraph insert—

(d) has not been given a penalty notice under section 155 of the Data Protection Act 2018 in circumstances described in paragraph (c)(ii), other than a penalty notice that has been cancelled.

(6) After sub-paragraph (1) insert—

(2) In this paragraph, “data protection obligations”, in relation to a credit reference agency, means— (a) where the agency carries on business in the United Kingdom, obligations under the data protection legislation (as defined in section 3 of the Data Protection Act 2018); (b) where the agency carries on business in a EEA State other than the United Kingdom, obligations under— (i) the GDPR (as defined in section 3(10) of the Data Protection Act 2018), (ii) legislation made in exercise of powers conferred on member States under the GDPR (as so defined), and (iii) legislation implementing the Law Enforcement Directive (as defined in section 3(12) of the Data Protection Act 2018).

Overseas Companies Regulations 2009 (S.I. 2009/1801)

340

(1) Paragraph 6 of Schedule 2 to the Overseas Companies Regulations 2009 (conditions for permitted disclosure to a credit reference agency) is amended as follows.

(2) The existing text becomes sub-paragraph (1).

(3) In paragraph (b) of that sub-paragraph, for sub-paragraph (ii) substitute—

(ii) for the purposes of ensuring that it complies with its data protection obligations;

(4) In paragraph (c) of that sub-paragraph—

(a) omit “or” at the end of sub-paragraph (i), and

(b) at the end insert

; or (iii) section 144 of the Data Protection Act 2018 (false statements made in response to an information notice) or section 148 of that Act (destroying or falsifying information and documents etc);

(5) After paragraph (c) of that sub-paragraph insert—

(d) has not been given a penalty notice under section 155 of the Data Protection Act 2018 in circumstances described in paragraph (c)(ii), other than a penalty notice that has been cancelled.

(6) After sub-paragraph (1) insert—

(2) In this paragraph, “data protection obligations”, in relation to a credit reference agency, means— (a) where the agency carries on business in the United Kingdom, obligations under the data protection legislation (as defined in section 3 of the Data Protection Act 2018); (b) where the agency carries on business in a EEA State other than the United Kingdom, obligations under— (i) the GDPR (as defined in section 3(10) of the Data Protection Act 2018), (ii) legislation made in exercise of powers conferred on member States under the GDPR (as so defined), and (iii) legislation implementing the Law Enforcement Directive (as defined in section 3(12) of the Data Protection Act 2018).

Data Protection (Processing of Sensitive Personal Data) Order 2009 (S.I. 2009/1811)

341

The Data Protection (Processing of Sensitive Personal Data) Order 2009 is revoked.

Provision of Services Regulations 2009 (S.I. 2009/2999)

342

In regulation 25 of the Provision of Services Regulations 2009 (derogations from the freedom to provide services), for paragraph (d) substitute—

(d) matters covered by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation);

INSPIRE Regulations 2009 (S.I. 2009/3157)

343

(1) Regulation 9 of the INSPIRE Regulations 2009 (public access to spatial data sets and spatial data services) is amended as follows.

(2) In paragraph (2)—

(a) omit “or” at the end of sub-paragraph (a),

(b) for sub-paragraph (b) substitute—

(b) Article 21 of the GDPR (general processing: right to object to processing), or (c) section 99 of the Data Protection Act 2018 (intelligence services processing: right to object to processing).

, and

(3) After paragraph (7) insert—

(8) In this regulation— - “the data protection principles” means the principles set out in— 1. Article 5(1) of the GDPR, 2. section 34(1) of the Data Protection Act 2018, and 3. section 85(1) of that Act; - “the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act); - “personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act). (9) In determining for the purposes of this regulation whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.

INSPIRE (Scotland) Regulations 2009 (S.S.I. 2009/440)

344

(1) Regulation 10 of the INSPIRE (Scotland) Regulations 2009 (public access to spatial data sets and spatial data services) is amended as follows.

(2) In paragraph (2)—

(a) omit “or” at the end of sub-paragraph (a),

(b) for sub-paragraph (b) substitute—

(b) Article 21 of the GDPR (general processing: right to object to processing), or (c) section 99 of the Data Protection Act 2018 (intelligence services processing: right to object to processing).

, and

(3) After paragraph (6) insert—

(7) In this regulation— - “the data protection principles” means the principles set out in— 1. Article 5(1) of the GDPR, 2. section 34(1) of the Data Protection Act 2018, and 3. section 85(1) of that Act; - “the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act); - “personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act). (8) In determining for the purposes of this regulation whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.

Controlled Drugs (Supervision of Management and Use) Regulations (Northern Ireland) 2009 (S.R (N.I.) 2009 No. 225)

345

The Controlled Drugs (Supervision of Management and Use) Regulations (Northern Ireland) 2009 are amended as follows.

346

In regulation 2(2) (interpretation), at the appropriate place insert—

“the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act);

.”

347

(1) Regulation 25 (duty to co-operate by disclosing information as regards relevant persons) is amended as follows.

(2) In paragraph (7), at the end insert “ or the GDPR ”.

(3) For paragraph (8) substitute—

(8) In determining for the purposes of paragraph (7) whether disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this regulation.

348

(1) Regulation 26 (responsible bodies requesting additional information be disclosed about relevant persons) is amended as follows.

(2) In paragraph (6), at the end insert “ or the GDPR ”.

(3) For paragraph (7) substitute—

(7) In determining for the purposes of paragraph (6) whether disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this regulation.

349

(1) Regulation 29 (occurrence reports) is amended as follows.

(2) In paragraph (3), at the end insert “ or the GDPR ”.

(3) For paragraph (4) substitute—

(4) In determining for the purposes of paragraph (3) whether disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this regulation.

Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010 (S.I. 2010/31)

350

The Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010 are revoked.

Pharmacy Order 2010 (S.I. 2010/231)

351

The Pharmacy Order 2010 is amended as follows.

352

In article 3(1) (interpretation), omit the definition of “Directive 95/46/EC”.

353

(1) Article 9 (inspection and enforcement) is amended as follows.

(2) For paragraph (4) substitute—

(4) If a report that the Council proposes to publish pursuant to paragraph (3) includes personal data, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure of the personal data is required by paragraph (3) of this article.

(3) After paragraph (4) insert—

(5) In this article, “personal data” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(2) and (14) of that Act).

354

In article 33A (European professional card), after paragraph (2) insert—

(3) In Schedule 2A, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018.

355

(1) Article 49 (disclosure of information: general) is amended as follows.

(2) In paragraph (2)(a), after “enactment” insert “ or the GDPR ”.

(3) For paragraph (3) substitute—

(3) In determining for the purposes of paragraph (2)(a) whether a disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by paragraph (1) of this article.

(4) After paragraph (5) insert—

(6) In this article, “the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).

356

(1) Article 55 (professional performance assessments) is amended as follows.

(2) In paragraph (5)(a), after “enactment” insert “ or the GDPR ”.

(3) For paragraph (6) substitute—

(6) In determining for the purposes of paragraph (5)(a) whether a disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by paragraph (4) of this article.

(4) After paragraph (8) insert—

(9) In this article, “the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).

357

In article 67(6) (Directive 2005/36/EC: designation of competent authority etc.), after sub-paragraph (a) insert—

(aa) “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018;

358

(1) Schedule 2A (Directive 2005/36/EC: European professional card) is amended as follows.

(2) In paragraph 8(1) (access to data), for “Directive 95/46/EC)” substitute “ the GDPR ”.

(3) In paragraph 9 (processing data)—

(a) omit sub-paragraph (2) (deeming the Council to be the controller for the purposes of Directive 95/46/EC), and

(b) after sub-paragraph (2) insert—

(3) In this paragraph, “personal data” has the same meaning as in the Data Protection Act 2018 (see section 3(2) of that Act).

359

(1) The table in Schedule 3 (Directive 2005/36/EC: designation of competent authority etc.) is amended as follows.

(2) In the entry for Article 56(2), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.

(3) In the entry for Article 56a(4), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.

Data Protection (Monetary Penalties) Order 2010 (S.I. 2010/910)

360

The Data Protection (Monetary Penalties) Order 2010 is revoked.

National Employment Savings Trust Order 2010 (S.I. 2010/917)

361

The National Employment Savings Trust Order 2010 is amended as follows.

362

In article 2 (interpretation)—

(a) omit the definition of “data” and “personal data”, and

(b) at the appropriate place insert—

“personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act).

363

(1) Article 10 (disclosure of requested data to the Secretary of State) is amended as follows.

(2) In paragraph (1)—

(a) for “disclosure of data” substitute “ disclosure of information ”, and

(b) for “requested data” substitute “ requested information ”.

(3) In paragraph (2)—

(a) for “requested data” substitute “ requested information ”,

(b) for “those data are” substitute “ the information is ”, and

(4) In paragraph (3), for “requested data” substitute “ requested information ”.

(5) In paragraph (4), for “requested data” substitute “ requested information ”.

Local Elections (Northern Ireland) Order 2010 (S.I. 2010/2977)

364

(1) Schedule 3 to the Local Elections (Northern Ireland) Order 2010 (access to marked registers and other documents open to public inspection after an election) is amended as follows.

(2) In paragraph 1(1) (interpretation and general)—

(a) omit the definition of “research purposes”, and

(b) at the appropriate places insert—

“Article 89 GDPR purposes” means the purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);

;

“the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation);

(3) In paragraph 5(3) (restrictions on the use, supply and disclosure of documents open to public inspection), for “research purposes” substitute “ Article 89 GDPR purposes ”.

Pupil Information (Wales) Regulations 2011 (S.I. 2011/1942 (W.209))

365

(1) Regulation 5 of the Pupil Information (Wales) Regulations 2011 (duties of head teacher - educational records) is amended as follows.

(2) In paragraph (5)—

(a) in the English language text, for “documents which are subject to any order under section 30(2) of the Data Protection Act 1998” substitute

information— (a) which the head teacher could not lawfully disclose to the pupil under the GDPR, or (b) to which the pupil would have no right of access under the GDPR.

, and

(b) in the Welsh language text, for “ddogfennau sy'n ddarostyngedig i unrhyw orchymyn o dan adran 30(2) o Ddeddf Diogelu Data 1998” substitute

wybodaeth— (a) na allai'r pennaeth ei datgelu'n gyfreithlon i'r disgybl o dan y GDPR, neu (b) na fyddai gan y disgybl hawl mynediad ati o dan y GDPR.

(3) After paragraph (5)—

(a) in the English language text insert—

(6) In this regulation, “the GDPR” (“y GDPR”) means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018.

, and

(b) in the Welsh language text insert—

(6) Yn y rheoliad hwn, ystyr “y GDPR” (“the GDPR”) yw Rheoliad (EU) 2016/679 Senedd Ewrop a'r Cyngor dyddiedig 27 Ebrill 2016 ar ddiogelu personau naturiol o ran prosesu data personol a rhyddid symud data o'r fath (y Rheoliad Diogelu Data Cyffredinol), fel y'i darllenir ynghyd â Phennod 2 o Ran 2 o Ddeddf Diogelu Data 2018.

Debt Arrangement Scheme (Scotland) Regulations 2011 (S.S.I. 2011/141)

366

In Schedule 4 to the Debt Arrangement Scheme (Scotland) Regulations 2011 (payments distributors), omit paragraph 2.

Police and Crime Commissioner Elections Order 2012 (S.I. 2012/1917)

367

The Police and Crime Commissioner Elections Order 2012 is amended as follows.

368

(1) Schedule 2 (absent voting in Police and Crime Commissioner elections) is amended as follows.

(2) In paragraph 20 (absent voter lists: supply of copies etc)—

(a) in sub-paragraph (8), for paragraph (a) (but not the final “or”) substitute—

(a) purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);

, and

(b) after sub-paragraph (10) insert—

(11) In this paragraph, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

(3) In paragraph 24 (restriction on use of absent voter records or lists or the information contained in them)—

(a) in sub-paragraph (3), for paragraph (a) (but not the final “or”) substitute—

(a) purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics),

, and

(b) after that sub-paragraph insert—

(4) In this paragraph, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

369

(1) Schedule 10 (access to marked registers and other documents open to public inspection after an election) is amended as follows.

(2) In paragraph 1(2) (interpretation), omit paragraphs (c) and (d) (but not the final “and”).

(3) In paragraph 5 (restriction on use of documents or of information contained in them)—

(a) in sub-paragraph (3), for paragraph (a) (but not the final “or”) substitute—

(a) purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics),

, and

(b) after sub-paragraph (4) insert—

(5) In this paragraph, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

Data Protection (Processing of Sensitive Personal Data) Order 2012 (S.I. 2012/1978)

370

The Data Protection (Processing of Sensitive Personal Data) Order 2012 is revoked.

Neighbourhood Planning (Referendums) Regulations 2012 (S.I. 2012/2031)

371

Schedule 6 to the Neighbourhood Planning (Referendums) Regulations 2012 (registering to vote in a business referendum) is amended as follows.

372

(1) Paragraph 29(1) (interpretation of Part 8) is amended as follows.

(2) At the appropriate places insert—

“Article 89 GDPR purposes” means the purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);

;

“the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation);

(3) For the definition of “relevant conditions” substitute—

“relevant requirement” means the requirement under Article 89 of the GDPR, read with section 19 of the Data Protection Act 2018, that personal data processed for Article 89 GDPR purposes must be subject to appropriate safeguards;

(4) Omit the definition of “research purposes”.

373

In paragraph 32(3)(b)(i), for “section 11(3) of the Data Protection Act 1998” substitute “ section 122(5) of the Data Protection Act 2018 ”.

374

In paragraph 33(6) and (7) (supply of copy of business voting register to the British Library and restrictions on use), for “research purposes in compliance with the relevant conditions” substitute “ Article 89 GDPR purposes in accordance with the relevant requirement ”.

375

In paragraph 34(6) and (7) (supply of copy of business voting register to the Office of National Statistics and restrictions on use), for “research purposes in compliance with the relevant conditions” substitute “ Article 89 GDPR purposes in accordance with the relevant requirement ”.

376

In paragraph 39(8) and (97) (supply of copy of business voting register to public libraries and local authority archives services and restrictions on use), for “research purposes in compliance with the relevant conditions” substitute “ Article 89 GDPR purposes in accordance with the relevant requirement ”.

377

In paragraph 45(2) (conditions on the use, supply and disclosure of documents open to public inspection), for paragraph (a) (but not the final “or”) substitute—

(a) Article 89 GDPR purposes (as defined in paragraph 29),

Controlled Drugs (Supervision of Management and Use) Regulations 2013 (S.I. 2013/373)

378

(1) Regulation 20 of the Controlled Drugs (Supervision of Management and Use) Regulations 2013 (information management) is amended as follows.

(2) For paragraph (4) substitute—

(4) Where a CDAO, a responsible body or someone acting on their behalf is permitted to share information which includes personal data by virtue of a function under these Regulations, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this regulation.

(3) In paragraph (5), after “enactment” insert “ or the GDPR ”.

(4) After paragraph (6) insert—

(7) In this regulation, “the GDPR”, “personal data” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(2), (10), (11) and (14) of that Act).

Communications Act 2003 (Disclosure of Information) Order 2014 (S.I. 2014/1825)

379

(1) Article 3 of the Communications Act 2003 (Disclosure of Information) Order 2014 (specification of relevant functions) is amended as follows.

(2) The existing text becomes paragraph (1).

(3) In that paragraph, in sub-paragraph (a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(4) After that paragraph insert—

(2) In this article, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Criminal Justice and Data Protection (Protocol No. 36) Regulations 2014 (S.I. 2014/3141)

380

In the Criminal Justice and Data Protection (Protocol No. 36) Regulations 2014, omit Part 4 (data protection in relation to police and judicial co-operation in criminal matters).

Data Protection (Assessment Notices) (Designation of National Health Service Bodies) Order 2014 (S.I. 2014/3282)

381

The Data Protection (Assessment Notices) (Designation of National Health Service Bodies) Order 2014 is revoked.

The Control of Explosives Precursors etc Regulations (Northern Ireland) 2014 (S.R. (N.I.) 2014 No. 224)

382

In regulation 6 of the Control of Explosives Precursors etc Regulations (Northern Ireland) 2014 (applications)—

(a) in paragraph (9), omit sub-paragraph (b) and the word “and” before it, and

(b) in paragraph (11), omit the definition of “processing” and “sensitive personal data” and the word “and” before it.

Control of Poisons and Explosives Precursors Regulations 2015 (S.I. 2015/966)

383

In regulation 3 of the Control of Poisons and Explosives Precursors Regulations 2015 (applications in relation to licences under section 4A of the Poisons Act 1972)—

(a) in paragraph (7), omit sub-paragraph (b) and the word “and” before it, and

(b) omit paragraph (8).

Companies (Disclosure of Date of Birth Information) Regulations 2015 (S.I. 2015/1694)

384

(1) Paragraph 6 of Schedule 2 to the Companies (Disclosure of Date of Birth Information) Regulations 2015 (conditions for permitted disclosure to a credit reference agency) is amended as follows.

(2) The existing text becomes sub-paragraph (1).

(3) In paragraph (b) of that sub-paragraph, for sub-paragraph (ii) substitute—

(ii) for the purposes of ensuring that it complies with its data protection obligations;

(4) In paragraph (c) of that sub-paragraph—

(a) omit “or” at the end of sub-paragraph (i), and

(b) at the end insert

; or (iii) section 144 of the Data Protection Act 2018 (false statements made in response to an information notice) or section 148 of that Act (destroying or falsifying information and documents etc);

(5) After paragraph (c) of that sub-paragraph insert—

(d) has not been given a penalty notice under section 155 of the Data Protection Act 2018 in circumstances described in paragraph (c)(ii), other than a penalty notice that has been cancelled.

(6) After sub-paragraph (1) insert—

(2) In this paragraph, “data protection obligations”, in relation to a credit reference agency, means— (a) where the agency carries on business in the United Kingdom, obligations under the data protection legislation (as defined in section 3 of the Data Protection Act 2018); (b) where the agency carries on business in a EEA State other than the United Kingdom, obligations under— (i) the GDPR (as defined in section 3(10) of the Data Protection Act 2018), (ii) legislation made in exercise of powers conferred on member States under the GDPR (as so defined), and (iii) legislation implementing the Law Enforcement Directive (as defined in section 3(12) of the Data Protection Act 2018).

Small and Medium Sized Business (Credit Information) Regulations 2015 (S.I. 2015/1945)

385

The Small and Medium Sized Business (Credit Information) Regulations 2015 are amended as follows.

386

(1) Regulation 12 (criteria for the designation of a credit reference agency) is amended as follows.

(2) In paragraph (1)(b), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) After paragraph (2) insert—

(3) In this regulation, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

387

(1) Regulation 15 (access to and correction of information for individuals and small firms) is amended as follows.

(2) For paragraph (1) substitute—

(1) Section 13 of the Data Protection Act 2018 (rights of the data subject under the GDPR: obligations of credit reference agencies) applies in respect of a designated credit reference agency which is not a credit reference agency within the meaning of section 145(8) of the Consumer Credit Act 1974 as if it were such an agency.

(3) After paragraph (3) insert—

(4) In this regulation, the reference to section 13 of the Data Protection Act 2018 has the same meaning as in Parts 5 to 7 of that Act (see section 3(14) of that Act).

European Union (Recognition of Professional Qualifications) Regulations 2015 (S.I. 2015/2059)

388

The European Union (Recognition of Professional Qualifications) Regulations 2015 are amended as follows.

389

(1) Regulation 2(1) (interpretation) is amended as follows.

(2) Omit the definition of “Directive 95/46/EC”.

(3) At the appropriate place insert—

“the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018;

390

In regulation 5(5) (functions of competent authorities in the United Kingdom) for “Directives 95/46/EC” substitute “ the GDPR and Directive ”.

391

In regulation 45(3) (processing and access to data regarding the European Professional Card), for “Directive 95/46/EC” substitute “ the GDPR ”.

392

In regulation 46(1) (processing and access to data regarding the European Professional Card), for “Directive 95/46/EC” substitute “ the GDPR ”.

393

In regulation 48(2) (processing and access to data regarding the European Professional Card), omit paragraph (2) (deeming the relevant designated competent authorities to be controllers for the purposes of Directive 95/46/EC).

394

In regulation 66(3) (exchange of information), for “Directives 95/46/EC” substitute “ the GDPR and Directive ”.

Scottish Parliament (Elections etc) Order 2015 (S.S.I. 2015/425)

395

The Scottish Parliament (Elections etc) Order 2015 is amended as follows.

396

(1) Schedule 3 (absent voting) is amended as follows.

(2) In paragraph 16 (absent voting lists: supply of copies etc)—

(a) in sub-paragraph (4), for paragraph (a) (but not the final “or”) substitute—

(a) purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);

, and

(b) after sub-paragraph (10) insert—

(11) In this paragraph, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

(3) In paragraph 20 (restriction on use of absent voting lists)—

(a) in sub-paragraph (3), for paragraph (a) (but not the final “or”) substitute—

(a) purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);

, and

(b) after that sub-paragraph insert—

(4) In this paragraph, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

397

(1) Schedule 8 (access to marked registers and other documents open to public inspection after an election) is amended as follows.

(2) In paragraph 1(2) (interpretation), omit paragraphs (c) and (d) (but not the final “and”).

(3) In paragraph 5 (restriction on use of documents or of information contained in them)—

(a) in sub-paragraph (3), for paragraph (a) (but not the final “or”) substitute—

(a) purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);

, and

(b) after sub-paragraph (4) insert—

(5) In this paragraph, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

Recall of MPs Act 2015 (Recall Petition) Regulations 2016 (S.I. 2016/295)

398

In paragraph 1(3) of Schedule 3 to the Recall of MPs Act 2015 (Recall Petition) Regulations 2016 (access to marked registers after a petition), omit the definition of “relevant conditions”.

Register of People with Significant Control Regulations 2016 (S.I. 2016/339)

399

Schedule 4 to the Register of People with Significant Control Regulations 2016 (conditions for permitted disclosure) is amended as follows.

400

(1) Paragraph 6 (disclosure to a credit reference agency) is amended as follows.

(2) In sub-paragraph (b), for paragraph (ii) (together with the final “; and”) substitute—

(ii) for the purposes of ensuring that it complies with its data protection obligations;

(3) In sub-paragraph (c)—

(a) omit “or” at the end of paragraph (ii), and

(b) at the end insert—

(iv) section 144 of the Data Protection Act 2018 (false statements made in response to an information notice); or (v) section 148 of that Act (destroying or falsifying information and documents etc);

(4) After sub-paragraph (c) insert—

(d) has not been given a penalty notice under section 155 of the Data Protection Act 2018 in circumstances described in sub-paragraph (c)(iii), other than a penalty notice that has been cancelled.

401

In paragraph 12A (disclosure to a credit institution or a financial institution), for sub-paragraph (b) substitute—

(b) for the purposes of ensuring that it complies with its data protection obligations.

402

In Part 3 (interpretation), after paragraph 13 insert—

(14) In this Schedule, “data protection obligations”, in relation to a credit reference agency, a credit institution or a financial institution, means— (a) where the agency or institution carries on business in the United Kingdom, obligations under the data protection legislation (as defined in section 3 of the Data Protection Act 2018); (b) where the agency or institution carries on business in a EEA State other than the United Kingdom, obligations under— (i) the GDPR (as defined in section 3(10) of the Data Protection Act 2018), (ii) legislation made in exercise of powers conferred on member States under the GDPR (as so defined), and (iii) legislation implementing the Law Enforcement Directive (as defined in section 3(12) of the Data Protection Act 2018).

Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 (S.I. 2016/696)

403

The Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 are amended as follows.

404

In regulation 2(1) (interpretation), omit the definition of “the 1998 Act”.

405

In regulation 3(3) (supervision), omit “under the 1998 Act”.

406

For Schedule 2 substitute—

SCHEDULE 2 (1) For the purposes of enforcing these Regulations and the eIDAS Regulation, the following provisions of Parts 5 to 7 of the Data Protection Act 2018 apply with the modifications set out in paragraphs 2 to 26— (a) section 140 (publication by the Commissioner); (b) section 141 (notices from the Commissioner); (c) section 142 (information notices); (d) section 143 (information notices: restrictions); (e) section 144 (false statements made in response to an information notice); (f) section 145 (information orders); (g) section 146 (assessment notices); (h) section 147 (assessment notices: restrictions); (i) section 148 (destroying or falsifying information and documents etc); (j) section 149 (enforcement notices); (k) section 150 (enforcement notices: supplementary); (l) section 152 (enforcement notices: restrictions); (m) section 153 (enforcement notices: cancellation and variation); (n) section 154 and Schedule 15 (powers of entry and inspection); (o) section 155 and Schedule 16 (penalty notices); (p) section 156(4)(a) (penalty notices: restrictions); (q) section 157 (maximum amount of penalty); (r) section 159 (amount of penalties: supplementary); (s) section 160 (guidance about regulatory action); (t) section 161 (approval of first guidance about regulatory action); (u) section 162 (rights of appeal); (v) section 163 (determination of appeals); (w) section 164 (applications in respect of urgent notices); (x) section 180 (jurisdiction); (y) section 182(1), (2), (5), (7) and (13) (regulations and consultation); (z) section 196 (penalties for offences); (z1) section 197 (prosecution); (z2) section 202 (proceedings in the First-tier Tribunal: contempt); (z3) section 203 (Tribunal Procedure Rules). (2) The provisions listed in paragraph 1 have effect as if— (a) references to the Data Protection Act 2018 were references to the provisions of that Act as applied by these Regulations; (b) references to a particular provision of that Act were references to that provision as applied by these Regulations. (3) (1) Section 142 has effect as if subsections (9) and (10) were omitted. (2) In that section, subsection (1) has effect as if— (a) in paragraph (a)— (i) for “controller or processor” there were substituted “ trust service provider ”; (ii) for “the data protection legislation” there were substituted “ the eIDAS Regulation and the EITSET Regulations ”; (b) paragraph (b) were omitted. (3) In that section, subsection (2) has effect as if paragraph (a) were omitted. (4) (1) Section 143 has effect as if subsections (1) and (9) were omitted. (2) In that section— (a) subsections (3)(b) and (4)(b) have effect as if for “the data protection legislation” there were substituted “ the eIDAS Regulation or the EITSET Regulations ”; (b) subsection (7)(a) has effect as if for “this Act” there were substituted “ section 144 or 148 or paragraph 15 of Schedule 15 ”; (c) subsection (8) has effect as if for “this Act (other than an offence under section 144)” there were substituted “ section 148 or paragraph 15 of Schedule 15 ”. (5) Section 145(2)(b) has effect as if for “section 142(2)(b)” there were substituted “ section 142(2) ”. (6) (1) Section 146 has effect as if subsection (11) were omitted. (2) In that section— (a) subsection (1) has effect as if— (i) for “controller or processor” (in both places) there were substituted “ trust service provider ”; (ii) for “the data protection legislation” there were substituted “ the eIDAS requirements ”; (b) subsection (2) has effect as if paragraphs (h) and (i) were omitted; (c) subsections (7), (8), (9) and (10) have effect as if for “controller or processor” (in each place) there were substituted “trust service provider. (d) subsection (9)(a) has effect as if for “as described in section 149(2) or that an offence under this Act” there were substituted “ to comply with the eIDAS requirements or that an offence under section 144 or 148 or paragraph 15 of Schedule 15 ”. (7) (1) Section 147 has effect as if subsections (5) and (6) were omitted. (2) In that section, subsections (2)(b) and (3)(b) have effect as if for “the data protection legislation” there were substituted “ the eIDAS Regulation or the EITSET Regulations ”. (8) (1) Section 149 has effect as if subsections (2) to (5) and (7) to (9) were omitted. (2) In that section— (a) subsection (1) has effect as if— (i) for “as described in subsection (2), (3), (4) or (5)” there were substituted “ to comply with the eIDAS requirements ”; (ii) for “sections 150 and 151” there were substituted “ section 150 ”; (b) subsection (6) has effect as if the words “given in reliance on subsection (2), (3) or (5)” were omitted. (9) (1) Section 150 has effect as if subsection (3) were omitted. (2) In that section, subsection (2) has effect as if the words “in reliance on section 149(2)” and “or distress” were omitted. (10) Section 152 has effect as if subsections (1), (2) and (4) were omitted. (11) The provisions listed in paragraph 1 have effect as if after section 153 there were inserted— (153A) (1) The Commissioner may, by written notice (a “withdrawal notice”), withdraw the qualified status from a trust service provider, or the qualified status of a service provided by a trust service provider, if— (a) the Commissioner is satisfied that the trust service provider has failed to comply with an information notice or an enforcement notice, and (b) the condition in subsection (2) or (3) is met. (2) The condition in this subsection is met if the period for the trust service provider to appeal against the information notice or enforcement notice has ended without an appeal having been brought. (3) The condition in this subsection is met if an appeal against the information notice or enforcement notice has been brought and— (a) the appeal and any further appeal in relation to the notice has been decided or has otherwise ended, and (b) the time for appealing against the result of the appeal or further appeal has ended without another appeal having been brought. (4) A withdrawal notice must— (a) state when the withdrawal takes effect, and (b) provide information about the rights of appeal under section 162. (12) (1) Schedule 15 has effect as if paragraph 3 were omitted. (2) Paragraph 1(1) of that Schedule (issue of warrants in connection with non-compliance and offences) has effect as if for paragraph (a) (but not the final “and”) there were substituted— (a) there are reasonable grounds for suspecting that— (i) a trust service provider has failed or is failing to comply with the eIDAS requirements, or (ii) an offence under section 144 or 148 or paragraph 15 of Schedule 15 has been or is being committed, (3) Paragraph 2 of that Schedule (issue of warrants in connection with assessment notices) has effect as if— (a) in sub-paragraphs (1) and (2), for “controller or processor” there were substituted “ trust service provider ”; (b) in sub-paragraph (2), for “the data protection legislation” there were substituted “ the eIDAS requirements ”. (4) Paragraph 5 of that Schedule (content of warrants) has effect as if— (a) in sub-paragraph (1)(c), for “the processing of personal data” there were substituted “ the provision of trust services ”; (b) in sub-paragraph (2)(d)— (i) for “controller or processor” there were substituted “ trust service provider ”; (ii) for “as described in section 149(2)” there were substituted “ to comply with the eIDAS requirements ”; (c) in sub-paragraph (3)(a) and (d)— (i) for “controller or processor” there were substituted “ trust service provider ”; (ii) for “the data protection legislation” there were substituted “ the eIDAS requirements ”. (5) Paragraph 11 of that Schedule (privileged communications) has effect as if, in sub-paragraphs (1)(b) and (2)(b), for “the data protection legislation” there were substituted “ the eIDAS Regulation or the EITSET Regulations ”. (13) (1) Section 155 has effect as if subsections (1)(a), (2)(a), (3)(g), (4) and (6) to (8) were omitted. (2) Subsection (2) of that section has effect as if— (a) the words “Subject to subsection (4),” were omitted; (b) in paragraph (b), the words “to the extent that the notice concerns another matter,” were omitted. (3) Subsection (3) of that section has effect as if— (a) for “controller or processor”, in each place, there were substituted “ trust services provider ”; (b) in paragraph (c), the words “or distress” were omitted; (c) in paragraph (c), for “data subjects” there were substituted “ relying parties ”; (d) in paragraph (d), for “section 57, 66, 103 or 107” there were substituted “ Article 19(1) of the eIDAS Regulation ”. (14) Schedule 16 has effect as if paragraphs 3(2)(b) and 5(2)(b) were omitted. (15) Section 157 has effect as if subsections (1) to (3) and (6) were omitted. (16) Section 159 has effect as if— (a) in subsection (1), the words “Article 83 of the GDPR and” were omitted; (b) in subsection (2), the words “Article 83 of the GDPR” and “and section 158” were omitted. (17) (1) Section 160 has effect as if subsections (5) and (12) were omitted. (2) In that section, subsection (4)(f) has effect as if for “controllers and processors” there were substituted “ trust service providers ”. (18) (1) Section 162 has effect as if subsection (4) were omitted. (2) In that section, subsection (1) has effect as if, after paragraph (c), there were inserted— (ca) a withdrawal notice; (19) Section 163 has effect as if subsection (6) were omitted. (20) (1) Section 180 has effect as if subsections (2)(d) and (e) and (3) were omitted. (2) Subsection (1) of that section has effect as if for “subsections (3) and (4)” there were substituted “ subsection (4) ”. (21) Section 182 has effect as if subsections (3), (4), (6), (8) to (11) and (14) were omitted. (22) (1) Section 196 has effect as if subsections (3) to (5) were omitted. (2) In that section— (a) subsection (1) has effect as if the words “section 119 or 173 or” were omitted; (b) subsection (2) has effect as if for “section 132, 144, 148, 170, 171 or 184” there were substituted “ section 144 or 148 ”. (23) Section 197 has effect as if subsections (3) to (6) were omitted. (24) Section 202 has effect as if in subsection (1)(a), for sub-paragraphs (i) and (ii) there were substituted “ on an appeal under section 162 ”. (25) Section 203 has effect as if— (a) in subsection (1), for paragraphs (a) and (b) there were substituted “ the exercise of the rights of appeal conferred by section 162 ”; (b) in subsection (2)(a) and (b), for “the processing of personal data” there were substituted “ the provision of trust services ”. (26) (1) This paragraph applies if the first guidance produced under section 160(1) of the Data Protection Act 2018 and the first guidance produced under that provision as applied by this Schedule are laid before Parliament as a single document (“the combined guidance”). (2) Section 161 of that Act (including that section as applied by this Schedule) has effect as if the references to “the guidance” were references to the combined guidance, except in subsections (2)(b) and (4). (3) Nothing in subsection (2)(a) of that section (including as applied by this Schedule) prevents another version of the combined guidance being laid before Parliament. (4) Any duty under subsection (2)(b) of that section (including as applied by this Schedule) may be satisfied by producing another version of the combined guidance. (27) In this Schedule— - “the eIDAS requirements” means the requirements of Chapter III of the eIDAS Regulation; - “the EITSET Regulations” means these Regulations; - “withdrawal notice” has the meaning given in section 153A of the Data Protection Act 2018 (as inserted in that Act by this Schedule).

Court Files Privileged Access Rules (Northern Ireland) 2016 (S.R. (N.I.) 2016 No. 123)

407

The Court Files Privileged Access Rules (Northern Ireland) 2016 are amended as follows.

408

In rule 5 (information that may released) for “Schedule 1 of the Data Protection Act 1998” substitute

— (a) Article 5(1) of the GDPR, and (b) section 34(1) of the Data Protection Act 2018.

409

In rule 7(2) (provision of information) for “Schedule 1 of the Data Protection Act 1998” substitute

— (a) Article 5(1) of the GDPR, and (b) section 34(1) of the Data Protection Act 2018.

Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (S.I. 2017/692)

410

The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 are amended as follows.

411

In regulation 3(1) (interpretation), at the appropriate places insert—

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

;

“the GDPR” and references to provisions of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act);

412

In regulation 16(8) (risk assessment by the Treasury and Home Office), for “the Data Protection Act 1998 or any other enactment” substitute

— (a) the Data Protection Act 2018 or any other enactment, or (b) the GDPR.

413

In regulation 17(9) (risk assessment by supervisory authorities), for “the Data Protection Act 1998 or any other enactment” substitute

— (a) the Data Protection Act 2018 or any other enactment, or (b) the GDPR.

414

For regulation 40(9)(c) (record keeping) substitute—

(c) “data subject” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act); (d) “personal data” has the same meaning as in Parts 5 to 7 of that Act (see section 3(2) and (14) of that Act).

415

(1) Regulation 41 (data protection) is amended as follows.

(2) Omit paragraph (2).

(3) In paragraph (3)(a), after “Regulations” insert “ or the GDPR ”.

(4) Omit paragraphs (4) and (5).

(5) After those paragraphs insert—

(6) Before establishing a business relationship or entering into an occasional transaction with a new customer, as well as providing the customer with the information required under Article 13 of the GDPR (information to be provided where personal data are collected from the data subject), relevant persons must provide the customer with a statement that any personal data received from the customer will be processed only— (a) for the purposes of preventing money laundering or terrorist financing, or (b) as permitted under paragraph (3). (7) In Article 6(1) of the GDPR (lawfulness of processing), the reference in point (e) to processing of personal data that is necessary for the performance of a task carried out in the public interest includes processing of personal data in accordance with these Regulations that is necessary for the prevention of money laundering or terrorist financing. (8) In the case of sensitive processing of personal data for the purposes of the prevention of money laundering or terrorist financing, section 10 of, and Schedule 1 to, the Data Protection Act 2018 make provision about when the processing meets a requirement in Article 9(2) or 10 of the GDPR for authorisation under the law of the United Kingdom (see, for example, paragraphs 10, 11 and 12 of that Schedule). (9) In this regulation— - “data subject” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act); - “personal data” and “processing” have the same meaning as in Parts 5 to 7 of that Act (see section 3(2), (4) and (14) of that Act); - “sensitive processing” means the processing of personal data described in Article 9(1) or 10 of the GDPR (special categories of personal data and personal data relating to criminal convictions and offences etc).

416

(1) Regulation 84 (publication: the Financial Conduct Authority) is amended as follows.

(2) In paragraph (10), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) For paragraph (11) substitute—

(11) For the purposes of this regulation, “personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act).

417

(1) Regulation 85 (publication: the Commissioners) is amended as follows.

(2) In paragraph (9), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) For paragraph (10) substitute—

(10) For the purposes of this regulation, “personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act).

418

For regulation 106(a) (general restrictions) substitute—

(a) a disclosure in contravention of the data protection legislation; or

419

After paragraph 27 of Schedule 3 (relevant offences) insert—

(27A) An offence under the Data Protection Act 2018, apart from an offence under section 173 of that Act.

Scottish Partnerships (Register of People with Significant Control) Regulations 2017 (S.I. 2017/694)

420

(1) Paragraph 6 of Schedule 5 to the Scottish Partnerships (Register of People with Significant Control) Regulations 2017 (conditions for permitted disclosure to a credit institution or a financial institution) is amended as follows.

(2) The existing text becomes sub-paragraph (1).

(3) For paragraph (b) of that sub-paragraph substitute—

(b) for the purposes of ensuring that it complies with its data protection obligations.

(4) After sub-paragraph (1) insert—

(2) In this paragraph, “data protection obligations”, in relation to a relevant institution, means— (a) where the institution carries on business in the United Kingdom, obligations under the data protection legislation (as defined in section 3 of the Data Protection Act 2018); (b) where the institution carries on business in a EEA State other than the United Kingdom, obligations under— (i) the GDPR (as defined in section 3(10) of the Data Protection Act 2018), (ii) legislation made in exercise of powers conferred on member States under the GDPR (as so defined), and (iii) legislation implementing the Law Enforcement Directive (as defined in section 3(12) of the Data Protection Act 2018).

Data Protection (Charges and Information) Regulations 2018 (S.I. 2018/480)

421

In regulation 1(2) of the Data Protection (Charges and Information) Regulations 2018 (interpretation), at the appropriate places insert—

“data controller” means a person who is a controller for the purposes of Parts 5 to 7 of the Data Protection Act 2018 (see section 3(6) and (14) of that Act);

;

“personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act);

National Health Service (General Medical Services Contracts) (Scotland) Regulations 2018 (S.S.I. 2018/66)

422

The National Health Service (General Medical Services Contracts) (Scotland) Regulations 2018 are amended as follows.

423

(1) Regulation 1 (citation and commencement) is amended as follows.

(2) In paragraph (2), omit “Subject to paragraph (3),”.

(3) Omit paragraph (3).

424

In regulation 3(1) (interpretation)—

(a) omit the definition of “the 1998 Act”,

(b) at the appropriate place insert—

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

, and

425

(1) Schedule 6 (other contractual terms) is amended as follows.

(2) In paragraph 63(2) (interpretation: general), for “the 1998 Act or any directly applicable EU instrument relating to data protection” substitute

— (a) the data protection legislation, or (b) any directly applicable EU legislation which is not part of the data protection legislation but which relates to data protection.

(3) For paragraph 64 (meaning of data controller etc.) substitute—

(64A) For the purposes of this Part— - “controller” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(6) and (14) of that Act); - “data protection officer” means a person designated as a data protection officer under the data protection legislation; - “personal data” and “processing” have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) and (14) of that Act).

(4) In paragraph 65(2)(b) (roles, responsibilities and obligations: general), for “data controllers” substitute “ controllers ”.

(5) In paragraph 69(2)(a) (processing and access of data), for “the 1998 Act, and any directly applicable EU instrument relating to data protection;” substitute

— (i) the data protection legislation, and (ii) any directly applicable EU legislation which is not part of the data protection legislation but which relates to data protection;

(6) In paragraph 94(4) (variation of a contract: general)—

(a) omit paragraph (b), and

(b) after paragraph (d) (but before the final “and”) insert—

(da) the data protection legislation; (db) any directly applicable EU legislation which is not part of the data protection legislation but which relates to data protection;

National Health Service (Primary Medical Services Section 17C Agreements) (Scotland) Regulations 2018 (S.S.I. 2018/67)

426

The National Health Service (Primary Medical Services Section 17C Agreements) (Scotland) Regulations 2018 are amended as follows.

427

(1) Regulation 1 (citation and commencement) is amended as follows.

(2) In paragraph (2), omit “Subject to paragraph (3),”.

(3) Omit paragraph (3).

428

In regulation 3(1) (interpretation)—

(a) omit the definition of “the 1998 Act”, and

(b) at the appropriate place insert—

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

, and

429

(1) Schedule 1 (content of agreements) is amended as follows.

(2) In paragraph 34 (interpretation)—

(a) in sub-paragraph (1)—

(i) omit “Subject to sub-paragraph (3),”,

(ii) before paragraph (a) insert—

(za) “controller” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(6) and (14) of that Act); (zb) “data protection officer” means a person designated as a data protection officer under the data protection legislation;

, and

(iii) for paragraph (d) substitute—

(e) “personal data” and “processing” have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) and (14) of that Act).

(b) omit sub-paragraphs (2) and (3),

(c) in sub-paragraph (4), for “the 1998 Act and any directly applicable EU instrument relating to data protection” substitute

— (a) the data protection legislation, or (b) any directly applicable EU legislation which is not part of the data protection legislation but which relates to data protection.

, and

(d) in sub-paragraph (6)(b), for “data controllers” substitute “ controllers ”.

(3) In paragraph 37(2)(a) (processing and access of data), for “the 1998 Act, and any directly applicable EU instrument relating to data protection;” substitute

— (i) the data protection legislation, and (ii) any directly applicable EU legislation which is not part of the data protection legislation but which relates to data protection;

(4) In paragraph 61(3) (variation of agreement: general)—

(a) omit paragraph (b), and

(b) after paragraph (d) (but before the final “and”) insert—

(da) the data protection legislation; (db) any directly applicable EU legislation which is not part of the data protection legislation but which relates to data protection;

PART 3 — Modifications

Introduction

430

(1) Unless the context otherwise requires, legislation described in sub-paragraph (2) has effect on and after the day on which this Part of this Schedule comes into force as if it were modified in accordance with this Part of this Schedule.

(2) That legislation is—

(a) subordinate legislation made before the day on which this Part of this Schedule comes into force;

(b) primary legislation that is passed or made before the end of the Session in which this Act is passed.

(3) In this Part of this Schedule—

“primary legislation” has the meaning given in section 211(7);

“references” includes any references, however expressed.

General modifications

431

(1) References to a particular provision of, or made under, the Data Protection Act 1998 have effect as references to the equivalent provision or provisions of, or made under, the data protection legislation.

(2) Other references to the Data Protection Act 1998 have effect as references to the data protection legislation.

(3) References to disclosure, use or other processing of information that is prohibited or restricted by an enactment which include disclosure, use or other processing of information that is prohibited or restricted by the Data Protection Act 1998 have effect as if they included disclosure, use or other processing of information that is prohibited or restricted by the UK GDPR.

Specific modification of references to terms used in the Data Protection Act 1998

432

(1) References to personal data, and to the processing of such data, as defined in the Data Protection Act 1998, have effect as references to personal data, and to the processing of such data, as defined for the purposes of Parts 5 to 7 of this Act (see section 3(2), (4) and (14)).

(2) References to processing as defined in the Data Protection Act 1998, in relation to information, have effect as references to processing as defined in section 3(4).

(3) References to a data subject as defined in the Data Protection Act 1998 have effect as references to a data subject as defined in section 3(5).

(4) References to a data controller as defined in the Data Protection Act 1998 have effect as references to a controller as defined for the purposes of Parts 5 to 7 of this Act (see section 3(6) and (14)).

(5) References to the data protection principles set out in the Data Protection Act 1998 have effect as references to the principles set out in—

(a) Article 5(1) of the UK GDPR, and

(b) sections 34(1) and 85(1) of this Act.

(6) References to direct marketing as defined in section 11 of the Data Protection Act 1998 have effect as references to direct marketing as defined in section 122 of this Act.

(7) References to a health professional within the meaning of section 69(1) of the Data Protection Act 1998 have effect as references to a health professional within the meaning of section 204 of this Act.

(8) References to a health record within the meaning of section 68(2) of the Data Protection Act 1998 have effect as references to a health record within the meaning of section 205 of this Act.

PART 4 — Supplementary

Definitions

433

Section 3(14) does not apply to this Schedule.

Provision inserted in subordinate legislation by this Schedule

434

Provision inserted into subordinate legislation by this Schedule may be amended or revoked as if it had been inserted using the power under which the subordinate legislation was originally made.

SCHEDULE 20

PART 1 — General

Interpretation

1

(1) In this Schedule—

“the 1984 Act” means the Data Protection Act 1984;

“the 1998 Act” means the Data Protection Act 1998;

“the 2014 Regulations” means the Criminal Justice and Data Protection (Protocol No. 36) Regulations 2014 (S.I. 2014/3141);

“data controller” has the same meaning as in the 1998 Act (see section 1 of that Act);

“the old data protection principles” means the principles set out in—Part 1 of Schedule 1 to the 1998 Act, andregulation 30 of the 2014 Regulations.

(2) A provision of the 1998 Act that has effect by virtue of this Schedule is not, by virtue of that, part of the data protection legislation (as defined in section 3).

PART 2 — Rights of data subjects

Right of access to personal data under the 1998 Act

2

(1) The repeal of sections 7 to 9A of the 1998 Act (right of access to personal data) does not affect the application of those sections after the relevant time in a case in which a data controller received a request under section 7 of that Act (right of access to personal data) before the relevant time.

(2) The repeal of sections 7 and 8 of the 1998 Act and the revocation of regulation 44 of the 2014 Regulations (which applies those sections with modifications) do not affect the application of those sections and that regulation after the relevant time in a case in which a UK competent authority received a request under section 7 of the 1998 Act (as applied by that regulation) before the relevant time.

(3) The revocation of the relevant regulations, or their amendment by Schedule 19 to this Act, and the repeals and revocation mentioned in sub-paragraphs (1) and (2), do not affect the application of the relevant regulations after the relevant time in a case described in those sub-paragraphs.

(4) In this paragraph—

“the relevant regulations” means—the Data Protection (Subject Access) (Fees and Miscellaneous Provisions) Regulations 2000 (S.I. 2000/191);regulation 4 of, and Schedule 1 to, the Consumer Credit (Credit Reference Agency) Regulations 2000 (S.I. 2000/290);regulation 3 of the Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004 (S.I. 2004/3244);

“the relevant time” means the time when the repeal of section 7 of the 1998 Act comes into force;

“UK competent authority” has the same meaning as in Part 4 of the 2014 Regulations (see regulation 27 of those Regulations).

Right to prevent processing likely to cause damage or distress under the 1998 Act

3

(1) The repeal of section 10 of the 1998 Act (right to prevent processing likely to cause damage or distress) does not affect the application of that section after the relevant time in a case in which an individual gave notice in writing to a data controller under that section before the relevant time.

(2) In this paragraph, “the relevant time” means the time when the repeal of section 10 of the 1998 Act comes into force.

Right to prevent processing for purposes of direct marketing under the 1998 Act

4

(1) The repeal of section 11 of the 1998 Act (right to prevent processing for purposes of direct marketing) does not affect the application of that section after the relevant time in a case in which an individual gave notice in writing to a data controller under that section before the relevant time.

(2) In this paragraph, “the relevant time” means the time when the repeal of section 11 of the 1998 Act comes into force.

Automated processing under the 1998 Act

5

(1) The repeal of section 12 of the 1998 Act (rights in relation to automated decision-taking) does not affect the application of that section after the relevant time in relation to a decision taken by a person before that time if—

(a) in taking the decision the person failed to comply with section 12(1) of the 1998 Act, or

(b) at the relevant time—

(i) the person had not taken all of the steps required under section 12(2) or (3) of the 1998 Act, or

(ii) the period specified in section 12(2)(b) of the 1998 Act (for an individual to require a person to reconsider a decision) had not expired.

(2) In this paragraph, “the relevant time” means the time when the repeal of section 12 of the 1998 Act comes into force.

Compensation for contravention of the 1998 Act or Part 4 of the 2014 Regulations

6

(1) The repeal of section 13 of the 1998 Act (compensation for failure to comply with certain requirements) does not affect the application of that section after the relevant time in relation to damage or distress suffered at any time by reason of an act or omission before the relevant time.

(2) The revocation of regulation 45 of the 2014 Regulations (right to compensation) does not affect the application of that regulation after the relevant time in relation to damage or distress suffered at any time by reason of an act or omission before the relevant time.

(3) “The relevant time” means—

(a) in sub-paragraph (1), the time when the repeal of section 13 of the 1998 Act comes into force;

(b) in sub-paragraph (2), the time when the revocation of regulation 45 of the 2014 Regulation comes into force.

Rectification, blocking, erasure and destruction under the 1998 Act

7

(1) The repeal of section 14(1) to (3) and (6) of the 1998 Act (rectification, blocking, erasure and destruction of inaccurate personal data) does not affect the application of those provisions after the relevant time in a case in which an application was made under subsection (1) of that section before the relevant time.

(2) The repeal of section 14(4) to (6) of the 1998 Act (rectification, blocking, erasure and destruction: risk of further contravention in circumstances entitling data subject to compensation under section 13 of the 1998 Act) does not affect the application of those provisions after the relevant time in a case in which an application was made under subsection (4) of that section before the relevant time.

(3) In this paragraph, “the relevant time” means the time when the repeal of section 14 of the 1998 Act comes into force.

Jurisdiction and procedure under the 1998 Act

8

The repeal of section 15 of the 1998 Act (jurisdiction and procedure) does not affect the application of that section in connection with sections 7 to 14 of the 1998 Act as they have effect by virtue of this Schedule.

Exemptions under the 1998 Act

9

(1) The repeal of Part 4 of the 1998 Act (exemptions) does not affect the application of that Part after the relevant time in connection with a provision of Part 2 of the 1998 Act as it has effect after that time by virtue of paragraphs 2 to 7 of this Schedule.

(2) The revocation of the relevant Orders, and the repeal mentioned in sub-paragraph (1), do not affect the application of the relevant Orders after the relevant time in connection with a provision of Part 2 of the 1998 Act as it has effect as described in sub-paragraph (1).

(3) In this paragraph—

“the relevant Orders” means—the Data Protection (Corporate Finance Exemption) Order 2000 (S.I. 2000/184);the Data Protection (Subject Access Modification) (Health) Order 2000 (S.I. 2000/413);the Data Protection (Subject Access Modification) (Education) Order 2000 (S.I. 2000/414);the Data Protection (Subject Access Modification) (Social Work) Order 2000 (S.I. 2000/415);the Data Protection (Crown Appointments) Order 2000 (S.I. 2000/416);Data Protection (Miscellaneous Subject Access Exemptions) Order 2000 (S.I. 2000/419);Data Protection (Designated Codes of Practice) (No. 2) Order 2000 (S.I. 2000/1864);

“the relevant time” means the time when the repeal of the provision of Part 2 of the 1998 Act in question comes into force.

(4) As regards certificates issued under section 28(2) of the 1998 Act, see Part 5 of this Schedule.

Prohibition by this Act of requirement to produce relevant records

10

(1) In Schedule 18 to this Act, references to a record obtained in the exercise of a data subject access right include a record obtained at any time in the exercise of a right under section 7 of the 1998 Act.

(2) In section 184 of this Act, references to a “relevant record” include a record which does not fall within the definition in Schedule 18 to this Act (read with sub-paragraph (1)) but which, immediately before the relevant time, was a “relevant record” for the purposes of section 56 of the 1998 Act.

(3) In this paragraph, “the relevant time” means the time when the repeal of section 56 of the 1998 Act comes into force.

Avoidance under this Act of certain contractual terms relating to health records

11

In section 185 of this Act, references to a record obtained in the exercise of a data subject access right include a record obtained at any time in the exercise of a right under section 7 of the 1998 Act.

PART 3 — The UK GDPR and Part 2 of this Act

Exemptions from the GDPR: restrictions of rules in Articles 13 to 15 of the GDPR

12

In paragraph 20(2) of Schedule 2 to this Act (self-incrimination), the reference to an offence under this Act includes an offence under the 1998 Act or the 1984 Act.

Manual unstructured data held by FOI public authorities

13

Until the first regulations under section 24(8) of this Act come into force, “the appropriate maximum” for the purposes of that section is—

(a) where the controller is a public authority listed in Part 1 of Schedule 1 to the Freedom of Information Act 2000, £600, and

(b) otherwise, £450.

PART 4 — Law enforcement and intelligence services processing

Logging

14

(1) In relation to an automated processing system set up before 6 May 2016, subsections (1) to (3) of section 62 of this Act do not apply if and to the extent that compliance with them would involve disproportionate effort.

(2) Sub-paragraph (1) ceases to have effect at the beginning of 6 May 2026.

Regulation 50 of the 2014 Regulations (disapplication of the 1998 Act)

15

Nothing in this Schedule, read with the revocation of regulation 50 of the 2014 Regulations, has the effect of applying a provision of the 1998 Act to the processing of personal data to which Part 4 of the 2014 Regulations applies in a case in which that provision did not apply before the revocation of that regulation.

Maximum fee for data subject access requests to intelligence services

16

Until the first regulations under section 94(4)(b) of this Act come into force, the maximum amount of a fee that may be required by a controller under that section is £10.

PART 5 — National security certificates

National security certificates: processing of personal data under the 1998 Act

17

(1) The repeal of section 28(2) to (12) of the 1998 Act does not affect the application of those provisions after the relevant time with respect to the processing of personal data to which the 1998 Act (including as it has effect by virtue of this Schedule) applies.

(2) A certificate issued under section 28(2) of the 1998 Act continues to have effect after the relevant time with respect to the processing of personal data to which the 1998 Act (including as it has effect by virtue of this Schedule) applies.

(3) Where a certificate continues to have effect under sub-paragraph (2) after the relevant time, it may be revoked or quashed in accordance with section 28 of the 1998 Act after the relevant time.

(4) In this paragraph, “the relevant time” means the time when the repeal of section 28 of the 1998 Act comes into force.

National security certificates: processing of personal data under the 2018 Act

18

(1) This paragraph applies to a certificate issued under section 28(2) of the 1998 Act (an “old certificate”) which has effect immediately before the relevant time.

(2) If and to the extent that the old certificate provides protection with respect to personal data which corresponds to protection that could be provided by a certificate issued under section 27, 79 or 111 of this Act, the old certificate also has effect to that extent after the relevant time as if—

(a) it were a certificate issued under one or more of sections 27, 79 and 111 (as the case may be),

(b) it provided protection in respect of that personal data in relation to the corresponding provisions of this Act or the UK GDPR, and

(c) where it has effect as a certificate issued under section 79, it certified that each restriction in question is a necessary and proportionate measure to protect national security.

(3) Where an old certificate also has effect as if it were a certificate issued under one or more of sections 27, 79 and 111, that section has, or those sections have, effect accordingly in relation to the certificate.

(4) Where an old certificate has an extended effect because of sub-paragraph (2), section 130 of this Act does not apply in relation to it.

(5) An old certificate that has an extended effect because of sub-paragraph (2) provides protection only with respect to the processing of personal data that occurs during the period of 1 year beginning with the relevant time (and a Minister of the Crown may curtail that protection by wholly or partly revoking the old certificate).

(6) For the purposes of this paragraph—

(a) a reference to the protection provided by a certificate issued under—

(i) section 28(2) of the 1998 Act, or

(ii) section 27, 79 or 111 of this Act,

is a reference to the effect of the evidence that is provided by the certificate;

(b) protection provided by a certificate under section 28(2) of the 1998 Act is to be regarded as corresponding to protection that could be provided by a certificate under section 27, 79 or 111 of this Act where, in respect of provision in the 1998 Act to which the certificate under section 28(2) relates, there is corresponding provision in this Act or the UK GDPR to which a certificate under section 27, 79 or 111 could relate.

(7) In this paragraph, “the relevant time” means the time when the repeal of section 28 of the 1998 Act comes into force.

(8) In this paragraph, references to the UK GDPR do not include the EU GDPR as it was directly applicable to the United Kingdom before IP completion day (see paragraph 2 of Schedule 21).

PART 6 — The Information Commissioner

Appointment etc

19

(1) On and after the relevant day, the individual who was the Commissioner immediately before that day—

(a) continues to be the Commissioner,

(b) is to be treated as having been appointed under Schedule 12 to this Act, and

(i) beginning with the relevant day, and

(ii) lasting for 7 years less a period equal to the individual's pre-commencement term.

(2) On and after the relevant day, a resolution passed by the House of Commons for the purposes of paragraph 3 of Schedule 5 to the 1998 Act (salary and pension of Commissioner), and not superseded before that day, is to be treated as having been passed for the purposes of paragraph 4 of Schedule 12 to this Act.

(3) In this paragraph—

“pre-commencement term”, in relation to an individual, means the period during which the individual was the Commissioner before the relevant day;

“the relevant day” means the day on which Schedule 12 to this Act comes into force.

Accounts

20

(1) The repeal of paragraph 10 of Schedule 5 to the 1998 Act does not affect the duties of the Commissioner and the Comptroller and Auditor General under that paragraph in respect of the Commissioner's statement of account for the financial year beginning with 1 April 2017.

(2) The Commissioner's duty under paragraph 11 of Schedule 12 to this Act to prepare a statement of account for each financial year includes a duty to do so for the financial year beginning with 1 April 2018.

Annual report

21

(1) The repeal of section 52(1) of the 1998 Act (annual report) does not affect the Commissioner's duty under that subsection to produce a general report on the exercise of the Commissioner's functions under the 1998 Act during the period of 1 year beginning with 1 April 2017 and to lay it before Parliament.

(2) The repeal of section 49 of the Freedom of Information Act 2000 (annual report) does not affect the Commissioner's duty under that section to produce a general report on the exercise of the Commissioner's functions under that Act during the period of 1 year beginning with 1 April 2017 and to lay it before Parliament.

(3) The first report produced by the Commissioner under section 139 of this Act must relate to the period of 1 year beginning with 1 April 2018.

Fees etc received by the Commissioner

22

(1) The repeal of Schedule 5 to the 1998 Act (Information Commissioner) does not affect the application of paragraph 9 of that Schedule after the relevant time to amounts received by the Commissioner before the relevant time.

(2) In this paragraph, “the relevant time” means the time when the repeal of Schedule 5 to the 1998 Act comes into force.

23

Paragraph 10 of Schedule 12 to this Act applies only to amounts received by the Commissioner after the time when that Schedule comes into force.

Functions in connection with the Data Protection Convention

24

(1) The repeal of section 54(2) of the 1998 Act (functions to be discharged by the Commissioner for the purposes of Article 13 of the Data Protection Convention), and the revocation of the Data Protection (Functions of Designated Authority) Order 2000 (S.I. 2000/186), do not affect the application of articles 1 to 5 of that Order after the relevant time in relation to a request described in those articles which was made before that time.

(2) The references in paragraph 9 of Schedule 14 to this Act (Data Protection Convention: restrictions on use of information) to requests made or received by the Commissioner under paragraph 6 or 7 of that Schedule include a request made or received by the Commissioner under article 3 or 4 of the Data Protection (Functions of Designated Authority) Order 2000 (S.I. 2000/186).

(3) The repeal of section 54(7) of the 1998 Act (duty to notify the European Commission of certain approvals and authorisations) does not affect the application of that provision after the relevant time in relation to an approval or authorisation granted before the relevant time.

(4) In this paragraph, “the relevant time” means the time when the repeal of section 54 of the 1998 Act comes into force.

Co-operation with the European Commission: transfers of personal data outside the EEA

25

(1) The repeal of section 54(3) of the 1998 Act (co-operation by the Commissioner with the European Commission etc), and the revocation of the Data Protection (International Co-operation) Order 2000 (S.I. 2000/190), do not affect the application of articles 1 to 4 of that Order after the relevant time in relation to transfers that took place before the relevant time.

(2) In this paragraph—

“the relevant time” means the time when the repeal of section 54 of the 1998 Act comes into force;

“transfer” has the meaning given in article 2 of the Data Protection (International Co-operation) Order 2000 (S.I. 2000/190).

Charges payable to the Commissioner by controllers

26

(1) The Data Protection (Charges and Information) Regulations 2018 (S.I. 2018/480) have effect after the relevant time (until revoked) as if they were made under section 137 of this Act.

(2) In this paragraph, “the relevant time” means the time when section 137 of this Act comes into force.

Requests for assessment

27

(1) The repeal of section 42 of the 1998 Act (requests for assessment) does not affect the application of that section after the relevant time in a case in which the Commissioner received a request under that section before the relevant time, subject to sub-paragraph (2).

(2) The Commissioner is only required to make an assessment of acts and omissions that took place before the relevant time.

(3) In this paragraph, “the relevant time” means the time when the repeal of section 42 of the 1998 Act comes into force.

Codes of practice

28

(1) The repeal of section 52E of the 1998 Act (effect of codes of practice) does not affect the application of that section after the relevant time in relation to legal proceedings or to the exercise of the Commissioner's functions under the 1998 Act as it has effect by virtue of this Schedule.

(2) In section 52E of the 1998 Act, as it has effect by virtue of this paragraph, the references to the 1998 Act include that Act as it has effect by virtue of this Schedule.

(3) For the purposes of subsection (3) of that section, as it has effect by virtue of this paragraph, the data-sharing code and direct marketing code in force immediately before the relevant time are to be treated as having continued in force after that time.

(4) In this paragraph—

“the data-sharing code” and “the direct marketing code” mean the codes respectively prepared under sections 52A and 52AA of the 1998 Act and issued under section 52B(5) of that Act;

“the relevant time” means the time when the repeal of section 52E of the 1998 Act comes into force.

PART 7 — Enforcement etc under the 1998 Act

Interpretation of this Part

29

(1) In this Part of this Schedule, references to contravention of the sixth data protection principle sections are to relevant contravention of any of sections 7, 10, 11 or 12 of the 1998 Act, as they continue to have effect by virtue of this Schedule after their repeal (and references to compliance with the sixth data protection principle sections are to be read accordingly).

(2) In sub-paragraph (1), “relevant contravention” means contravention in a manner described in paragraph 8 of Part 2 of Schedule 1 to the 1998 Act (sixth data protection principle).

Information notices

30

(1) The repeal of section 43 of the 1998 Act (information notices) does not affect the application of that section after the relevant time in a case in which—

(a) the Commissioner served a notice under that section before the relevant time (and did not cancel it before that time), or

(b) the Commissioner requires information after the relevant time for the purposes of—

(i) responding to a request made under section 42 of the 1998 Act before that time,

(ii) determining whether a data controller complied with the old data protection principles before that time, or

(iii) determining whether a data controller complied with the sixth data protection principle sections after that time.

(2) In section 43 of the 1998 Act, as it has effect by virtue of this paragraph—

(a) the reference to an offence under section 47 of the 1998 Act includes an offence under section 144 of this Act, and

(b) the references to an offence under the 1998 Act include an offence under this Act.

(3) In this paragraph, “the relevant time” means the time when the repeal of section 43 of the 1998 Act comes into force.

Special information notices

31

(1) The repeal of section 44 of the 1998 Act (special information notices) does not affect the application of that section after the relevant time in a case in which—

(a) the Commissioner served a notice under that section before the relevant time (and did not cancel it before that time), or

(b) the Commissioner requires information after the relevant time for the purposes of—

(i) responding to a request made under section 42 of the 1998 Act before that time, or

(ii) ascertaining whether section 44(2)(a) or (b) of the 1998 Act was satisfied before that time.

(2) In section 44 of the 1998 Act, as it has effect by virtue of this paragraph—

(a) the reference to an offence under section 47 of the 1998 Act includes an offence under section 144 of this Act, and

(b) the references to an offence under the 1998 Act include an offence under this Act.

(3) In this paragraph, “the relevant time” means the time when the repeal of section 44 of the 1998 Act comes into force.

Assessment notices

32

(1) The repeal of sections 41A and 41B of the 1998 Act (assessment notices) does not affect the application of those sections after the relevant time in a case in which—

(a) the Commissioner served a notice under section 41A of the 1998 Act before the relevant time (and did not cancel it before that time), or

(b) the Commissioner considers it appropriate, after the relevant time, to investigate—

(i) whether a data controller complied with the old data protection principles before that time, or

(ii) whether a data controller complied with the sixth data protection principle sections after that time.

(2) The revocation of the Data Protection (Assessment Notices) (Designation of National Health Service Bodies) Order 2014 (S.I. 2014/3282), and the repeals mentioned in sub-paragraph (1), do not affect the application of that Order in a case described in sub-paragraph (1).

(3) Sub-paragraph (1) does not enable the Secretary of State, after the relevant time, to make an order under section 41A(2)(b) or (c) of the 1998 Act (data controllers on whom an assessment notice may be served) designating a public authority or person for the purposes of that section.

(4) Section 41A of the 1998 Act, as it has effect by virtue of sub-paragraph (1), has effect as if subsections (8) and (11) (duty to review designation orders) were omitted.

(5) The repeal of section 41C of the 1998 Act (code of practice about assessment notice) does not affect the application, after the relevant time, of the code issued under that section and in force immediately before the relevant time in relation to the exercise of the Commissioner's functions under and in connection with section 41A of the 1998 Act, as it has effect by virtue of sub-paragraph (1).

(6) In this paragraph, “the relevant time” means the time when the repeal of section 41A of the 1998 Act comes into force.

Enforcement notices

33

(1) The repeal of sections 40 and 41 of the 1998 Act (enforcement notices) does not affect the application of those sections after the relevant time in a case in which—

(a) the Commissioner served a notice under section 40 of the 1998 Act before the relevant time (and did not cancel it before that time), or

(b) the Commissioner is satisfied, after that time, that a data controller —

(i) contravened the old data protection principles before that time, or

(ii) contravened the sixth data protection principle sections after that time.

(2) In this paragraph, “the relevant time” means the time when the repeal of section 40 of the 1998 Act comes into force.

Determination by Commissioner as to the special purposes

34

(1) The repeal of section 45 of the 1998 Act (determination by Commissioner as to the special purposes) does not affect the application of that section after the relevant time in a case in which—

(a) the Commissioner made a determination under that section before the relevant time, or

(b) the Commissioner considers it appropriate, after the relevant time, to make a determination under that section.

(2) In this paragraph, “the relevant time” means the time when the repeal of section 45 of the 1998 Act comes into force.

Restriction on enforcement in case of processing for the special purposes

35

(1) The repeal of section 46 of the 1998 Act (restriction on enforcement in case of processing for the special purposes) does not affect the application of that section after the relevant time in relation to an enforcement notice or information notice served under the 1998 Act—

(a) before the relevant time, or

(b) after the relevant time in reliance on this Schedule.

(2) In this paragraph, “the relevant time” means the time when the repeal of section 46 of the 1998 Act comes into force.

Offences

36

(1) The repeal of sections 47, 60 and 61 of the 1998 Act (offences of failing to comply with certain notices and of providing false information etc in response to a notice) does not affect the application of those sections after the relevant time in connection with an information notice, special information notice or enforcement notice served under Part 5 of the 1998 Act—

(a) before the relevant time, or

(b) after that time in reliance on this Schedule.

(2) In this paragraph, “the relevant time” means the time when the repeal of section 47 of the 1998 Act comes into force.

Powers of entry

37

(1) The repeal of sections 50, 60 and 61 of, and Schedule 9 to, the 1998 Act (powers of entry) does not affect the application of those provisions after the relevant time in a case in which—

(a) a warrant issued under that Schedule was in force immediately before the relevant time,

(b) before the relevant time, the Commissioner supplied information on oath for the purposes of obtaining a warrant under that Schedule but that had not been considered by a circuit judge or a District Judge (Magistrates' Courts), or

(c) after the relevant time, the Commissioner supplies information on oath to a circuit judge or a District Judge (Magistrates' Courts) in respect of—

(i) a contravention of the old data protection principles before the relevant time;

(ii) a contravention of the sixth data protection principle sections after the relevant time;

(iii) the commission of an offence under a provision of the 1998 Act (including as the provision has effect by virtue of this Schedule);

(iv) a failure to comply with a requirement imposed by an assessment notice issued under section 41A the 1998 Act (including as it has effect by virtue of this Schedule).

(2) In paragraph 16 of Schedule 9 to the 1998 Act, as it has effect by virtue of this paragraph, the reference to an offence under paragraph 12 of that Schedule includes an offence under paragraph 15 of Schedule 15 to this Act.

(3) In this paragraph, “the relevant time” means the time when the repeal of Schedule 9 to the 1998 Act comes into force.

(4) Paragraphs 14 and 15 of Schedule 9 to the 1998 Act (application of that Schedule to Scotland and Northern Ireland) apply for the purposes of this paragraph as they apply for the purposes of that Schedule.

Monetary penalties

38

(1) The repeal of sections 55A, 55B, 55D and 55E of the 1998 Act (monetary penalties) does not affect the application of those provisions after the relevant time in a case in which—

(a) the Commissioner served a monetary penalty notice under section 55A of the 1998 Act before the relevant time,

(b) the Commissioner served a notice of intent under section 55B of the 1998 Act before the relevant time, or

(c) the Commissioner considers it appropriate, after the relevant time, to serve a notice mentioned in paragraph (a) or (b) in respect of—

(i) a contravention of section 4(4) of the 1998 Act before the relevant time, or

(ii) a contravention of the sixth data protection principle sections after the relevant time.

(2) The revocation of the relevant subordinate legislation, and the repeals mentioned in sub-paragraph (1), do not affect the application of the relevant subordinate legislation (or of provisions of the 1998 Act applied by them) after the relevant time in a case described in sub-paragraph (1).

(3) Guidance issued under section 55C of the 1998 Act (guidance about monetary penalty notices) which is in force immediately before the relevant time continues in force after that time for the purposes of the Commissioner's exercise of functions under sections 55A and 55B of the 1998 Act as they have effect by virtue of this paragraph.

(4) In this paragraph—

“the relevant subordinate legislation” means—the Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010 (S.I. 2010/31);the Data Protection (Monetary Penalties) Order 2010 (S.I. 2010/910);

“the relevant time” means the time when the repeal of section 55A of the 1998 Act comes into force.

Appeals

39

(1) The repeal of sections 48 and 49 of the 1998 Act (appeals) does not affect the application of those sections after the relevant time in relation to a notice served under the 1998 Act or a determination made under section 45 of that Act—

(a) before the relevant time, or

(b) after that time in reliance on this Schedule.

(2) In this paragraph, “the relevant time” means the time when the repeal of section 48 of the 1998 Act comes into force.

Exemptions

40

(1) The repeal of section 28 of the 1998 Act (national security) does not affect the application of that section after the relevant time for the purposes of a provision of Part 5 of the 1998 Act as it has effect after that time by virtue of the preceding paragraphs of this Part of this Schedule.

(2) In this paragraph, “the relevant time” means the time when the repeal of the provision of Part 5 of the 1998 Act in question comes into force.

(3) As regards certificates issued under section 28(2) of the 1998 Act, see Part 5 of this Schedule.

Tribunal Procedure Rules

41

(1) The repeal of paragraph 7 of Schedule 6 to the 1998 Act (Tribunal Procedure Rules) does not affect the application of that paragraph, or of rules made under that paragraph, after the relevant time in relation to the exercise of rights of appeal conferred by section 28 or 48 of the 1998 Act, as they have effect by virtue of this Schedule.

(2) Part 3 of Schedule 19 to this Act does not apply for the purposes of Tribunal Procedure Rules made under paragraph 7(1)(a) of Schedule 6 to the 1998 Act as they apply, after the relevant time, in relation to the exercise of rights of appeal described in sub-paragraph (1).

(3) In this paragraph, “the relevant time” means the time when the repeal of paragraph 7 of Schedule 6 to the 1998 Act comes into force.

Obstruction etc

42

(1) The repeal of paragraph 8 of Schedule 6 to the 1998 Act (obstruction etc in proceedings before the Tribunal) does not affect the application of that paragraph after the relevant time in relation to an act or omission in relation to proceedings under the 1998 Act (including as it has effect by virtue of this Schedule).

(2) In this paragraph, “the relevant time” means the time when the repeal of paragraph 8 of Schedule 6 to the 1998 Act comes into force.

Enforcement etc under the 2014 Regulations

43

(1) The references in the preceding paragraphs of this Part of this Schedule to provisions of the 1998 Act include those provisions as applied, with modifications, by regulation 51 of the 2014 Regulations (other functions of the Commissioner).

(2) The revocation of regulation 51 of the 2014 Regulations does not affect the application of those provisions of the 1998 Act (as so applied) as described in those paragraphs.

PART 8 — Enforcement etc under this Act

Information notices

44

In section 143 of this Act—

(a) the reference to an offence under section 144 of this Act includes an offence under section 47 of the 1998 Act (including as it has effect by virtue of this Schedule), and

(b) the references to an offence under this Act include an offence under the 1998 Act (including as it has effect by virtue of this Schedule) or the 1984 Act.

Powers of entry

45

In paragraph 16 of Schedule 15 to this Act (powers of entry: self-incrimination), the reference to an offence under paragraph 15 of that Schedule includes an offence under paragraph 12 of Schedule 9 to the 1998 Act (including as it has effect by virtue of this Schedule).

Tribunal Procedure Rules

46

(1) Tribunal Procedure Rules made under paragraph 7(1)(a) of Schedule 6 to the 1998 Act (appeal rights under the 1998 Act) and in force immediately before the relevant time have effect after that time as if they were also made under section 203 of this Act.

(2) In this paragraph, “the relevant time” means the time when the repeal of paragraph 7(1)(a) of Schedule 6 to the 1998 Act comes into force.

PART 9 — Other enactments

Powers to disclose information to the Commissioner

47

(1) The following provisions (as amended by Schedule 19 to this Act) have effect after the relevant time as if the matters they refer to included a matter in respect of which the Commissioner could exercise a power conferred by a provision of Part 5 of the 1998 Act, as it has effect by virtue of this Schedule—

(a) section 11AA(1)(a) of the Parliamentary Commissioner Act 1967 (disclosure of information by Parliamentary Commissioner);

(b) sections 33A(1)(a) and 34O(1)(a) of the Local Government Act 1974 (disclosure of information by Local Commissioner);

(c) section 18A(1)(a) of the Health Service Commissioners Act 1993 (disclosure of information by Health Service Commissioner);

(d) paragraph 1 of the entry for the Information Commissioner in Schedule 5 to the Scottish Public Services Ombudsman Act 2002 (asp 11) (disclosure of information by the Ombudsman);

(e) section 34X(3)(a) of the Public Services Ombudsman (Wales) Act 2005 (disclosure of information by the Ombudsman);

(f) section 18(6)(a) of the Commissioner for Older People (Wales) Act 2006 (disclosure of information by the Commissioner);

(g) section 22(3)(a) of the Welsh Language (Wales) Measure 2011 (nawm 1) (disclosure of information by the Welsh Language Commissioner);

(h) section 49(3)(a) of the Public Services Ombudsman Act (Northern Ireland) 2016 (c. 4 (N.I.))(disclosure of information by the Ombudsman);

(i) section 44(3)(a) of the Justice Act (Northern Ireland) 2016 (c. 21 (N.I.)) (disclosure of information by the Prison Ombudsman for Northern Ireland).

(2) The following provisions (as amended by Schedule 19 to this Act) have effect after the relevant time as if the offences they refer to included an offence under any provision of the 1998 Act other than paragraph 12 of Schedule 9 to that Act (obstruction of execution of warrant)—

(a) section 11AA(1)(b) of the Parliamentary Commissioner Act 1967;

(b) sections 33A(1)(b) and 34O(1)(b) of the Local Government Act 1974;

(d) paragraph 2 of the entry for the Information Commissioner in Schedule 5 to the Scottish Public Services Ombudsman Act 2002 (asp 11);

(e) section 34X(5) of the Public Services Ombudsman (Wales) Act 2005 (disclosure of information by the Ombudsman);

(f) section 18(8) of the Commissioner for Older People (Wales) Act 2006;

(g) section 22(5) of the Welsh Language (Wales) Measure 2011 (nawm 1);

(h) section 49(5) of the Public Services Ombudsman Act (Northern Ireland) 2016 (c. 4 (N.I.));

(i) section 44(3)(b) of the Justice Act (Northern Ireland) 2016 (c. 21 (N.I.)).

(3) In this paragraph, “the relevant time”, in relation to a provision of a section or Schedule listed in sub-paragraph (1) or (2), means the time when the amendment of the section or Schedule by Schedule 19 to this Act comes into force.

Codes etc required to be consistent with the Commissioner’s data-sharing code

48

(1) This paragraph applies in relation to the code of practice issued under each of the following provisions—

(a) section 19AC of the Registration Service Act 1953 (code of practice about disclosure of information by civil registration officials);

(b) section 43 of the Digital Economy Act 2017 (code of practice about disclosure of information to improve public service delivery);

(d) section 60 of that Act (code of practice about disclosure of information to combat fraud against the public sector);

(e) section 70 of that Act (code of practice about disclosure of information for research purposes).

(2) During the relevant period, the code of practice does not have effect to the extent that it is inconsistent with the code of practice prepared under section 121 of this Act (data-sharing code) and issued under section 125(4) of this Act (as altered or replaced from time to time).

(3) In this paragraph, “the relevant period”, in relation to a code issued under a section mentioned in sub-paragraph (1), means the period—

(a) beginning when the amendments of that section in Schedule 19 to this Act come into force, and

(b) ending when the code is first reissued under that section.

49

(1) This paragraph applies in relation to the original statement published under section 45E of the Statistics and Registration Service Act 2007 (statement of principles and procedures in connection with access to information by the Statistics Board).

(2) During the relevant period, the statement does not have effect to the extent that it is inconsistent with the code of practice prepared under section 121 of this Act (data-sharing code) and issued under section 125(4) of this Act (as altered or replaced from time to time).

(3) In this paragraph, “the relevant period” means the period—

(a) beginning when the amendments of section 45E of the Statistics and Registration Service Act 2007 in Schedule 19 to this Act come into force, and

(b) ending when the first revised statement is published under that section.

Consumer Credit Act 1974

50

In section 159(1)(a) of the Consumer Credit Act 1974 (correction of wrong information) (as amended by Schedule 19 to this Act), the reference to information given under Article 15(1) to (3) of the UK GDPR includes information given at any time under section 7 of the 1998 Act.

Freedom of Information Act 2000

51

Paragraphs 52 to 55 make provision about the Freedom of Information Act 2000 (“the 2000 Act”).

52

(1) This paragraph applies where a request for information was made to a public authority under the 2000 Act before the relevant time.

(2) To the extent that the request is dealt with after the relevant time, the amendments of sections 2 and 40 of the 2000 Act in Schedule 19 to this Act have effect for the purposes of determining whether the authority deals with the request in accordance with Part 1 of the 2000 Act.

(3) To the extent that the request was dealt with before the relevant time—

(a) the amendments of sections 2 and 40 of the 2000 Act in Schedule 19 to this Act do not have effect for the purposes of determining whether the authority dealt with the request in accordance with Part 1 of the 2000 Act, but

(b) the powers of the Commissioner and the Tribunal, on an application or appeal under the 2000 Act, do not include power to require the authority to take steps which it would not be required to take in order to comply with Part 1 of the 2000 Act as amended by Schedule 19 to this Act.

(4) In this paragraph—

“public authority” has the same meaning as in the 2000 Act;

“the relevant time” means the time when the amendments of sections 2 and 40 of the 2000 Act in Schedule 19 to this Act come into force.

53

(1) Tribunal Procedure Rules made under paragraph 7(1)(b) of Schedule 6 to the 1998 Act (appeal rights under the 2000 Act) and in force immediately before the relevant time have effect after that time as if they were also made under section 61 of the 2000 Act (as inserted by Schedule 19 to this Act).

(2) In this paragraph, “the relevant time” means the time when the repeal of paragraph 7(1)(b) of Schedule 6 to the 1998 Act comes into force.

54

(1) The repeal of paragraph 8 of Schedule 6 to the 1998 Act (obstruction etc in proceedings before the Tribunal) does not affect the application of that paragraph after the relevant time in relation to an act or omission before that time in relation to an appeal under the 2000 Act.

(2) In this paragraph, “the relevant time” means the time when the repeal of paragraph 8 of Schedule 6 to the 1998 Act comes into force.

55

(1) The amendment of section 77 of the 2000 Act in Schedule 19 to this Act (offence of altering etc record with intent to prevent disclosure: omission of reference to section 7 of the 1998 Act) does not affect the application of that section after the relevant time in relation to a case in which—

(a) the request for information mentioned in section 77(1) of the 2000 Act was made before the relevant time, and

(b) when the request was made, section 77(1)(b) of the 2000 Act was satisfied by virtue of section 7 of the 1998 Act.

(2) In this paragraph, “the relevant time” means the time when the repeal of section 7 of the 1998 Act comes into force.

Freedom of Information (Scotland) Act 2002

56

(1) This paragraph applies where a request for information was made to a Scottish public authority under the Freedom of Information (Scotland) Act 2002 (“the 2002 Act”) before the relevant time.

(2) To the extent that the request is dealt with after the relevant time, the amendments of the 2002 Act in Schedule 19 to this Act have effect for the purposes of determining whether the authority deals with the request in accordance with Part 1 of the 2002 Act.

(3) To the extent that the request was dealt with before the relevant time—

(a) the amendments of the 2002 Act in Schedule 19 to this Act do not have effect for the purposes of determining whether the authority dealt with the request in accordance with Part 1 of the 2002 Act, but

(b) the powers of the Scottish Information Commissioner and the Court of Session, on an application or appeal under the 2002 Act, do not include power to require the authority to take steps which it would not be required to take in order to comply with Part 1 of the 2002 Act as amended by Schedule 19 to this Act.

(4) In this paragraph—

“Scottish public authority” has the same meaning as in the 2002 Act;

“the relevant time” means the time when the amendments of the 2002 Act in Schedule 19 to this Act come into force.

Access to Health Records (Northern Ireland) Order 1993 (S.I. 1993/1250 (N.I. 4))

57

Until the first regulations under Article 5(4)(a) of the Access to Health Records (Northern Ireland) Order 1993 (as amended by Schedule 19 to this Act) come into force, the maximum amount of a fee that may be required for giving access under that Article is £10.

Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2450)

58

(1) The repeal of a provision of the 1998 Act does not affect its operation for the purposes of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“the PECR 2003”) (see regulation 2 of those Regulations).

(2) Where subordinate legislation made under a provision of the 1998 Act is in force immediately before the repeal of that provision, neither the revocation of the subordinate legislation nor the repeal of the provision of the 1998 Act affect the application of the subordinate legislation for the purposes of the PECR 2003 after that time.

(3) Part 3 of Schedule 19 to this Act (modifications) does not have effect in relation to the PECR 2003.

(4) Part 7 of this Schedule does not have effect in relation to the provisions of the 1998 Act as applied by the PECR 2003.

Health and Personal Social Services (Quality, Improvement and Regulation) (Northern Ireland) Order 2003 (S.I. 2003/431 (N.I. 9))

59

Part 3 of Schedule 19 to this Act (modifications) does not have effect in relation to the reference to an accessible record within the meaning of section 68 of the 1998 Act in Article 43 of the Health and Personal Social Services (Quality, Improvement and Regulation) (Northern Ireland) Order 2003.

Environmental Information Regulations 2004 (S.I. 2004/3391)

60

(1) This paragraph applies where a request for information was made to a public authority under the Environmental Information Regulations 2004 (“the 2004 Regulations”) before the relevant time.

(2) To the extent that the request is dealt with after the relevant time, the amendments of the 2004 Regulations in Schedule 19 to this Act have effect for the purposes of determining whether the authority deals with the request in accordance with Parts 2 and 3 of those Regulations.

(3) To the extent that the request was dealt with before the relevant time—

(a) the amendments of the 2004 Regulations in Schedule 19 to this Act do not have effect for the purposes of determining whether the authority dealt with the request in accordance with Parts 2 and 3 of those Regulations, but

(b) the powers of the Commissioner and the Tribunal, on an application or appeal under the 2000 Act (as applied by the 2004 Regulations), do not include power to require the authority to take steps which it would not be required to take in order to comply with Parts 2 and 3 of those Regulations as amended by Schedule 19 to this Act.

(4) In this paragraph—

“public authority” has the same meaning as in the 2004 Regulations;

“the relevant time” means the time when the amendments of the 2004 Regulations in Schedule 19 to this Act come into force.

Environmental Information (Scotland) Regulations 2004 (S.S.I. 2004/520)

61

(1) This paragraph applies where a request for information was made to a Scottish public authority under the Environmental Information (Scotland) Regulations 2004 (“the 2004 Regulations”) before the relevant time.

(2) To the extent that the request is dealt with after the relevant time, the amendments of the 2004 Regulations in Schedule 19 to this Act have effect for the purposes of determining whether the authority deals with the request in accordance with those Regulations.

(3) To the extent that the request was dealt with before the relevant time—

(a) the amendments of the 2004 Regulations in Schedule 19 to this Act do not have effect for the purposes of determining whether the authority dealt with the request in accordance with those Regulations, but

(b) the powers of the Scottish Information Commissioner and the Court of Session, on an application or appeal under the 2002 Act (as applied by the 2004 Regulations), do not include power to require the authority to take steps which it would not be required to take in order to comply with those Regulations as amended by Schedule 19 to this Act.

(4) In this paragraph—

“Scottish public authority” has the same meaning as in the 2004 Regulations;

“the relevant time” means the time when the amendments of the 2004 Regulations in Schedule 19 to this Act come into force.

Overview

Processing to which this Part applies

Special categories of personal data etc: supplementary

National security and defence exemption

Processing to which this Part applies

Meaning of “controller” and “processor”

Regulations and consultation

Index of defined expressions

Employment, social security and social protection

Health or social care purposes

Public health

Research etc

Requirement for an appropriate policy document when relying on conditions in this Part

Statutory etc and government purposes

Administration of justice and parliamentary purposes

Equality of opportunity or treatment

Racial and ethnic diversity at senior levels of organisations

Preventing etc unlawful acts

Protecting the public against dishonesty etc

Regulatory requirements relating to unlawful acts and dishonesty etc

Journalism etc in connection with unlawful acts and dishonesty etc

Preventing fraud

Suspicion of terrorist financing or money laundering

Support for individuals with a particular disability or medical condition

Counselling etc

Safeguarding of children and of individuals at risk

Safeguarding of economic well-being of certain individuals

Insurance

Occupational pensions

Political parties

Elected representatives responding to requests

Disclosure to elected representatives

Informing elected representatives about prisoners

Publication of legal judgments

Anti-doping in sport

Standards of behaviour in sport

Consent

Protecting individual's vital interests

Processing by not-for-profit bodies

Personal data in the public domain

Legal claims

Judicial acts

Administration of accounts used in commission of indecency offences involving children

Extension of conditions in Part 2 of this Schedule referring to substantial public interest

Extension of insurance conditions

Application of this Part of this Schedule

Requirement to have an appropriate policy document in place

Additional safeguard: retention of appropriate policy document

Additional safeguard: record of processing

UK GDPR provisions to be adapted or restricted: “the listed GDPR provisions”

Crime and taxation: general

Crime and taxation: risk assessment systems

Immigration

Information required to be disclosed by law etc or in connection with legal proceedings

UK GDPR provisions to be restricted: “the listed GDPR provisions”

Functions designed to protect the public etc

Audit functions

Functions of the Bank of England

Regulatory functions relating to legal services, the health service and children's services

Regulatory functions of certain other persons

Parliamentary privilege

Judicial appointments, judicial independence and judicial proceedings

Crown honours, dignities and appointments

Protection of the rights of others: general

Assumption of reasonableness for health workers, social workers and education workers

UK GDPR provisions to be restricted: “the listed GDPR provisions”

Legal professional privilege

Self incrimination

Corporate finance

Management forecasts

Negotiations

Confidential references

Exam scripts and exam marks

Journalistic, academic, artistic and literary purposes

Research and statistics

Archiving in the public interest

Definitions

Exemption from the listed GDPR provisions: data processed by a court

Exemption from the listed GDPR provisions: data subject's expectations and wishes

Exemption from Article 15 of the UK GDPR: serious harm

Restriction of Article 15 of the UK GDPR: prior opinion of appropriate health professional

Definitions

Exemption from the listed GDPR provisions: data processed by a court

Exemption from the listed GDPR provisions: data subject's expectations and wishes

Exemption from Article 15 of the UK GDPR: serious harm

Restriction of Article 15 of the UK GDPR: prior opinion of Principal Reporter

Educational records

Other definitions

Exemption from the listed GDPR provisions: data processed by a court

Exemption from Article 15 of the UK GDPR: serious harm

Restriction of Article 15 of the UK GDPR: prior opinion of Principal Reporter

Exemption from Article 15 of the UK GDPR: child abuse data

UK GDPR provisions to be restricted: “the listed GDPR provisions”

Human fertilisation and embryology information

Adoption records and reports

Statements of special educational needs

Parental order records and reports

Information provided by Principal Reporter for children's hearing

Introduction

Review

Right to appeal

Appeal panel

Hearing

Decision following referral to appeal panel

Meaning of “working day”

Introductory

References to the GDPR and its provisions

References to Union law and Member State law

References to the Union and to Member States

References to supervisory authorities

References to the national parliament

Chapter I of the GDPR (general provisions)

Chapter II of the GDPR (principles)

Section 1 of Chapter III of the GDPR (rights of the data subject: transparency and modalities)

Section 2 of Chapter III of the GDPR (rights of the data subject: information and access to personal data)

Section 3 of Chapter III of the GDPR (rights of the data subject: rectification and erasure)

Section 4 of Chapter III of the GDPR (rights of the data subject: right to object and automated individual decision-making)

Section 5 of Chapter III of the GDPR (rights of the data subject: restrictions)

Section 1 of Chapter IV of the GDPR (controller and processor: general obligations)

Section 3 of Chapter IV of the GDPR (controller and processor: data protection impact assessment and prior consultation)

Section 4 of Chapter IV of the GDPR (controller and processor: data protection officer)

Section 5 of Chapter IV of the GDPR (controller and processor: codes of conduct and certification)

Chapter V of the GDPR (transfers of data to third countries or international organisations)

Section 1 of Chapter VI of the GDPR (independent supervisory authorities: independent status)

Section 2 of Chapter VI of the GDPR (independent supervisory authorities: competence, tasks and powers)

Chapter VII of the GDPR (co-operation and consistency)

Chapter VIII of the GDPR (remedies, liability and penalties)

Chapter IX of the GDPR (provisions relating to specific processing situations)

Chapter X of the GDPR (delegated acts and implementing acts)

Chapter XI of the GDPR (final provisions)

Introductory

General modifications

Exemptions

Chief officers of police and other policing bodies

Other authorities with investigatory functions

Authorities with functions relating to offender management

Other authorities

Statutory etc purposes

Administration of justice

Protecting individual's vital interests

Safeguarding of children and of individuals at risk

Personal data already in the public domain

Legal claims

Judicial acts

Preventing fraud

Archiving etc

Consent to particular processing

Right or obligation relating to employment

Vital interests of a person

Safeguarding of children and of individuals at risk

Data already published by data subject

Legal proceedings etc

Administration of justice, parliamentary, statutory etc and government purposes

Medical purposes

Equality

Preliminary

Crime

Information required to be disclosed by law etc or in connection with legal proceedings

Parliamentary privilege

Judicial proceedings

Crown honours and dignities

Armed forces

Economic well-being

Legal professional privilege

Negotiations

Confidential references given by the controller

Exam scripts and marks

Research and statistics

Archiving in the public interest

Status and capacity

Appointment

Resignation and removal

Salary etc

Officers and staff

Carrying out of the Commissioner's functions by officers and staff

Authentication of the seal of the Commissioner

Presumption of authenticity of documents issued by the Commissioner

Money

Fees etc and other sums

Accounts

Scotland

General tasks

General powers

Definitions

Co-operation

Requests for information and assistance from LED supervisory authorities

Fees

Restrictions on use of information

LED supervisory authority

Co-operation between the Commissioner and foreign designated authorities

Assisting persons resident outside the UK with requests under Article 14 of the Convention

Assisting UK residents with requests under Article 8 of the Convention

Restrictions on use of information

Foreign designated authority

Issue of warrants in connection with non-compliance and offences

Issue of warrants in connection with assessment notices

Restrictions on issuing warrants: processing for the special purposes

Restrictions on issuing warrants: procedural requirements

Content of warrants

Copies of warrants

Execution of warrants: reasonable force

Execution of warrants: time when executed

Execution of warrants: occupier of premises

Execution of warrants: seizure of documents etc

Matters exempt from inspection and seizure: privileged communications

Matters exempt from inspection and seizure: Parliamentary privilege

Partially exempt material

Return of warrants

Offences

Self-incrimination

Vessels, vehicles etc

Scotland

Northern Ireland

Meaning of “penalty”

Notice of intent to impose penalty

Contents of notice of intent

Giving a penalty notice

Contents of penalty notice

Period for payment of penalty

Variation of penalty

Cancellation of penalty

Enforcement of payment

Interpretation

Information notices

Assessment notices

Applications in respect of urgent notices

Relevant records

Relevant health records

Relevant records relating to a conviction or caution

Relevant records relating to statutory functions

Data subject access right

Records stating that personal data is not processed

Power to amend

Registration Service Act 1953 (c. 37)

Veterinary Surgeons Act 1966 (c. 36)

Parliamentary Commissioner Act 1967 (c. 13)

Local Government Act 1974 (c. 7)

Consumer Credit Act 1974 (c. 39)

Pharmacy (Northern Ireland) Order 1976 (S.I. 1976/1213 (N.I. 22))

Representation of the People Act 1983 (c. 2)

Medical Act 1983 (c. 54)

Dentists Act 1984 (c. 24)

Companies Act 1985 (c. 6)

Access to Medical Reports Act 1988 (c. 28)

Opticians Act 1989 (c. 44)

Access to Health Records Act 1990 (c. 23)

Human Fertilisation and Embryology Act 1990 (c. 37)

Trade Union and Labour Relations (Consolidation) Act 1992 (c. 52)

Tribunals and Inquiries Act 1992 (c. 53)

Industrial Relations (Northern Ireland) Order 1992 (S.I. 1992/807 (N.I. 5))

Health Service Commissioners Act 1993 (c. 46)

Data Protection Act 1998 (c. 29)

Crime and Disorder Act 1998 (c. 37)

Food Standards Act 1999 (c. 28)

Immigration and Asylum Act 1999 (c. 33)

Financial Services and Markets Act 2000 (c. 8)

Terrorism Act 2000 (c. 11)

Freedom of Information Act 2000 (c. 36)

Political Parties, Elections and Referendums Act 2000 (c. 41)

Public Finance and Accountability (Scotland) Act 2000 (asp 1)

Criminal Justice and Police Act 2001 (c. 16)

Anti-terrorism, Crime and Security Act 2001 (c.24)

Health and Personal Social Services Act (Northern Ireland) 2001 (c. 3 (N.I.))

Justice (Northern Ireland) Act 2002 (c. 26)

Proceeds of Crime Act 2002 (c. 29)

Enterprise Act 2002 (c. 40)

Scottish Public Services Ombudsman Act 2002 (asp 11)

Freedom of Information (Scotland) Act 2002 (asp 13)

Courts Act 2003 (c. 39)

Sexual Offences Act 2003 (c. 42)

Criminal Justice Act 2003 (c. 44)

Mental Health (Care and Treatment) (Scotland) Act 2003 (asp 13)

Public Audit (Wales) Act 2004 (c. 23)

Companies (Audit, Investigations and Community Enterprise) Act 2004 (c. 27)

Domestic Violence, Crime and Victims Act 2004 (c. 28)

Children Act 2004 (c. 31)

Constitutional Reform Act 2005 (c. 4)

Mental Capacity Act 2005 (c. 9)

Public Services Ombudsman (Wales) Act 2005 (c. 10)

Commissioners for Revenue and Customs Act 2005 (c. 11)

Gambling Act 2005 (c. 19)

Commissioner for Older People (Wales) Act 2006 (c. 30)

National Health Service Act 2006 (c. 41)

National Health Service (Wales) Act 2006 (c. 42)

Companies Act 2006 (c. 46)

Tribunals, Courts and Enforcement Act 2007 (c. 15)

Statistics and Registration Service Act 2007 (c. 18)

Serious Crime Act 2007 (c. 27)

Legal Services Act 2007 (c. 29)

Adoption and Children (Scotland) Act 2007 (asp 4)

Criminal Justice and Immigration Act 2008 (c. 4)

Regulatory Enforcement and Sanctions Act 2008 (c. 13)

Health and Social Care Act 2008 (c. 14)

Counter-Terrorism Act 2008 (c. 28)

Public Health etc. (Scotland) Act 2008 (asp 5)

Banking Act 2009 (c. 1)

Borders, Citizenship and Immigration Act 2009 (c. 11)

Marine and Coastal Access Act 2009 (c. 23)

Coroners and Justice Act 2009 (c. 25)

Broads Authority Act 2009 (c. i)

Health and Social Care (Reform) Act (Northern Ireland) 2009 (c. 1 (N.I.))

Terrorist Asset-Freezing etc. Act 2010 (c. 38)

Marine (Scotland) Act 2010 (asp 5)

Charities Act 2011 (c. 25)

Welsh Language (Wales) Measure 2011 (nawm 1)

Safeguarding Board Act (Northern Ireland) 2011 (c. 7 (N.I))

Health and Social Care Act 2012 (c. 7)

Protection of Freedoms Act 2012 (c. 9)

HGV Road User Levy Act 2013 (c. 7)

Crime and Courts Act 2013 (c. 22)

Marine Act (Northern Ireland) 2013 (c. 10 (N.I.))

Local Audit and Accountability Act 2014 (c. 2)

Anti-social Behaviour, Crime and Policing Act 2014 (c. 12)

Immigration Act 2014 (c. 22)

Care Act 2014 (c. 23)

Social Services and Well-being (Wales) Act 2014 (anaw 4)

Counter-Terrorism and Security Act 2015 (c. 6)

Small Business, Enterprise and Employment Act 2015 (c. 26)

Modern Slavery Act 2015 (c. 30)

Human Trafficking and Exploitation (Criminal Justice and Support for Victims) Act (Northern Ireland) 2015 (c. 2 (N.I.))

Justice Act (Northern Ireland) 2015 (c. 9 (N.I.))

Immigration Act 2016 (c. 19)

Investigatory Powers Act 2016 (c. 25)

Public Services Ombudsman Act (Northern Ireland) 2016 (c. 4 (N.I.))

Health and Social Care (Control of Data Processing) Act (Northern Ireland) 2016 (c. 12 (N.I.))

Mental Capacity Act (Northern Ireland) 2016 (c. 18 (N.I.))

Justice Act (Northern Ireland) 2016 (c. 21 (N.I.))

Policing and Crime Act 2017 (c. 3)

Children and Social Work Act 2017 (c. 12)

Higher Education and Research Act 2017 (c. 29)

Digital Economy Act 2017 (c. 30)

Landfill Disposals Tax (Wales) Act 2017 (anaw 3)

Additional Learning Needs and Educational Tribunal (Wales) Act 2018 (anaw 2)

This Act

Estate Agents (Specified Offences) (No. 2) Order 1991 (S.I. 1991/1091)

Channel Tunnel (International Arrangements) Order 1993 (S.I. 1993/1813)

Access to Health Records (Northern Ireland) Order 1993 (S.I. 1993/1250 (N.I. 4))

Channel Tunnel (Miscellaneous Provisions) Order 1994 (S.I. 1994/1405)

European Primary and Specialist Dental Qualifications Regulations 1998 (S.I. 1998/811)

Scottish Parliamentary Corporate Body (Crown Status) Order 1999 (S.I. 1999/677)

Northern Ireland Assembly Commission (Crown Status) Order 1999 (S.I. 1999/3145)

Data Protection (Corporate Finance Exemption) Order 2000 (S.I. 2000/184)

Data Protection (Conditions under Paragraph 3 of Part II of Schedule 1) Order 2000 (S.I. 2000/185)

Data Protection (Functions of Designated Authority) Order 2000 (S.I. 2000/186)

Data Protection (International Co-operation) Order 2000 (S.I. 2000/190)

Data Protection (Subject Access) (Fees and Miscellaneous Provisions) Regulations 2000 (S.I. 2000/191)

Consumer Credit (Credit Reference Agency) Regulations 2000 (S.I. 2000/290)

Data Protection (Subject Access Modification) (Health) Order 2000 (S.I. 2000/413)

Data Protection (Subject Access Modification) (Education) Order 2000 (S.I. 2000/414)

Data Protection (Subject Access Modification) (Social Work) Order 2000 (S.I. 2000/415)

Data Protection (Crown Appointments) Order 2000 (S.I. 2000/416)

Data Protection (Processing of Sensitive Personal Data) Order 2000 (S.I. 2000/417)

Data Protection (Miscellaneous Subject Access Exemptions) Order 2000 (S.I. 2000/419)

Data Protection (Designated Codes of Practice) (No. 2) Order 2000 (S.I. 2000/1864)

Representation of the People (England and Wales) Regulations 2001 (S.I. 2001/341)

Representation of the People (Scotland) Regulations 2001 (S.I. 2001/497)

Financial Services and Markets Act 2000 (Disclosure of Confidential Information) Regulations 2001 (S.I. 2001/2188)

Nursing and Midwifery Order 2001 (S.I. 2002/253)

Electronic Commerce (EC Directive) Regulations 2002 (S.I. 2002/2013)

Data Protection (Processing of Sensitive Personal Data) (Elected Representatives) Order 2002 (S.I. 2002/2905)

Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426)

Nationality, Immigration and Asylum Act 2002 (Juxtaposed Controls) Order 2003 (S.I. 2003/2818)

Pupils' Educational Records (Scotland) Regulations 2003 (S.S.I. 2003/581)

European Parliamentary Elections (Northern Ireland) Regulations 2004 (S.I. 2004/1267)

Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004 (S.I. 2004/3244)

Environmental Information Regulations 2004 (S.I. 2004/3391)

Environmental Information (Scotland) Regulations 2004 (S.S.I. 2004/520)

Licensing Act 2003 (Personal Licences) Regulations 2005 (S.I. 2005/41)

Education (Pupil Information) (England) Regulations 2005 (S.I. 2005/1437)

Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005 (S.I. 2005/2042)

Register of Judgments, Orders and Fines Regulations 2005 (S.I. 2005/3595)

Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005 (S.S.I. 2005/494)

Data Protection (Processing of Sensitive Personal Data) Order 2006 (S.I. 2006/2068)

National Assembly for Wales (Representation of the People) Order 2007 (S.I. 2007/236)

Mental Capacity Act 2005 (Loss of Capacity during Research Project) (England) Regulations 2007 (S.I. 2007/679)

National Assembly for Wales Commission (Crown Status) Order 2007 (S.I. 2007/1118)

Mental Capacity Act 2005 (Loss of Capacity during Research Project) (Wales) Regulations 2007 (S.I. 2007/837 (W.72))

Representation of the People (Absent Voting at Local Elections) (Scotland) Regulations 2007 (S.S.I. 2007/170)

Representation of the People (Post-Local Government Elections Supply and Inspection of Documents) (Scotland) Regulations 2007 (S.S.I. 2007/264)

Education (Pupil Records and Reporting) (Transitional) Regulations (Northern Ireland) 2007 (S.R. (N.I.) 2007 No. 43)

Representation of the People (Northern Ireland) Regulations 2008 (S.I. 2008/1741)

Companies Act 2006 (Extension of Takeover Panel Provisions) (Isle of Man) Order 2008 (S.I. 2008/3122)

Controlled Drugs (Supervision of Management and Use) (Wales) Regulations 2008 (S.I. 2008/3239 (W.286))

Energy Order 2003 (Supply of Information) Regulations (Northern Ireland) 2008 (S.R. (N.I.) 2008 No. 3)

Companies (Disclosure of Address) Regulations 2009 (S.I. 2009/214)

Overseas Companies Regulations 2009 (S.I. 2009/1801)

Data Protection (Processing of Sensitive Personal Data) Order 2009 (S.I. 2009/1811)

Provision of Services Regulations 2009 (S.I. 2009/2999)

INSPIRE Regulations 2009 (S.I. 2009/3157)

INSPIRE (Scotland) Regulations 2009 (S.S.I. 2009/440)

Controlled Drugs (Supervision of Management and Use) Regulations (Northern Ireland) 2009 (S.R (N.I.) 2009 No. 225)

Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010 (S.I. 2010/31)

Pharmacy Order 2010 (S.I. 2010/231)

Data Protection (Monetary Penalties) Order 2010 (S.I. 2010/910)

National Employment Savings Trust Order 2010 (S.I. 2010/917)

Local Elections (Northern Ireland) Order 2010 (S.I. 2010/2977)

Pupil Information (Wales) Regulations 2011 (S.I. 2011/1942 (W.209))

Debt Arrangement Scheme (Scotland) Regulations 2011 (S.S.I. 2011/141)

Police and Crime Commissioner Elections Order 2012 (S.I. 2012/1917)

Data Protection (Processing of Sensitive Personal Data) Order 2012 (S.I. 2012/1978)

Neighbourhood Planning (Referendums) Regulations 2012 (S.I. 2012/2031)

Controlled Drugs (Supervision of Management and Use) Regulations 2013 (S.I. 2013/373)

Communications Act 2003 (Disclosure of Information) Order 2014 (S.I. 2014/1825)

Criminal Justice and Data Protection (Protocol No. 36) Regulations 2014 (S.I. 2014/3141)

Data Protection (Assessment Notices) (Designation of National Health Service Bodies) Order 2014 (S.I. 2014/3282)

The Control of Explosives Precursors etc Regulations (Northern Ireland) 2014 (S.R. (N.I.) 2014 No. 224)

Control of Poisons and Explosives Precursors Regulations 2015 (S.I. 2015/966)

Companies (Disclosure of Date of Birth Information) Regulations 2015 (S.I. 2015/1694)

Small and Medium Sized Business (Credit Information) Regulations 2015 (S.I. 2015/1945)

European Union (Recognition of Professional Qualifications) Regulations 2015 (S.I. 2015/2059)

Scottish Parliament (Elections etc) Order 2015 (S.S.I. 2015/425)

Recall of MPs Act 2015 (Recall Petition) Regulations 2016 (S.I. 2016/295)

Register of People with Significant Control Regulations 2016 (S.I. 2016/339)

Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 (S.I. 2016/696)

Court Files Privileged Access Rules (Northern Ireland) 2016 (S.R. (N.I.) 2016 No. 123)

Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (S.I. 2017/692)

Scottish Partnerships (Register of People with Significant Control) Regulations 2017 (S.I. 2017/694)

Data Protection (Charges and Information) Regulations 2018 (S.I. 2018/480)

National Health Service (General Medical Services Contracts) (Scotland) Regulations 2018 (S.S.I. 2018/66)

National Health Service (Primary Medical Services Section 17C Agreements) (Scotland) Regulations 2018 (S.S.I. 2018/67)

Introduction

General modifications

Specific modification of references to terms used in the Data Protection Act 1998

Definitions

Provision inserted in subordinate legislation by this Schedule

Interpretation

Right of access to personal data under the 1998 Act

Right to prevent processing likely to cause damage or distress under the 1998 Act

Right to prevent processing for purposes of direct marketing under the 1998 Act

Automated processing under the 1998 Act

Compensation for contravention of the 1998 Act or Part 4 of the 2014 Regulations

Rectification, blocking, erasure and destruction under the 1998 Act

Jurisdiction and procedure under the 1998 Act

Exemptions under the 1998 Act

Prohibition by this Act of requirement to produce relevant records

Avoidance under this Act of certain contractual terms relating to health records

Exemptions from the GDPR: restrictions of rules in Articles 13 to 15 of the GDPR

Manual unstructured data held by FOI public authorities

Logging

Regulation 50 of the 2014 Regulations (disapplication of the 1998 Act)

Maximum fee for data subject access requests to intelligence services

National security certificates: processing of personal data under the 1998 Act

National security certificates: processing of personal data under the 2018 Act

Appointment etc

Accounts

Annual report

Fees etc received by the Commissioner

Functions in connection with the Data Protection Convention

Co-operation with the European Commission: transfers of personal data outside the EEA

Charges payable to the Commissioner by controllers

Requests for assessment

Codes of practice

Interpretation of this Part

Information notices

Special information notices

Assessment notices

Enforcement notices

Determination by Commissioner as to the special purposes

Restriction on enforcement in case of processing for the special purposes

Offences

Powers of entry

Monetary penalties

Appeals

Exemptions

Tribunal Procedure Rules

Obstruction etc

Enforcement etc under the 2014 Regulations

Information notices

Powers of entry

Tribunal Procedure Rules

Powers to disclose information to the Commissioner

Codes etc required to be consistent with the Commissioner's data-sharing code

Consumer Credit Act 1974

Freedom of Information Act 2000

Freedom of Information (Scotland) Act 2002

Access to Health Records (Northern Ireland) Order 1993 (S.I. 1993/1250 (N.I. 4))

Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2450)

Health and Personal Social Services (Quality, Improvement and Regulation) (Northern Ireland) Order 2003 (S.I. 2003/431 (N.I. 9))

Environmental Information Regulations 2004 (S.I. 2004/3391)

Environmental Information (Scotland) Regulations 2004 (S.S.I. 2004/520)

Editorial notes

[^c23266291]: S. 7 in force at Royal Assent for specified purposes, see s. 212(2)(f)

[^c23266301]: S. 10 in force at Royal Assent for specified purposes, see s. 212(2)(f)

[^c23266331]: S. 12 in force at Royal Assent for specified purposes, see s. 212(2)(f)

[^c23266361]: S. 16 in force at Royal Assent for specified purposes, see s. 212(2)(f)

[^c23266401]: S. 24 in force at Royal Assent for specified purposes, see s. 212(2)(f)

[^c23266411]: S. 30 in force at Royal Assent for specified purposes, see s. 212(2)(f)

[^c23266421]: S. 35 in force at Royal Assent for specified purposes, see s. 212(2)(f)

[^c23266471]: S. 53 in force at Royal Assent for specified purposes, see s. 212(2)(f)

[^c23268021]: S. 54 in force at Royal Assent for specified purposes, see s. 212(2)(f)

[^c23268891]: S. 86 in force at Royal Assent for specified purposes, see s. 212(2)(f)

[^c23268981]: S. 94 in force at Royal Assent for specified purposes, see s. 212(2)(f)

[^c23269021]: S. 113 in force at Royal Assent for specified purposes, see s. 212(2)(f)

[^c23269101]: S. 137 in force at Royal Assent for specified purposes, see s. 212(2)(f)

[^c23269111]: S. 138 in force at Royal Assent for specified purposes, see s. 212(2)(f)

[^c23269131]: S. 149 in force at Royal Assent for specified purposes, see s. 212(2)(f)

[^c23269141]: S. 155 in force at Royal Assent for specified purposes, see s. 212(2)(f)

[^c23269151]: S. 159 in force at Royal Assent for specified purposes, see s. 212(2)(f)

[^c23269161]: S. 183 in force at Royal Assent for specified purposes, see s. 212(2)(f)

[^c23269171]: S. 188 in force at Royal Assent for specified purposes, see s. 212(2)(f)

[^c23269181]: S. 190 in force at Royal Assent for specified purposes, see s. 212(2)(f)

[^c23269191]: S. 191 in force at Royal Assent for specified purposes, see s. 212(2)(f)

[^c23269201]: S. 203 in force at Royal Assent for specified purposes, see s. 212(2)(f)

[^c23269211]: S. 211 in force at Royal Assent for specified purposes, see s. 212(2)(f)

[^c23269221]: S. 213(2) in force and s. 213(3) in force for specified purposes at Royal Assent, see s. 212(2)(e)(f)

[^c23269231]: Sch. 2 para. 26 in force at Royal Assent for specified purposes, see s. 212(2)(f)

[^c23269241]: Sch. 18 para. 7 in force at Royal Assent for specified purposes, see s. 212(2)(f)

[^c23269251]: Sch. 19 para. 60 in force at Royal Assent for specified purposes, see s. 212(2)(f)

[^c23269261]: Sch. 19 para. 434 in force at Royal Assent for specified purposes, see s. 212(2)(f)

[^c23270721]: Sch. 2 para. 15 in force at Royal Assent for specified purposes, see s. 212(2)(f)

[^c23287301]: S. 125 not in force at Royal Assent; s. 125 in force at 23.7.2018 for specified purposes, see s. 212(3)(b)

[^c23287311]: S. 126 not in force at Royal Assent; s. 126 in force at 23.7.2018 for specified purposes, see s. 212(3)(b)

[^c23287321]: S. 127 not in force at Royal Assent; s. 127 in force at 23.7.2018 for specified purposes, see s. 212(3)(b)

[^key-00432701eea2cde637ac5d287f4837c8]: Sch. 19 para. 333 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-0069451af9e1f039078d649a6b834dfb]: S. 119A(3)(aa) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 20(3) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-008659743a491eb703127dd80e785478]: Words in s. 124(5) omitted (20.8.2025) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 11 para. 18(a); S.I. 2025/904, reg. 2(y)

[^key-00a998ef954e776a941edb1c4f669ea3]: Words in s. 78(2) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 10(5)(a); S.I. 2026/82, reg. 2(z10)

[^key-00c31acc0526af8b197626c45f603186]: S. 103 in force at 16.9.2019 by S.I. 2019/1188, reg. 2(c)

[^key-019c61443b227cfc431617e576673df8]: Sch. 19 para. 368 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-01e0b7c056d90098dda06c025884a600]: Sch. 1 para. 40 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-020bbab2a3937097fe87c235aa9d2876]: Words in Sch. 2 Pt. 6 heading omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(22) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-02257d73d63a015dfbb50ba43425dda5]: S. 180A inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 104(3), 142(1); S.I. 2025/904, reg. 2(j)

[^key-0228d23a866d3b67264125f2ef6b7ee5]: Words in s. 26(2)(c) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 34(3)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-0261d887a09ac80ed5671762eabc2d89]: Words in s. 17(7) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 22(5)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-0275322d4c3e9338c7982248c59afa08]: Sch. 19 para. 26 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-028cd06e6f950f4558cd72890b7ed743]: Sch. 19 para. 257 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-02a6528f0ef1de1eccead8b29c583d45]: S. 66(3) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 84(5), 142(1); S.I. 2025/904, reg. 2(d)

[^key-02c9392ccbfe5d518f4e56dba15b087b]: Sch. 19 para. 139 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-03a41268b1f986aee847dad7f0702a19]: Words in Sch. 2 para. 26(9)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(21)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-03be80b9d01d85e387feb8f4beaf6d2f]: Sch. 19 para. 32 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-03d2f3e7999eedf91b3cf7abed68d4f9]: Sch. 19 para. 289 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-03fe9c07df618a44ead6a09ff7ff172f]: Words in s. 78(1) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 10(3)(a); S.I. 2026/82, reg. 2(z10)

[^key-043f7bc14d22fdcbfb448881e634bb29]: Sch. 14 para. 9 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

[^key-0447af8ae299a204a2630922dc53e872]: Sch. 19 para. 270 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-044a7ac5d319a0ffb7c00ed7636fa913]: S. 3(9)(b) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 4(3)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-048713be6754b1e793f21b40269622d9]: Sch. 1 para. 29 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-04a116e5e2b279f99e07bb7fc9c120bd]: Sch. 19 para. 69 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-04b978162a0ac7cecff53b38d4c65267]: S. 33(6A) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 74(3), 142(1); S.I. 2025/904, reg. 2(c)

[^key-04deb533ed57e15add641215ed3efabf]: Sch. 20 para. 46 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-04eb1172bf0efdbe8a895be27cefc005]: Words in Sch. 21 para. 10(4)(a) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(8)(b) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-052d274a8bd30e1ac9982409ed6e3e86]: S. 182(9)(10) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 22(6) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-055760fc82e5e2786df333ac02e415f3]: Sch. 19 para. 297 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-058ceb009e6f2263b728c5df73cb3576]: Words in s. 187(2)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 81(5)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-05db1f618adcd0f850b18cfe67f3c291]: Words in Sch. 2 para. 4(2) substituted (8.3.2024) by The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024 (S.I. 2024/342), regs. 1(2), 2(5)

[^key-067b411a6f252d978f5363bb7f8fd473]: Words in s. 161(6) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 11 para. 21; S.I. 2025/904, reg. 2(y)

[^key-068079f0d354b65a415f2cdd6d742510]: Word in s. 165(5)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 66(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-06e85acf6fae37d9f442573e440e4c13]: Words in s. 24(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 32(2)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-06ee5fb74345454741ae734d0b97ceaa]: S. 136(1)(b) and word omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 94(3), 142(1); S.I. 2026/82, reg. 2(p)

[^key-07090df3ca4a1ef9932cc47e618dc305]: Words in s. 149(2)(e) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 61 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-071d1dd7492c1a08829b1e12514d44f6]: Sch. 19 para. 393 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-073279dc56c10b95d4fc1174d2bb9002]: Sch. 19 para. 344 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-074df9646a976c44c98e2007798a5bda]: Sch. 16 para. 4(A1)(A2) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 101(3)(a), 142(1); S.I. 2026/82, reg. 2(t) (with reg. 6)

[^key-075130ba76e3c3f27cf76df70ec522b8]: Sch. 19 para. 204 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-075c9a035c809ff241232418d14ceeff]: Words in s. 190(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 84 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-078834edf1fff161c9e6fa81ce234817]: Words in s. 183(2)(d) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 78(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-07dee8d69012da87b02291e4c8e3d699]: Sch. 2 para. 11 table modified (28.1.2021 for specified purposes, 30.7.2022 in so far as not already in force) by The Financial Services and Markets Act 2000 (Regulated Activities) (Amendment) Order 2021 (S.I. 2021/90), arts. 1(2)(3), 15(2)

[^key-081d12fd19e15895b2c24def7373caac]: S. 135(A1) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 94(2)(a), 142(1); S.I. 2026/82, reg. 2(p)

[^key-0876256c5ad3d60e361b782c4058e808]: Sch. 19 para. 224 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-08a66ca2af7b4b1ea6d3d87306a370f7]: Words in Sch. 2 para. 1(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(5)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-08ad9f9df54aea437bd161c772023bf2]: S. 83(A1) inserted (17.11.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 90(4)(a), 142(1); S.I. 2025/996, reg. 2(2)(b)

[^key-08b293e3fde48c9b8dd1f1ec574b10ea]: S. 205(3) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 85(6) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-08f0dc8ee77a2e679c674a1653b65e89]: Sch. 19 para. 44 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-08f4a6329ad10a2e9314dee57073b8be]: Words in s. 206 Table inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 74(9), 142(1); S.I. 2025/904, reg. 2(c)

[^key-0980e055af9390b4571e201b8f8aafaa]: Words in s. 1(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 2(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-09ad4c27f1d1f5107104ceb3233831b0]: Sch. 19 para. 104 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-09da2f0bffbc26c05b2dc87ab4d3cd36]: Words in s. 6(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 9 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-09fdc01e4022553e41255db6f7e74f0f]: Words in Sch. 2 Pt. 3 heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(13) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-0a47f233acc9d54f244d68e5e7b97287]: Sch. 7 para. 7 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-0a7db461f51968f8ba878ebd21f8457e]: S. 84(2A) inserted (17.11.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 90(5)(a), 142(1); S.I. 2025/996, reg. 2(2)(b)

[^key-0a802107ab2c08fc27b1ddde01f85aa8]: Words in Sch. 4 para. 1 substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 94(4) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-0a86b7ac7f6cd28ad8594499bf962105]: Sch. 12 para. 4 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

[^key-0ad994e390ded3737e0cf452dcb87c1c]: Sch. 19 para. 88 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-0aec7eae8fcc0cb7a6400cb54bac6096]: S. 45(4)(d) omitted (5.9.2025) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 88(4)(a), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

[^key-0b089b6e1c9a68b042bfb7d6decabe4a]: Sch. 20 para. 48 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-0b10f6281c849fb152ebfa1af8d2f949]: Words in s. 115(5) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 47(6) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-0ba459e03e17dc61a837438daecd1a48]: Word in s. 171(3)(a) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 11 para. 23(2); S.I. 2026/82, reg. 2(z12)

[^key-0bfd00907b511398d0520d55dda1857c]: Sch. 19 para. 140 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-0c2efecad359220e6a37b89dba30fb47]: Sch. 19 para. 334 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-0c4dc81c9c250f7500da1b0dc37fb7e1]: Words in s. 74B(7) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 5(9)(a); S.I. 2026/82, reg. 2(z10)

[^key-0c64f94808e62ce8c06e20ffbc5b1116]: Sch. 16 para. 4 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-0c921886eda65d928d0d76962456ecfe]: S. 124A inserted (19.6.2025 for specified purposes, 20.8.2025 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), ss. 92(2), 142(1)(2)(h); S.I. 2025/904, reg. 2(f)

[^key-0c925c155f884ff322d1f06c0cf09a74]: Sch. 19 para. 239 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-0ca2154432d523e9349716a80c0650a7]: Sch. 19 para. 222 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-0cd28f0f5d93804597b7bab43c86f5e2]: Sch. 19 para. 401 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-0d0f728e9f8b4a55db8deb669c342540]: Sch. 7 para. 13 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-0d271530c429f861f97bd026d99487d6]: Sch. 19 para. 48 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-0d28ce61d602ad2e767e31293c260e43]: Sch. 16 applied (with modifications) by S.I. 2016/696, Sch. 2 (as substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 406 (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g) (with reg. 4))

[^key-0d4b111311777831fdffba581e848ea6]: Sch. 9 para. 5 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^key-0d717e014e2ac42d02e0b61cef256e2c]: Sch. 10 para. 5 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^key-0e1a221ed43e81a753b0777427765028]: S. 176 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-0e22a095e41e8693fa7318f4c45ed9e9]: Sch. 19 para. 19 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-0e77a10a2be9269a9a10434a1228683a]: Words in s. 78(1) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 10(3)(d); S.I. 2026/82, reg. 2(z10)

[^key-0e7dfc288a4e86482de3e20d1740cfa6]: Words in Sch. 21 para. 12(1) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(9)(b)(i) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-0e87ceeaeb473d5c9e0fc5a4ea92b025]: Sch. 20 para. 28 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-0ebeabb9baa1c3270129deaf8098cef1]: Sch. 20 para. 37 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-0ec738b14348d17f3e62b70513465a13]: Sch. 19 para. 55 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-0ee3310713d1629ddd39380fe64cbd00]: Sch. 19 para. 42 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-0ef61c79a2caa1fceea57dd634375af5]: S. 162(1)(ba) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 100(7), 142(1); S.I. 2026/82, reg. 2(s)

[^key-0f889346244276db6c824e1a59269789]: Words in s. 149(2)(b) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 6 para. 15(a); S.I. 2026/82, reg. 2(z8) (with reg. 5)

[^key-10250dcd0017993ac3d096de2e88503b]: Words in s. 15(2)(e) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(7)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-104c707c6a01b69f5d71d71da7c75c6d]: Sch. 19 para. 101 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-1051e17c49a81d00262c51a04b7fce43]: Sch. 19 para. 127 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-111e5ef955c0f9aedabdb8e61940d711]: Sch. 1 para. 23(3)(e) repealed (31.12.2020) by The European Parliamentary Elections Etc. (Repeal, Revocation, Amendment and Saving Provisions) (United Kingdom and Gibraltar) (EU Exit) Regulations 2018 (S.I. 2018/1310), reg. 1, Sch. 1 Pt. 1 (as amended by S.I. 2019/1389, regs. 1, 2(2))

[^key-111f1a1c71e0256436529fc90b060e72]: Sch. 7 para. 26 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-1129e4d0e1a9eae74e5f5e286620ccd1]: Words in s. 186(3) substituted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 106(4)(d)(i), 142(1); S.I. 2025/904, reg. 2(k)

[^key-1148dc6616b45f92ec3191558e2d7f41]: Sch. 19 para. 353 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-11713a4a83eebe64064274ef861d5f85]: S. 146(3A) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 98(2)(b), 142(1); S.I. 2026/82, reg. 2(q)

[^key-1184aae7611f8dceba09b9e679d2f54c]: Sch. 1 para. 34 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-11c07ee11f2167bbb1763bd246448e85]: Sch. 19 para. 217 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-11ce3e1bdc55c65611f28c3a935d263d]: Sch. 19 para. 95 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-11e7c66b8939b2e6758255eed50c6b54]: Sch. 19 para. 305 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-122e04060480ebe585560440bf984c41]: Words in s. 171(8)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 72 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-12596093cad9b0116c5d74567c3cb502]: Words in Sch. 2 para. 4(1) substituted (8.3.2024) by The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024 (S.I. 2024/342), regs. 1(2), 2(2)

[^key-12685902bd117eecdf41483cba453640]: Words in Sch. 3 para. 20(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(19) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-1284f5ea94d84d42dc81e80877b05881]: Sch. 2 para. 1(b)(ii) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 71(10), 142(1); S.I. 2026/82, reg. 2(d)

[^key-12e3d0fff7beb57219b3b7559e3266e5]: Word in Sch. 2 para. 3(2)(b)(ii) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 11 para. 29(3); S.I. 2026/82, reg. 2(z12)

[^key-12f1ccb28a2bd9f965f7c31d10395d32]: Words in s. 205(1) substituted (1.1.2024) by The Retained EU Law (Revocation and Reform) Act 2023 (Consequential Amendment) Regulations 2023 (S.I. 2023/1424), reg. 1(2), Sch. para. 87(a)

[^key-12f86fac951fc73c0140d571a31e9292]: Sch. 19 para. 210 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-134fd5e04dd25c969baf7cb8da305ebf]: Sch. 11 para. 10 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^key-1366acd7f95a9c1e06161794880e0719]: Sch. 20 para. 35 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-13b42698594ab524aa3bd391ddbb00d8]: Word in s. 196(2) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 100(10), 142(1); S.I. 2026/82, reg. 2(s)

[^key-13cffa7e513a8d19da475b708717a6c5]: S. 161A inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 102(4), 142(1); S.I. 2025/904, reg. 2(i)

[^key-145f005fd8042c51b0664ff136e39957]: Sch. 7 para. 18 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-14aa686d4a0f1f82327479d58921ab37]: Sch. 19 para. 331 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-14ad0fde7b800982b4c427e3cb39df35]: Sch. 1 para. 6 modified by S.I. 1999/677, art. 7(1)(2) (as substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 237 (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g))

[^key-14dc1bd03f341f46d16e2b23a8854253]: S. 51(1)(ba) inserted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 79(7)(a), 142(1); S.I. 2025/996, reg. 2(1)(a) (with reg. 3)

[^key-15470efb9363c5548c4b065c183e0df8]: Sch. 19 para. 214 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-15749221f368fbb105364a1b67ee891c]: Sch. 19 para. 38 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-1590f8dd0e2f25840803266b0a89f970]: Words in s. 189(4)(c) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 83(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-1595a2a030d641505cc5c2b290d675b1]: Words in s. 115(10) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 47(10) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-1622e2e636a8697beaac52d8c441e4ac]: Sch. 1 para. 20 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-163fd2a2c3332fd617114d54434beede]: Words in s. 155(1)(b) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 100(4), 142(1); S.I. 2026/82, reg. 2(s)

[^key-16bde097283134ad53e67bc7eced6507]: Sch. 9 para. 2 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^key-16c6bec2c0f932b75e6e897d0d0214e1]: Sch. 19 para. 300 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-17124b67fbec472842be06ef4430da1f]: Sch. 19 para. 416 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-1751702947b03f5d997effe7d3559e00]: Sch. 19 para. 59 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-177f4502bd713ba257f8a94220cf312a]: Words in s. 53(5) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 75(2)(b), 142(1); S.I. 2026/82, reg. 2(g)

[^key-17a7230647a2583246524911d5578f98]: Sch. 19 para. 403 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-18239a18e3bd9a603de2281708e6151d]: Sch. 19 para. 241 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-1851ffdfb55a1ae4837371dce443325b]: Words in s. 110(2)(a) inserted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(9)(a), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

[^key-187011edc25500f0e9ac9f2a1b42e1b3]: Sch. 19 para. 180 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-187293003be44c5bcbbaa54a11235709]: Sch. 8 para. 1 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-1891a577bed40a948968a85d66637a93]: Sch. 7 para. 11 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-18a50fc05df7fa3cf98132d81799b519]: Sch. 19 para. 196 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-18c04c183259e8b8dda524fe72d1db0a]: Sch. 19 para. 328 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-18c493f49d96ae6ccb3c8cced0fddc5d]: Sch. 19 para. 421 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-18f5225df519ce6258d663cbb0e9a035]: Sch. 7 para. 42 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-192a1bf9519afe99b825d17615dfc26e]: Sch. 5 para. 7 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-192b65f20b37cd2b1425d8b8099bd30c]: Sch. 19 para. 427 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-197984193b1a0c63c5cf1d6bdb297f95]: S. 45 cross-heading omitted (5.9.2025) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 79(5), 142(1); S.I. 2025/996, reg. 2(1)(a) (with reg. 3)

[^key-1a7305813bab945662593ecbbd86a3cc]: Sch. 19 para. 267 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-1a7fa63e5530837c3583f0e5c7220882]: Words in s. 5(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 6(2)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-1aa44aabdb698a96bbb40d99be769ffe]: Words in s. 181 omitted (20.8.2025) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 11 para. 24; S.I. 2025/904, reg. 2(y)

[^key-1ae0cb7d1e50923dabeee3e28331a92e]: S. 206: power to amend conferred (19.6.2025 for specified purposes, 20.8.2025 in so far as not already in force) by Regulation (EU) 679/2016, Art. 11A(3) (as inserted by Data (Use and Access) Act 2025 (c. 18), ss. 74(1), 142(1)(2)(h); S.I. 2025/904, reg. 2(c))

[^key-1aeb023a0722a101af167f5207dc0988]: Sch. 20 para. 1 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-1affb68b010b011243d40d4337506c52]: Word in s. 205(5) substituted (1.1.2024) by The Retained EU Law (Revocation and Reform) Act 2023 (Consequential Amendment) Regulations 2023 (S.I. 2023/1424), reg. 1(2), Sch. para. 87(b)

[^key-1b040d8edc9113c2fe18f72c65488af0]: S. 155(1)(c) and word inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 98(4)(b), 142(1); S.I. 2026/82, reg. 2(q)

[^key-1b3210620a45e848232ab9e47619a0b4]: Sch. 19 para. 134 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-1b4ccf50fa29ed8677a8eda0173f00f9]: Sch. 19 para. 349 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-1bc27c21cc548d92bc3de596a7cdbe0e]: Words in s. 213(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 90(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-1bdda78ceb7b33ce85740d055b1a3758]: S. 24(4)(ba) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 87(2)(a), 142(1); S.I. 2026/82, reg. 2(o)

[^key-1be29581136bd4c18ff6bb98bfbee461]: Sch. 7 para. 28 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-1be9e273ac0b64d03506cf32210c1a57]: Sch. 3 para. 18 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-1c030dd28010faaf2bbe31a050893ce4]: Words in s. 26(2)(f) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 34(3)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-1c131e673e4b114091bed8a61ac7815e]: Sch. 9 para. 3 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^key-1c39091bca9026eb347e79e1fa4a78e5]: Words in s. 205(2)(e) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 23 (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-1cc22440a757c75d6a761e14e8508d42]: Sch. 20 para. 18(8) inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 101(4)(b) (with reg. 5) (as amended by S.I. 2020/1586, regs. 1(2), 5(3)); 2020 c. 1, Sch. 5 para. 1(1)

[^key-1ccd56afc99d98d997ea26936d814e5e]: Sch. 7 para. 35 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-1d0aacbc6a3f57fb9614a5fc01346883]: Words in s. 15(2)(c) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(5)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-1d18615dcf9a20c1820111b3a81f31c2]: Sch. 19 para. 302 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-1d193e02860f55c99db471219ec3f06e]: Sch. 7 para. 47 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-1d55fa5fc856a1be58b2f58fd5d98059]: S. 165(6) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 66(4) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-1d6dfd3a633b39d621c1ab30454c7837]: Sch. 21 para. 10(6) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(8)(c) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-1e29eba27e76c7408aaff2905df122df]: Sch. 19 para. 313 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-1e4185b59d1be365db23794ea0ee1651]: Words in s. 16(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 20(2)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-1e98d97332c9829fa200bf50f75866b5]: Sch. 19 para. 63 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-1ecad5e9871f13d9cd7d7b16b0161128]: Pts. 5-7 applied in part (with modifications) (5.2.2026) by S.I. 2003/2426, reg. 31, Sch. 1 (as substituted by Data (Use and Access) Act 2025 (c. 18), ss. 115(5)(8), 142(1), Sch. 13; S.I. 2026/82, reg. 2(y)(z14) (with regs. 8-11))

[^key-1ee41f387acdf11b0ee41fecc521ae98]: Words in s. 115(4) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 47(5) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-1ee641f3c321f91dfed1e82cc0461f56]: Sch. 19 para. 135 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-1f749532a8740f1e9eda4d0128a2a075]: Words in s. 142(9) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 59(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-1f896c19e41b1006ed860e9969942795]: S. 182(3)(a) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 77 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-1fb38bce83de1fe5b681b8cdde5ff129]: Sch. 19 para. 111 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-1fef7e66182de00ab308293cffb72a92]: Sch. 13 para. 2 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

[^key-2041ee869046f0555101f3c828389214]: Sch. 12 para. 12 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

[^key-20637b6951bd30d789aabe29602a4eb2]: Sch. 19 para. 97 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-20ea859c115d39d5e3436826e6c5c262]: Sch. 21 para. 8 omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(5) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-2100b3196361a95d8557db2f9b70e820]: Sch. 19 para. 381 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-211221de3dc056053a4c24f48f61a5c6]: Sch. 19 para. 110 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-213b489d8cd0817f932abf8b31c43adb]: Sch. 19 para. 2 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-2168a1b3e7131b302945e8fe317f3c27]: Words in s. 87(1)(a) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 71(9)(a), 142(1); S.I. 2026/82, reg. 2(d)

[^key-218ac3e533ec93bd9bdc354aed5273ba]: S. 74A omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 4(1); S.I. 2026/82, reg. 2(z10)

[^key-21b9303a7f71f231674bf2d10ba2e078]: Words in Sch. 3 para. 6(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(9) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-21cd06c381ae74c2c93a120a10d0d395]: Sch. 20 para. 2 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-21f4d7f3e477eb190524128d785be4e6]: Words in s. 15(2)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(3)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-21fced2ab0bcbddc5fc58b17d5e47dcf]: Sch. 19 para. 287 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-220a17bfd3f14d70dbffc23b40f7617c]: Ss. 74AA, 74AB inserted (19.6.2025 for specified purposes, 5.2.2026 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), s. 142(1)(2)(h), Sch. 8 para. 4(2); S.I. 2026/82, reg. 2(z10)

[^key-224603786e8386f2203555d1040fa06f]: Sch. 7 para. 2 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-224beca082638e8b5e55543343cc38ac]: S. 158 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-2289dc8b6eefe1d46d6a782ef7ea28b8]: S. 19 and cross-heading omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 86(6), 142(1); S.I. 2026/82, reg. 2(n)

[^key-228a2c4e83873d484f3840e102ea75d9]: Word in s. 171(6)(a) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 11 para. 23(3); S.I. 2026/82, reg. 2(z12)

[^key-22a9c9e8dbf86322bdf3b841fb939851]: Sch. 19 para. 122 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-22c9cb2cd2037b308003142aeeee5b32]: Words in s. 5(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 6(3)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-22d803690c292d06381ab7cc715f03f9]: Sch. 15 para. 6 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-22e89107ecf415c850b5a6f0b9b59302]: Sch. 19 para. 232 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-23171ba5132253c85a145de87e1054c5]: Sch. 19 para. 207 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-235e6b33584803340fe72ec9d6854d43]: Sch. 16 para. 3 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-2363f203a486d42fce7735a05b0e351b]: Words in Sch. 5 para. 4(4) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 95(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-236e24c6f934d419e363944d3a1f36fa]: Words in s. 24(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 32(4)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-239c68a5d49bddfad7b7c6cbedee418b]: Sch. 7 para. 6 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-23f48e53190001650ee581d5ea78c872]: Sch. 19 para. 304 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-23f61e511accf4c5242cc571d1f808b8]: Words in s. 79(8) substituted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(8)(f)(ii), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

[^key-24005f7ff051c74ba6fbee3b3344f7d6]: Word in s. 104(1) substituted (17.11.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 90(6), 142(1); S.I. 2025/996, reg. 2(2)(b)

[^key-2403c9bfbf96edff074974c79b22608a]: Words in s. 75(3) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 6(6); S.I. 2026/82, reg. 2(z10)

[^key-2434c3fb6c8b5ee17896e645120e0c61]: Sch. 2 para. 27 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-248079bcb833bce1b84980bc42a826bf]: Words in Sch. 3 para. 8(1)(b) substituted (30.11.2022) by The Health and Social Care Act (Northern Ireland) 2022 (Consequential Amendments) Order 2022 (S.I. 2022/1174), arts. 1(2), 12(3)(a)

[^key-24b3bbdc5e59d705d0210a6f74674451]: Sch. 19 para. 33 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-24c67fb416c38423b577d923c55b3ec9]: Words in s. 26(2)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 34(3)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-24f952f7070198136c58ea4ed6a49950]: S. 205(2)(za) inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 85(5)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-25346aaf6bc9db597d7da83585c8bc2f]: Sch. 19 para. 118 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-2593e756947a665be89cb620b04ef451]: Words in s. 72(1)(b) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 2(b); S.I. 2026/82, reg. 2(z10)

[^key-25d3635823d956cf15b550afd13d4e98]: Words in s. 206 Table inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 86(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-2626514eaa370e042778c491444aee9c]: Sch. 19 para. 11 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-26277b73a6ec8bb86d52ca4da18c621d]: Sch. 19 para. 149 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-262a153ed6a3f20ecbab0d2e9c49834e]: Sch. 19 para. 405 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-265015252b5915c275c3cce0e5a160d7]: Sch. 15 applied (with modifications) by S.I. 2016/696, Sch. 2 (as substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 406 (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g) (with reg. 4))

[^key-265056c26b76a20e1dbc856fb69e9468]: Sch. 19 para. 121 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-2686f9acbc03b702d067ea3f8d19b78f]: Words in s. 157(4) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 100(5), 142(1); S.I. 2026/82, reg. 2(s)

[^key-26d90feb72847e03ea021fb96e4178ec]: Word in Sch. 16 para. 4(1) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 101(3)(b)(i), 142(1); S.I. 2026/82, reg. 2(t) (with reg. 6)

[^key-26ded41f68d1f732b3865cc93e8d88fd]: Sch. 2 para. 19 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-26e02e31432cdbfaad7525568f904f96]: Sch. 19 para. 280 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-26e53c4365c637973f201bac1a9d893e]: Words in s. 26(2)(g)(ii) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 34(3)(e)(i) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-274e371213d21f8c518714836a7fd931]: Sch. 8 para. 2 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-278bdb819fea7c369510f10a29ffbc41]: Sch. 1 para. 24 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-279763c8e56d8c1e5cf0701b35542316]: Sch. 19 para. 78 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-27acdc78f2593bdf3b923e0a174dcec0]: Sch. 19 para. 106 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-27e1ea602a2a134d5052b4c1e8e3440c]: Sch. 19 para. 413 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-281d4e6540db13c15fe85d6b8cfcaa7f]: Sch. 19 para. 205 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-2889cf5caada78513e3eb57b96eea5cc]: S. 112 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^key-28d4daa78be4e5d33285e5535b47873d]: Sch. 10 para. 6 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^key-28eb7957e80be04910aa9b6ac58baaf7]: Sch. 19 para. 141 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-28f473b60938488229022a08cd48e4ad]: S. 110 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^key-290821ace42a16c497f396db54e9f858]: S. 4(3) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 5(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-291309ec0bfa295d73c7089ca1b91dd5]: Pt. 2 Ch. 3 heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 27 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-294f9f790bda664a2188b1b513ce0b8a]: Sch. 9 para. 1 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^key-2963c2ddea852b4e0d3eafea9277404d]: Word in s. 21(5)(a) omitted (25.1.2023) by virtue of Advanced Research and Invention Agency Act 2022 (c. 4), s. 13(1), Sch. 3 para. 15(2)(a); S.I. 2023/58, reg. 2

[^key-296a24e4c876580d5b86d4ca2becc824]: Sch. 19 para. 151 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-29a7c98ef1e800734a584e99822ec2b2]: Words in Sch. 2 para. 26(9) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(21)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-29cfe17814242f806ba3aeb1d9e9afd6]: Words in Sch. 3 para. 19 substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(17) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-29e112b63328c8a746536836db1c3966]: Words in s. 1(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 2(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-29e6a8adebc12062d8e7bbdbb4f20243]: Sch. 15 para. 2 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-2a00008589acb6f36983567b9fc6e820]: Sch. 19 para. 120 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-2a3a6de533c8c12b0494351998aa1271]: Sch. 20 para. 24 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-2a41d0e360feb8153add5e203acb19c0]: Words in s. 181 inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 100(9), 142(1); S.I. 2026/82, reg. 2(s)

[^key-2a87aa80873751cb087012413e702374]: Words in s. 24(2)(c) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 16(a) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-2acdeca126a2ebe1ce6a4586947c1173]: Sch. 19 para. 306 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-2b2224275f44680ddca2bfd57fbc2416]: Sch. 19 para. 250 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-2b9674d7bfd3049679cc97dc1b298995]: S. 161 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-2b9b3d8589286b3b26ca6b92d1868c01]: Sch. 19 para. 404 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-2bae9f70ba5cbd2b51246898aabb15e1]: Sch. 19 para. 376 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-2bb2789479074d0f5b04dc7d5c186c7f]: Sch. 21: power to amend conferred (19.6.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 142(2)(g), 143(2)

[^key-2c7e00ac1f688e12ca2bcc445e3ef4a8]: Sch. 19 para. 192 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-2c823c725443a820c779371731696d6c]: Words in s. 72(1)(b) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 2(a); S.I. 2026/82, reg. 2(z10)

[^key-2cb53e6958194b9c8f2dfb3797109eb5]: Word in Sch. 21 para. 12(1)(a) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(9)(b)(ii) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-2d48534b027b25a30a2b80c2a510dd6b]: Sch. 19 para. 243 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-2d89ded5d2f38b02918f66bf72aa9a67]: Sch. 19 para. 34 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-2df4d20a1557bfe80bf3be5e338ab1e3]: Sch. 19 para. 87 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-2e0041ef43a73fe0769dd148a0a2f935]: Sch. 19 para. 411 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-2e016290a3bce07321b5932b8b9442cb]: Sch. 19 para. 10 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-2e19ecb9205e26fabcbb68559b8159f5]: Words in s. 24(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 32(2)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-2ee236ebdbefaa20152eb5e389c3f15f]: S. 139A inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 95, 142(1); S.I. 2025/904, reg. 2(h)

[^key-2f056c8fbea11fd72923190c3a60a7e8]: S. 82(A1) inserted (17.11.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 89(2)(a), 142(1); S.I. 2025/996, reg. 2(2)(a)

[^key-2f0e9d2ad7758b3d8eeaabe264498df0]: Sch. 15 para. 11 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-2f2b6b8a9c341182dd7aa56637785a0a]: Words in Sch. 2 para. 1(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(5)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-2f908b9fefb61f6ccda52c5f821ade6a]: S. 154 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-2fbe32aca2b996b3d860ba43d5ed4d2a]: Words in s. 5(1) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 6(2)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-2fdc0f7c7c058ffa2465d97115f722c5]: Sch. 19 para. 286 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-3039aa24ff9ca1b28fabc3817626b72d]: S. 77 cross-heading substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 8; S.I. 2026/82, reg. 2(z10)

[^key-305ad8039b1a46c5f9ea78fe8a6b5ff7]: S. 183(2A) inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 78(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-30d4dac90018730975d3332a90aa59d7]: Words in s. 24(5)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 32(5)(d) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-30f8f37f3351a58e02d6f5b4850e8f6a]: Sch. 19 para. 299 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-30f9474fc1a05e0f61d821c1b8087a7b]: Words in Sch. 21 para. 6(1)(a) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(4)(a) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-30fb2804b001c6b0ad13a62b29019b1d]: S. 128 omitted (20.8.2025) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 92(5), 142(1); S.I. 2025/904, reg. 2(f)

[^key-3119209adeaef6a1df5147b527a4b2b7]: Words in s. 77(8) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 44 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-31302a37f9c6f4ae81079d8a479c0dc1]: Sch. 19 para. 169 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-3133faf8febe41406d2f9f821f7ee0d1]: Sch. 19 para. 143 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-31415131204b8cc0dde6edf55660411f]: Sch. 19 para. 46 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-3168771c0476757a85e3db057f143c5a]: Words in Sch. 18 para. 1(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 99(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-3180f2fd1280321b20ee6e24d5d513cc]: Sch. 1 para. 9 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-318cdee146a506edd9aa20e0bb24b3f9]: Word in s. 86(7) substituted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 74(7)(b), 142(1); S.I. 2025/904, reg. 2(c)

[^key-31bb776982600aed74cbcf435538a957]: Words in s. 125(8) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 11 para. 19(3); S.I. 2025/904, reg. 2(y)

[^key-31dcfda5dcd4e66221acf33abd97bf04]: Sch. 20 para. 23 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-324729d85d46bf435833df74eab03372]: Words in s. 26(2)(e) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 34(3)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-32de75b19001af6b4273053c3b092e07]: Sch. 11 para. 7 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^key-32f6f942b277dbd276b96d5b0984e118]: Sch. 19 para. 157 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-33106c6218135aa1517b7c246074feb9]: Sch. 19 para. 6 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-3322ebf4c927f1806b05df81f4e0343f]: Words in Sch. 4 para. 1 cross-heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 94(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-3327a481d30c9bdff556a8b76ded69cb]: Sch. 19 para. 123 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-332de4f04a0a242ded4037391f956f33]: Words in s. 36(1)(a) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 71(8)(a), 142(1); S.I. 2026/82, reg. 2(d)

[^key-334055490339c13a3065b12d15d14412]: S. 163 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-3369d46a2dc6feb2b919520a08308048]: Sch. 19 para. 103 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-3381b8ddd4ef0abf6790266e0cb8ac00]: Sch. 19 para. 228 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-33844decc2c84b21970a5264085c1f39]: Sch. 7 para. 27 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-33edea286b09352abf016a9e1f3354e0]: S. 120(2A) inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 52(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-343856c646dbefbbbdfd8912476af912]: S. 139(2A) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 102(2), 142(1); S.I. 2025/904, reg. 2(i)

[^key-34cd2e6cbe01eabb3d06225a7efe69b9]: Words in s. 205(2) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 85(5)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-34d8058ca9b991f37fca48403aab4b4a]: Words in s. 25(2)(a) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 33(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-34e9a827a167dace4af311fb2cd2994a]: Words in s. 115(2)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 47(4)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-34f65a9d3e96f8d7ff571af361392340]: Words in Sch. 2 Pt. 1 heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-34fe6f107e4f7bc7983506ee6a91cf35]: Sch. 19 para. 434 in force at 25.5.2018 in so far as not already in force by S.I. 2018/625, reg. 2(1)(g)

[^key-351ec702d4e1f2a9e1b9458310accfc5]: Sch. 7 para. 46 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-35344b59ed8359babcc5cd6308a3eb8d]: Sch. 19 para. 66 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-35558747b8c46c8ff03f147f0a7482a4]: Sch. 19 para. 341 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-3560e5cacbfff2ce849e5488c234c4c9]: Words in s. 115(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 47(5) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-357515c65e8f9ab1a677364595663442]: Sch. 19 para. 395 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-358700da09bd3b3db589d842d7dd9ab7]: Words in s. 17(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 22(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-35c1456922e0715ba072c49f2627e940]: S. 76(A1) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 7(3); S.I. 2026/82, reg. 2(z10)

[^key-35c840436ea427bbc6b05f90d6e943f1]: Sch. 19 para. 131 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-35db6d3245ae82a21c0141b79278945a]: Words in s. 25(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 33(2)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-35f6fa2fbc924bdd78dd22662e1d4e70]: Words in s. 169(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 70 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-36402eee3cdb8da6d3cb1e50ca39070b]: Sch. 19 para. 310 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-36599635eca521fc080bdf0f265f7284]: Sch. 12 para. 10 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

[^key-36a3e256a527d89c5a740d38dbd8973e]: Words in s. 26(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 34(2)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-36b37c6d1c4d4736d1dab263576fcebd]: S. 125 in force at 23.7.2018 for specified purposes by S.I. 2018/625, reg. 3(b)

[^key-372630a73b4028cf109f79d1f0665678]: Words in s. 187(5) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 81(6) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-377a1b0604cd68d461b2246e995e46e0]: Sch. 7 para. 17 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-37cacf20bf249c74413aada2c52be2c5]: Sch. 19 para. 325 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-37cead3703128bdbe14f9449c15cb01c]: Words in s. 115(2) inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 47(4)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-37f00e3fbcf6a1325a7bdb8cee3541b8]: Words in s. 3(9)(d) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 107(2), 142(1); S.I. 2025/904, reg. 2(l)

[^key-37f0e7baab56b10e415c83cab5bddb11]: Words in s. 74B(4) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 5(5); S.I. 2026/82, reg. 2(z10)

[^key-3813ee8247c9e3239d38238f596aab7f]: Words in s. 120(6) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 52(4) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-38b76457e1736087523fe425b9baf70a]: Sch. 19 para. 371 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-38c99db18cd5c194cee9495ce48403e8]: Sch. 19 para. 223 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-38e9d9c17d56c79090d6074e03e8ddbc]: S. 73(1)(c) and word inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 3(3)(c); S.I. 2026/82, reg. 2(z10)

[^key-38f52a9e32414b17494731e4cbb18039]: Words in Sch. 2 Pt. 4 heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(15) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-38fa0eb45714967ac6481ea2074debe8]: S. 84(6B) inserted (17.11.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 90(5)(b), 142(1); S.I. 2025/996, reg. 2(2)(b)

[^key-391aec4a4ec0685cabdd1aa28a8ba785]: Words in s. 15(2)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(3)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-394e213ab391d7a2301095c644dcd821]: Sum in s. 157(6) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 64(5) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-394f7b7301975b7000579ddf95606947]: Sch. 7 para. 10 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-398509b660879f90723134aa1a29ea11]: Sch. 20 para. 45 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-39a16e9f2a37e4b260ddb9752a4bc3ad]: Sch. 19 para. 363 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-39a195e0216d6cbc9ebfe1cdd1c18fcd]: Words in s. 3(10) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 4(4)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-39b8862f2d1f7dfd1e97471a115f8bff]: S. 3(14)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 4(7)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-39e0ce1bd3a8467f4ceae07a33f920c5]: Sch. 7 para. 5 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-39f62cafffb590c7ab1e4cceea210f8b]: Words in s. 125(3) substituted (19.6.2025 for specified purposes, 20.8.2025 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), ss. 92(3)(c), 142(1)(2)(h); S.I. 2025/904, reg. 2(f)

[^key-39f87c03dd19737cd940c5d9992de450]: Words in Sch. 2 Pt. 2 heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(9) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-39fe8a9769c33999f0f1fbca041c1c1b]: Sch. 19 para. 27 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-3a36915e800b4ada4429b4c079cdc070]: Words in s. 80(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 46(3)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-3a7394d89afbce22809a39b409bbe6c4]: Words in Sch. 1 para. 39(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 91(4) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-3a7f17dddd435cdc7527fdbd1c2a1015]: Sch. 19 para. 215 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-3a9c148245671edfca7949b3fa2966cd]: Words in Sch. 2 para. 4(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(8)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-3ab92aa41a35b7fca7dfb7bb9e94ab09]: Sch. 19 para. 176 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-3af973959f9df0279172807036d2ff65]: Word in s. 135(3) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 94(2)(d), 142(1); S.I. 2026/82, reg. 2(p)

[^key-3b189075aee602d5dd61a066dc8f918f]: Sch. 19 para. 43 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-3b334490a5b70cdd54dc63818afde14d]: S. 2(2) omitted (20.8.2025) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 91(2), 142(1); S.I. 2025/904, reg. 2(e)

[^key-3baa6060931d93b6943577f334d005b6]: S. 75(4)-(7) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 6(7); S.I. 2026/82, reg. 2(z10)

[^key-3be04071b6e982862efa5dedc98b91c5]: Ss. 82A-82E inserted (17.11.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 89(3), 142(1); S.I. 2025/996, reg. 2(2)(a)

[^key-3bf08e78325296b3e02f96ed8461dc11]: Words in Sch. 21 para. 9(3)(a) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(6)(b)(ii) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-3c0bda84559a635149b77d2604f5e78b]: Sch. 19 para. 308 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-3c2c46a40b01364a2f55ced34f0da62b]: Sch. 2 para. 17 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-3c2ca8b8a39fe6a1c43d2d0d0aa52508]: Words in s. 17(6) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 22(4)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-3c4a6e119bfcb1724fbbe043ea85c3d1]: Words in Sch. 13 para. 1(1)(g) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 97(2)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-3c842d85c1197ff1b42f60c711f26783]: S. 15(4A) inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(11) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-3c9f258002e16325ad02c0bb9c1494d2]: S. 48(8) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 38 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-3cb3866fa4cb74bba6a6aa92e8ffe358]: Words in s. 124(5) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 11 para. 18(b); S.I. 2025/904, reg. 2(y)

[^key-3cd4b21c486fb333c4f69a8f7f6ab0fa]: Sch. 1 para. 27 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-3d17c501d2052e26fccb827029f0a864]: Word in s. 16(2)(a)(ii) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 20(3)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-3d3c389152b7c8322a41c76aa2f421da]: Sch. 1 para. 15 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-3d4bdf3729cdaf65278d4e8242b8c0e8]: Sch. 19 para. 76 omitted (29.3.2019) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(3), Sch. 4 para. 3

[^key-3d53c868b8cc9dd299c7ae1b85106a23]: S. 71A and cross-heading inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 84(6), 142(1); S.I. 2025/904, reg. 2(d)

[^key-3e188053ee3dc28fc28c56ca4e8c9040]: Words in s. 185(4)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 79 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-3e3a8fdd4b1ab84d341304a4ffa3ea74]: Sch. 7 para. 15A inserted (1.5.2022 for specified purposes, 5.12.2022 in so far as not already in force) by Armed Forces Act 2021 (c. 35), s. 24(1), Sch. 5 para. 49; S.I. 2022/471, reg. 2(e); S.I. 2022/1095, reg. 4

[^key-3e6824e9fac1395ac56538683f7c074b]: S. 123 in force at 23.7.2018 by S.I. 2018/625, reg. 3(a)

[^key-3e93ab39b36e0906482aa2864196a302]: Sch. 1 para. 6 modified by S.I. 2007/1118, art. 5(1)(2) (as substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 324 (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g))

[^key-3ea752fe762439ea500ec02ee2749c5a]: Words in s. 15(2)(d) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(6)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-3eaa0823ead96c831913592484a5d070]: Words in s. 45(7)(a) inserted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(4)(c), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

[^key-3eb4d6aaf025a6d26ecf486d178f137f]: Words in s. 115(2)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 47(4)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-3ed12644095170b55de459a25220e589]: Word in s. 155(1)(a) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 98(4)(a), 142(1); S.I. 2026/82, reg. 2(q)

[^key-3eefcad59e5059bb1f25e0745e831a85]: Word in s. 129(3) substituted (19.6.2025 for specified purposes, 20.8.2025 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), ss. 92(6), 142(1)(2)(h); S.I. 2025/904, reg. 2(f)

[^key-3ef88b0e811cc1444359e5e0cb768e95]: Words in s. 28(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 36(3)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-3f625eda300a4caa4b2537beb0425bcb]: Sch. 20 para. 13 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-3f7ad845a14fe6000892c2d50d22b759]: Words in s. 73(4)(b)(i) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 3(5)(b); S.I. 2026/82, reg. 2(z10)

[^key-3f969b23e46516434ae2e89ddc69df68]: Words in s. 15(4) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(10)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-3f98c0a7a2654c2ef537f15b5f7eb22f]: Sch. 19 para. 423 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-3fd65504d7dcf79fa723e5de5abf3481]: Words in s. 182(6) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 22(3) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-40291df4906d4cc34785699c69e47b83]: Sch. 2 para. 28(4) inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(24)(d) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-403f2e7140850b3e5a4883ebe1dfba4a]: Sch. 19 para. 40 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-4066d18d7abda68a6bfb1fb3a9c5d7f0]: Sch. 19 para. 406 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g) (with reg. 4)

[^key-4095aaa2b37901eb26e6c02f6c373ef3]: Sch. 20 para. 59 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-40ea538764fb252a2c1885eea6cf2028]: Sch. 19 para. 290 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-411bc56475ba755c5cf8ff8876e096ba]: Sch. 20 para. 38 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-411ec4dab5ca54d4b44cf574e5fc47d3]: Sch. 20 para. 20 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-413d7a05865475abd36b30f3fc486102]: Sch. 19 para. 45 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-4166d151c2161e3cfa1baed97addc41e]: Words in s. 5(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 6(3)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-41f1fed7dde177dcbd4959f74da05f9b]: Word in s. 16(1)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 20(2)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-4216612a3b459824a4e163c8d4af1a07]: Words in s. 7(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 10(2)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-422675a4f99ccd66679390d411532525]: Sch. 19 para. 102 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-427e92f73b3e719ad3cf5a1214730481]: Words in s. 187(1)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 81(3)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-428c10615c092e807aebccc777cfb710]: Sch. 21 para. 12 renumbered as Sch. 21 para. 12(1) (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(9)(a) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-43046246cf3f27e7ff102d3f13a65766]: Sch. 19 para. 252 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-4306e68c9bcde53b4480e1f50d20f060]: Sch. 2 para. 5 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-431929efc48cfd1c7e9f739cdd057f77]: Sch. 10 para. 4 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^key-43399f72f3c3d874b4165535c7568a5d]: S. 127 in force at 23.7.2018 for specified purposes by S.I. 2018/625, reg. 3(d)

[^key-435242e13aafe834143b8d1833684521]: Sch. 19 para. 425 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-43793f9ce196b4380bba69ea0333c340]: Sch. 1 para. 21 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-43bc0992bbfa072aa58b065a6a0dbcb2]: Sch. 8 para. 7 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-43bee759a5f6cbf8926b877ad7d6d594]: S. 78A inserted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(7), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

[^key-440e3de22d9a2fac78e668ed17f56a46]: Sch. 10 para. 7 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^key-445f17fb666df6c1f9cf69c559a379b6]: Sch. 19 para. 230 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-449c1a7ed7588ac58e65dadd14c1c1b4]: Sch. 7 para. 30 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-450c7b25512dedb58adb3ea87cb6ba20]: Pt. 2 Ch. 2 heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 7 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-450d49414ec7653fc52157b5f13d5626]: S. 78(7) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 10(10); S.I. 2026/82, reg. 2(z10)

[^key-45472bbd00a393b549f1e72fd153ac3f]: Sch. 19 para. 119 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-456760319c42feac9a7898e5f44b1b19]: Sch. 19 para. 12 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-459def90d3d948fe23eed3889127cc51]: Words in s. 207(4) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 87(6) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-462113f09780c8525a56db11ffee2460]: Words in s. 24(2)(c) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 32(3)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-4670484b4cf22739c3b6dc134a6750aa]: Words and comma in s. 117 omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 49(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-476957a259953895973b48488fd85773]: Sch. 1 para. 6 modified by S.I. 1999/3145, art. 9(1)(2) (as substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 238 (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g))

[^key-479c0bc37322fff5ab05a964ed5802b3]: Sch. 19 para. 162 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-47b298b6510458494f665aeeee02e734]: S. 82(4) inserted (19.6.2025 for specified purposes, 17.11.2025 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), ss. 89(2)(d), 142(1)(2)(h); S.I. 2025/996, reg. 2(2)(a)

[^key-47be8568fc2fb24fc749f0903b5c4987]: Words in s. 7(4) substituted (25.1.2023) by Advanced Research and Invention Agency Act 2022 (c. 4), s. 13(1), Sch. 3 para. 14(b); S.I. 2023/58, reg. 2

[^key-47eb0702215830c476b0ed47eb46e7dd]: Words in s. 8 omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 70(7), 142(1); S.I. 2026/82, reg. 2(c)

[^key-482221ff062473b1919305c7eba14534]: Words in Sch. 21 para. 10(1) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(8)(a) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-482cfc0bdfdc1cd7467d24b06e056b53]: Word in s. 203(1) inserted (17.11.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 90(8), 142(1); S.I. 2025/996, reg. 2(2)(b)

[^key-4849df2d1d93b321b98b1225cfbb8277]: S. 79(3A) inserted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(8)(b), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

[^key-48556573bb2ddc6e999946cea4c7d1d1]: Words in Sch. 2 heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-48752be13f0732ee1bc7ba1f42c99452]: S. 54(3A)-(3D) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 76(6)(c), 142(1); S.I. 2026/82, reg. 2(h) (with reg. 4)

[^key-489b6d3d98bf09a70287853137ab35e6]: Words in Sch. 2 para. 27(3)(a) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 87(2)(c)(i), 142(1); S.I. 2026/82, reg. 2(o)

[^key-48eaeef4a832b970bc428de9cf37c88d]: S. 175 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-493b6699ab43b773b99b03d2551ed8b8]: Words in s. 15(2)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(4)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-4946c510a1d7d274f8f33e589eefa4ab]: Sch. 2 para. 4(1A)-(1C) inserted (31.1.2022) by The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2022 (S.I. 2022/76), regs. 1(2), 2(2)(b)

[^key-494dd52ba56482beabc25e56147b27ce]: Words in s. 1(5) inserted (17.11.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 90(2), 142(1); S.I. 2025/996, reg. 2(2)(b)

[^key-4974e4683c63a2295b4c8e367be9b4bd]: Sch. 19 para. 384 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-49b5b8891d09db8683757e7b32a72562]: Sch. 19 para. 1 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-49c6c21a8f1c4f4ca1ccfff6d70d38c9]: Sch. 19 para. 184 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-49fe73ca1ed5e09d77a6cff08738e315]: Words in s. 206 Table inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 100(11), 142(1); S.I. 2026/82, reg. 2(s)

[^key-4a5f063f25fb8de879cdc65f385fe055]: Sch. 21 para. 6(3) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(4)(c) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-4a697ea4ae028d646b23790db24f4bf7]: Words in Sch. 3 para. 11 substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(12) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-4a91bcf4f11286ff218d1506b5ffd7bb]: Word in Sch. 11 para. 2(a) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 11 para. 31; S.I. 2026/82, reg. 2(z12)

[^key-4ac91bf85ec11b5b09d2cffc0834e330]: Sch. 11 para. 3 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^key-4acce7a36a65b3dfa88122e1ac018720]: Words in s. 206 Table inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 117(5), 142(1); S.I. 2025/904, reg. 2(r)

[^key-4ade17abe3f68bf256bff4f2dbb59e3d]: Sch. 20 para. 53 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-4b9e6d497580985481a70ac53ffb3760]: Sch. 19 para. 71 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-4bf0023fc0abe3a6fe28e97ae0db6c8a]: Sch. 19 para. 96 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-4c20a14917f2c9b020b67a5f513a0f57]: S. 3(11) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 4(6) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-4c80cd42315c6365ff023e85a763c2e5]: Words in s. 18 heading inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 24(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-4cacf6ad42f2ff6a460cd4fecf587502]: Words in s. 78(2) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 10(5)(b); S.I. 2026/82, reg. 2(z10)

[^key-4cb750ea4557f2baffcc01c9e44b677f]: Sch. 7 para. 50 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-4cdb09090293d26d78397375ceeeef64]: Word in s. 205(1) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 85(2)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-4cf3e7d466f11b7e40ea1d651a44da91]: Sch. 19 para. 277 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-4d0adcfaa451f8df9766cc65dfba95e8]: Words in s. 202(1)(a)(i) inserted (17.11.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 90(7), 142(1); S.I. 2025/996, reg. 2(2)(b)

[^key-4d10128808e45c569543c313b90f3f68]: Words in s. 5(7) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 6(6)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-4d5bceecca89ad72be32168252e30a12]: Sch. 1 para. 18 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-4d6b908812e073f2b90981ecb1756d66]: Words in s. 16(1)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 20(2)(b)(ii) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-4d91ae4f070d013ae3a148fca0b63010]: Sch. 20 para. 47 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-4d956270edecbf7135abf8cbbd045529]: Sch. 19 para. 399 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-4d9aa0606c413206cb1320a83695979d]: Words in s. 110(2)(b) inserted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(9)(b), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

[^key-4dd14d64a5ac75aa8ddd3bd00ead5989]: Sch. 15 para. 9 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-4e053c869dd0d1212f96f10b0bd1f15c]: Words in s. 44(7)(a) inserted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(3)(c), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

[^key-4e053f303d63b7b74a499c4480735616]: Sch. 19 para. 409 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-4e06da20a4ee2b31f0f19b9c470f9b8d]: Words in Sch. 1 para. 2(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 91(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-4ebd65ab97e317d6c230a09c8743e730]: Sch. 19 para. 226 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-4ed31dd55586adedeb9b02282604b867]: Sch. 19 para. 93 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-4ef43de1fd3d22fa65d544c29721ca53]: Sch. 20 para. 54 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-4ef7c38139417e706b6402b58c13c6a1]: Words in s. 75(2) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 6(5); S.I. 2026/82, reg. 2(z10)

[^key-4f3513a26367d91804bfa7f435078e46]: Words in s. 79(7) substituted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(8)(e)(i), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

[^key-4f560578ecfbff00c81b108cc574f95c]: Words in s. 79(7) substituted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(8)(e)(ii), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

[^key-4fabde886f7f8ff4ffdec98db5a5a329]: Sch. 19 para. 317 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-4fdda46f1a69130f122c5704602c094d]: Sch. 19 para. 379 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-4fe4b7529553a13b08d627389944bf71]: Words in s. 125(9) substituted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 11 para. 19(4); S.I. 2025/904, reg. 2(y)

[^key-504da48b89f74e638a6616a94f7d03e2]: Words in Sch. 19 para. 431(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 100(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-50685db8378599c3d063ffd01618c754]: Words in s. 155(2)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 63 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-50b24bd536f09a25fb71ed7410fa8f3b]: Words in s. 76(1)(e) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 7(4)(d); S.I. 2026/82, reg. 2(z10)

[^key-51071121f70681b71cab6d579e3ad89a]: Sch. 19 para. 61 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-5161df839eddc2224f1ac8381d920e73]: Sch. 19 para. 294 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-518f0c230d07941d0b60ba6ea8afffc9]: Words in s. 28(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 36(3)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-51a420e340d7561e52b67143aef34c49]: S. 186(3)(ca) inserted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(10), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

[^key-51e5c70be67119667b759e829b6ec310]: Sch. 19 para. 342 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-51f9e4c401bc3155e422927720dd9738]: Words in Sch. 2 para. 28(3) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 87(2)(c)(ii), 142(1); S.I. 2026/82, reg. 2(o)

[^key-522cc2ffd4fbefd6bc331626b37d8649]: Words in s. 159(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 65 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-523e415bc234f62c893d91846c4c7579]: S. 3(9)(e) and word omitted (20.8.2025) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 11 para. 14(b); S.I. 2025/904, reg. 2(y)

[^key-5277e76770029ad12ef38864a40b6300]: Sch. 20 para. 31 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-5294d6d9aa82b0309648f5ec4d8160db]: Sch. 19 para. 346 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-52ed2b8cb72fb84acd6e2db1c86a4a19]: Words in s. 15(2)(e) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(7)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-53107efacf22ac248514ba40c62a4ee5]: Words in s. 74B(6)(a) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 5(7)(a); S.I. 2026/82, reg. 2(z10)

[^key-5323f01b951ce1dc681a7e41c427fe5a]: Words in s. 83(1) substituted (17.11.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 90(4)(b), 142(1); S.I. 2025/996, reg. 2(2)(b)

[^key-536ca137c3e35cd31b66970c3841bf62]: Sch. 19 para. 392 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-537ddaa4e08f232eeb349cab5d9e3a51]: Sch. 19 para. 91 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-53926fd489411a896de84bf3547618a6]: S. 16(2)(c) and word inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 20(3)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-5408ef8b4fef9b4413225ee38a7c8a5d]: Words in s. 165(7) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 66(5) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-5418e3ab3799af9615274352eba15429]: Words in s. 54(2) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 76(6)(b)(i), 142(1); S.I. 2026/82, reg. 2(h) (with reg. 4)

[^key-541c32cbb194df275a3b189f928f6db1]: Sch. 19 para. 21 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-54284906fe76feffec80867f982781e9]: Words in s. 87(1)(b) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 71(9)(b)(i), 142(1); S.I. 2026/82, reg. 2(d)

[^key-542d243b9191f7169b7009b1177f80e5]: S. 3(9)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 4(3)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-547275c503d1622ed745a1844aa3c05c]: Sch. 19 para. 231 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-54ccbd5063e3754088932793be4ce0f9]: Sch. 19 para. 264 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-54e1cebd08694edba883c6e04419824d]: Words in s. 13(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 16 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-54ed69a52979c0101f95691b880e8d86]: Sch. 19 para. 114 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-551a5acb36329559fb8567a347c30867]: Sch. 10 para. 8 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^key-556c71ac16f94e09c49f45e309bf0afd]: Words in Sch. 16 para. 4(1) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 101(3)(b)(ii), 142(1); S.I. 2026/82, reg. 2(t) (with reg. 6)

[^key-5596802d5ca5ee15d01f2a0e77ed94e9]: Sch. 19 para. 236 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-55d404a9f5a64d1bf721098163e73e8c]: Words in s. 185(4)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 79 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-55f19b5dfeae5274c86b20d257ee5abf]: Sch. 19 para. 324 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-5614b756eac3d8dc2bdaf822684cd82d]: Sch. 3 para. 15 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-562d08cd2dcb5be04009f471b7f9552f]: Sch. 19 para. 200 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-5633966e010ddf6145173a099d2c2156]: Words in s. 79(5) substituted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(8)(d), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

[^key-5652c80df7fd4845a3ee74d7a2a77128]: Sch. 20 para. 58 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-56536b33263227125ad45c4609bbea48]: Sch. 7 para. 33 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-5657721de3c458b0710026de5d0b03c1]: Sch. 7 para. 16 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-568094f95eb275005492dc053906fd96]: Words in Sch. 2 para. 18 substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(17) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-56a85299b8061657d3e11b677b355c71]: Sch. 9 para. 6 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^key-56e9ccbc908fd8c21431b5532b3be0d6]: Words in s. 78(6) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 10(9)(a); S.I. 2026/82, reg. 2(z10)

[^key-56f4c20119cf628e33d225490dc8dd65]: Words in Sch. 21 para. 9(1) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(6)(a)(i) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-5719f4546efdf9f702b40b2a5e775b53]: Sch. 15 para. 16 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-57812c32673391de107302cc043c6950]: Sch. 7 para. 19 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-579c3cd911e92166215a70e270b7943b]: S. 190 in force at 23.7.2018 in so far as not already in force by S.I. 2018/625, reg. 3(g)

[^key-57bc77e64fe7acec0922ea3c97dedc76]: Words in s. 16(1)(a) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 20(2)(b)(i) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-57ceaf6d57e9fed63f3260667888e89b]: Sch. 19 para. 429 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-5800b6be778d654fa3ae9164633a9dee]: Sch. 19 para. 36 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-580c2e8451662cbcb05f7efdbd413557]: Sch. 19 para. 311 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-5829e244b13303dc32dd37fe39fd0076]: Words in Sch. 2 para. 28(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(24)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-589147da4c3b8f7f70ca38a2aad7a017]: Words in s. 78(4) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 45(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-591ce9de9eda44e5f845b9c965e14c54]: S. 48(3)(d) omitted (5.9.2025) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 88(5)(a), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

[^key-5923789b39f2f85486d93c43d008a53e]: Sch. 1 para. 14 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-592385c2bfb47df43a31d621a3e907ca]: Sch. 19 para. 253 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-5936aeb81208d327b09b5d2cf83f1a01]: Words in s. 7(4) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 10(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-59a0badca91ad9baca06c67733e4b029]: Sch. 12 para. 1 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

[^key-59b565f9ed686b63dd17fb78a246be4b]: S. 148 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-59c00d0f4b9012edb2a6a3564ca2644d]: S. 9A and cross-heading inserted (19.6.2025 for specified purposes, 20.8.2025 for specified purposes, 5.2.2026 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), ss. 72(7), 142(1)(2)(h); S.I. 2025/904, reg. 2(b); S.I. 2026/82, reg. 2(e)

[^key-59da614434458460aa757b305cd350e7]: Sch. 1 para. 30 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-5a317a18af189f11ef752bf8e9909bfd]: Words in s. 115 heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 47(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-5a464370d8822b40169ec522a8d773a6]: Words in s. 13(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 16 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-5a993e31296f76eedd2958f4cd0fda2d]: Sch. 20 para. 41 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-5aa83acfda81d5aca3a7d879d20c8168]: Words in s. 206 Table omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 86(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-5ae2292fa42aa74f4748479a28697330]: Sch. 7 para. 40 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-5b0f52439fb91a2150369b4f1d490abd]: S. 77 heading substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 9(2); S.I. 2026/82, reg. 2(z10)

[^key-5b3acd4e0294355b8e9efe356efa7aa4]: Sch. 19 para. 272 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-5bc0406a73661aa1415e2904b278ad74]: Words in s. 10(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 13(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-5c6ae5dec8a8b08bfa71e298026863d0]: S. 67(8) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 39 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-5c6f5e999affc8c51be9d4966b00278f]: Sch. 18 para. 4(3)(a)(ia) inserted (1.12.2020) by Sentencing Act 2020 (c. 17), s. 416(1), Sch. 24 para. 297 (with Sch. 27); S.I. 2020/1236, reg. 2

[^key-5c7d608ae586742eec373d2bcdb6a748]: Words in Sch. 13 para. 1(1)(f) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 97(2)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-5c8795b53f97892d0f380b343427f2af]: Words in Sch. 2 para. 4(1C) substituted (8.3.2024) by The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024 (S.I. 2024/342), regs. 1(2), 2(4)(b)

[^key-5caab894dc42fb6245859f88114c6ccf]: Sch. 19 para. 60 in force at 25.5.2018 in so far as not already in force by S.I. 2018/625, reg. 2(1)(g)

[^key-5cc8c98ed927a29271aa9009a37c3a98]: Words in Sch. 3 para. 7(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(10) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-5cca3ac8ac29e135e7479d669dca2466]: S. 21(5)(c) and word inserted (25.1.2023) by Advanced Research and Invention Agency Act 2022 (c. 4), s. 13(1), Sch. 3 para. 15(2)(b); S.I. 2023/58, reg. 2

[^key-5d060454d3ffbec772dcf30d85306332]: Sch. 19 para. 82 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-5d2229549ab7a2313028e02954440336]: Sch. 20 para. 5 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-5db10dd62a7df7a33ae32851a6f9dec0]: Words in Sch. 5 para. 6(4) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 95(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-5e45ce56358543510889bcd1e8168c6a]: Sch. 19 para. 67 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-5ea99755306c1877268f3c7f8f0acae1]: S. 73(A1) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 3(2); S.I. 2026/82, reg. 2(z10)

[^key-5ebc40ae0ba03aa3d9abb7a5c47c27a0]: Words in Sch. 4 heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 94(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-5f09a0ec7fe4d04e41a74ebc4ea7a57a]: Sch. 19 para. 288 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-5f0fe9220d1a668dafa7cc7eeb298854]: Words in Sch. 1 para. 23(4) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 73, 142(1); S.I. 2026/82, reg. 2(f)

[^key-5f188da75fed9d0a5af86af0820ced84]: Words in s. 168(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 69(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-5f231bc059b057c3be3a8b858c1237d0]: Sch. 19 para. 293 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-5f28dceb83a8870e7b45bbab2176be18]: Sch. 19 para. 254 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-5f4247df5bc97fcbb47d705dd5c5d78d]: Sch. 19 para. 295 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-5f4bbbf26f6f9ab8b15592d2c6938ac4]: Words in s. 166(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 67 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-5f76e0da6463fb498ac656ec87d1f1da]: S. 205(1A) substituted (31.12.2023 immediately before the end of 2023) by The Data Protection (Fundamental Rights and Freedoms) (Amendment) Regulations 2023 (S.I. 2023/1417), regs. 1(2), 3(3)

[^key-5f94619ed391555b8bc542f944bc9f07]: S. 78A(2)(e)(ia) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 19 (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-5fa4e1b4e3138284c1e0c09af0505f2a]: Words in s. 8 substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 11 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-5fb747b583c0fc376438a9ab6fbe24d2]: Sch. 21 inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 102 (with reg. 5, Sch. 3 para. 111(6)) (as amended by S.I. 2020/1586, regs. 1(2), 5(4)); 2020 c. 1, Sch. 5 para. 1(1)

[^key-5fc36683a14c05bd90165c9828617de2]: Sch. 18 para. 6 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-5fdefaa38a586680a2225de272d78a95]: Sch. 19 para. 164 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-60550e37697dee518cebbbb73d3af841]: Words in s. 24(2)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 32(3)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-608496013faabf13fc8e487e17bf3a73]: Words in s. 24(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 32(2)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-608b2f9cf0fe71bd575fc86bce176a4f]: Sch. 19 para. 361 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-60c010d25f11f1914bccbc6d06e219b9]: Sch. 19 para. 359 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-60de89cf3b214460c2075bf102f6e8d5]: Words in s. 74B(3) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 5(4); S.I. 2026/82, reg. 2(z10)

[^key-60e4a152cf94a583f140fc84ff119a86]: Sch. 7 para. 12 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-61187dd7a3e1c1e7fb0580816d8b4c9d]: Sch. 5 para. 5 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-6119956a88aea2b8d3d486d7acad1a04]: Words in s. 26(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 34(2)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-613cb473c0df362a19eb8619512d010f]: S. 84(6A) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 74(6), 142(1); S.I. 2025/904, reg. 2(c)

[^key-61adeb92f11f45e0ec84df45e73f76e0]: Sch. 19 para. 126 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-624b7f167b9be0eda00270c5e40aba6b]: Words in s. 15(4) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(10)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-624e37c2f534f473861144715410cd20]: Words in s. 33(7) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 37 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-6251dd26de77a38b94d1a0a4ca997116]: S. 75(1) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 6(3); S.I. 2026/82, reg. 2(z10)

[^key-6251e3f8b043005c1b3af9c93785fec4]: S. 144 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-6262e574d77f3ed97e165e248a2abadd]: Words in s. 125(1) substituted (19.6.2025 for specified purposes, 20.8.2025 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), ss. 92(3)(b), 142(1)(2)(h); S.I. 2025/904, reg. 2(f)

[^key-6269a01b7e8cea25418c69a3a415f3c2]: Words in Sch. 2 para. 3(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(7)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-62783f17b8f2a7022ee1d43b4a98678e]: Words in s. 53(3) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 6 para. 14(3); S.I. 2026/82, reg. 2(z8) (with reg. 5)

[^key-62971ebca8ba67472f601cf6c756ddc0]: Words in Sch. 1 para. 24(1)(a) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 11 para. 28(6); S.I. 2026/82, reg. 2(z12)

[^key-62bbcd16a8bad5ae9f248e8cf72a3217]: Words in s. 115(8)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 47(9) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-63001065089a95390c38d674f45299f3]: S. 22 and cross-heading omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 30 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-6301e98c2aa45525d7a62b4737ed9b86]: Sch. 15 para. 5 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-63210b57744fbf08d2edb285a0cd5902]: Sch. 19 para. 415 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-63330d56a2e81707f9cd5b177a000af0]: Words in s. 183A(4) substituted (29.1.2026) by The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (S.I. 2026/82), reg. 12(2)

[^key-63477ad6b0f04b0dec5c0e7403800ffa]: Sch. 19 para. 108 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-634f3407a04ae2b50df4bc577770f7b4]: S. 205: power to amend conferred (19.6.2025 for specified purposes, 20.8.2025 in so far as not already in force) by Regulation (EU) 679/2016, Art. 11A(3) (as inserted by Data (Use and Access) Act 2025 (c. 18), ss. 74(1), 142(1)(2)(h); S.I. 2025/904, reg. 2(c))

[^key-63549367591b91b245c18fd99b767a4c]: Sch. 7 para. 9 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-6419b8d564dad36243ede4ccbdddf886]: Sch. 19 para. 301 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-6428f542028b4356211b4b2be7c0f045]: Sch. 19 para. 18 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-642964559e6e98411f41113d5d311b98]: Sch. 16 para. 6 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-64534ca8115b4440f659353e7c70f148]: Sch. 19 para. 391 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-64637fee59d742a478540e692712562e]: Words in s. 115(8)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 47(9) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-64bc08d1985519824ec0dd32abbcec66]: Sch. 12 para. 7 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

[^key-652e061bb56fb9b4f220ffae3d0a3b7c]: Sch. 19 para. 259 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-65343b18ed649b3b52f5b6a00da1caaa]: Words in Sch. 17 para. 4 substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 100(12)(b)(iii), 142(1); S.I. 2026/82, reg. 2(s)

[^key-6545233b44f61feb3cdd2c63700b450b]: Sch. 19 para. 388 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-654ef76458b17b962e7470b23278c518]: Words in s. 24(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 32(4)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-657aa7e5daf80d8036e29c3d486e1c59]: Words in s. 10(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 13(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-65db54d1863afa51736d7484ad25641f]: Words in s. 10(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 13(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-65deab101ecc18b194bb4c26b1270842]: S. 183B inserted (1.1.2024) by Data (Use and Access) Act 2025 (c. 18), ss. 106(3)(7), 142(1); S.I. 2025/904, reg. 2(k)

[^key-65f6cf7df6085a9cdaea6d8c8baf70c3]: Sch. 19 para. 420 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-6632992e282cfa917647cec7d63cfe07]: Sch. 3 para. 8(1)(c)(i)(ia) substituted for Sch. 3 para. 8(1)(c)(i) (30.11.2022) by The Health and Social Care Act (Northern Ireland) 2022 (Consequential Amendments) Order 2022 (S.I. 2022/1174), arts. 1(2), 12(3)(b)

[^key-664583bd72ffa43f978cc1b9b28ad53d]: Sch. 12 para. 5 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

[^key-664f0d0fd099ec05107c1fc9f6ba7bbc]: Words in s. 15(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(9)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-6685d554b3e7ed58b3b529c29432b778]: Sch. 19 para. 128 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-66ab9d1de4957bbacf62b04943c91e47]: Sch. 12 para. 8 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

[^key-66b40fbe2726cd954a7c535fce560656]: Sch. 19 para. 408 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-66d76dad44f0d13ffd99864f3de43a18]: Sch. 18 para. 4(8) inserted (17.12.2021) by The Age of Criminal Responsibility (Scotland) Act 2019 (Consequential Provisions and Modifications) Order 2021 (S.I. 2021/1458), arts. 1(1), 8(b)

[^key-66e980b327ff78ef6a0ce646dae209c8]: Words in s. 165(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 66(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-67033137501744360fc87bf558c6ef23]: S. 80(5)(6)(7) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 46(5) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-6758384614c1ad6fc83cce92f7ba1fb5]: Sch. 19 para. 370 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-676fe1a8b2a4417d85acd7eaa0cb4560]: Words in s. 205(1) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 85(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-6770db32f81e36acabebbe3e140fc8b9]: Sch. 19 para. 15 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-678a3382174b5eef118f049a8e0135a3]: Sch. 19 para. 154 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-67aec105c02309b3dcc27b6e0cf1c250]: Words in s. 74B(6)(a) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 5(7)(c); S.I. 2026/82, reg. 2(z10)

[^key-67c2d07c6b756193ae777321980fbada]: Sch. 5 para. 3 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-67f8177fb9af4ad26bb4c77960155a96]: Sch. 2 para. 21 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-68225e3df25a9f0f2570cf0783246f60]: Words in s. 79(11) substituted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(8)(h), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

[^key-68468e63dc949bef1473171d5c80732e]: Sch. 15 para. 14 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-6888ac65f30f092ac6490e4894483c5f]: Sch. 11 para. 6 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^key-68c26f2b2ec74cc15e867e9b451f50ae]: Words in s. 25(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 33(2)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-68f53a767f04f663ce23ebba7b9a8622]: Words in s. 73(1)(b) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 40(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-690c58c64b417a3b6f1d897287ce2cc0]: Word in s. 157(2)(a) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 64(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-691fa57eec6836b5b51677125f451067]: Words in s. 3(6) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 4(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-692a388eef2538c711e9de2ed9af16bc]: Sch. 19 para. 152 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-69b650c8b8cd0a9f9c00303439bac5ac]: Sch. 19 para. 377 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-69e18d9dd8b0baf912598da89854fe38]: Words in s. 97(4)(b) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 80(5)(b), 142(1); S.I. 2026/82, reg. 2(j) (with reg. 5)

[^key-69f1f4e3df8cba86080a11e581cacbc7]: Sch. 1 para. 32 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-69f9a7a9d26266ca1b42b20f77139add]: Sch. 7 para. 36 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-69fb4ce7e6a859ec749bbbf85915a53f]: Sch. 20 para. 29 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-6a4270838a15ea82cab691dc84af38d8]: Sch. 19 para. 348 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-6abc13cd18a213064aef213a2eae3a9e]: Words in Sch. 2 Pt. 5 heading omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(20) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-6b3dd5366b8aa656104793ad8fbda6d1]: Sch. 19 para. 178 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-6b42cc6bc33aa71da55b1f1394b715ff]: Sch. 20 para. 33 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-6b4626506e6293d1de08b9da8fc15ff8]: Words in s. 12(1)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 15 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-6b73746ba6f7dc8aef1c83cf22349b69]: Sch. 7 para. 31 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-6b973a6a6c7ca62745d334f519a01218]: Sch. 7 para. 55 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-6ba7f5fc21c3deb0d65124e3508f832f]: Act applied (18.3.2022) by The Cumbria (Structural Changes) Order 2022 (S.I. 2022/331), arts. 1(1), 18(2)(e)

[^key-6c11b02f4cf2412155ba5dd487de5f5d]: Sch. 19 para. 271 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-6c12a28a9f47155604b92c5ded987ee4]: Sch. 2 para. 26(9)(e) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(21)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-6c1f6bae1d802c23f773298531014961]: S. 17B omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 13 (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-6c3e1b90198089fd750919397b5d5f31]: Words in Sch. 2 para. 25(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(19)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-6c97145e9bea286f39b3cebee1e809b4]: Sch. 19 para. 138 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-6d2b09b7c66ecf1a2e1d1430a2abf217]: Sch. 19 para. 158 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-6d40880f4046ed50e5f12cfbeea87fa1]: S. 204(2)(a) substituted (2.12.2019 at 00:01) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 227(3) (with ss. 117, 209, 210); S.I. 2019/1434, reg. 2(b)

[^key-6d4f96ed12c59e68bdff321d38d2d21f]: Sch. 19 para. 90 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-6d54424c74ebcfa6482c38a597b6f8cd]: Sch. 19 para. 417 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-6db365e85b52911a728021f65ea4c98a]: Sch. 11 para. 1 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^key-6dde167af2d730a8ec63a8abbf4d8720]: Word in s. 78(1) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 10(3)(b); S.I. 2026/82, reg. 2(z10)

[^key-6e07ab4cb80ed81cfca1cbdc5f2f54bb]: Ss. 164A, 164B inserted (19.6.2025 for specified purposes) by Data (Use and Access) Act 2025 (c. 18), ss. 103(2), 142(1)(2)(h)

[^key-6e7cb2f6dc84974e7ac6a5e8816900a0]: Words in s. 167(4) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 68 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-6e84b69220cb50f38474940853f5034b]: Words in Sch. 3 para. 12(1)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(14) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-6edafa118087c70ee53b6f5cf47d4bbf]: Sch. 20 para. 51 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-6f0ff6b46e942e25d0e08ed709fd7174]: Words in Sch. 2 para. 12 omitted (31.12.2020) by virtue of The Consumer Protection (Enforcement) (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/203), regs. 1, 5(b); 2020 c. 1, Sch. 5 para. 1(1)

[^key-6f4e482e390982774ce679e4f28783da]: Words in s. 187(1)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 81(4)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-6fa02887b56cbb4386bbc62d8c2621c4]: Words in s. 117 inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 49(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-6fe4bc9b35fbbeee514f5574560f3e08]: Sch. 19 para. 203 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-6ff2d0b34df3416330022d509ad57eb3]: Sch. 19 para. 338 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-700cdd34340327bf52d7691ef5189d8f]: Sch. 19 para. 22 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-701d5cfc0f481357e74022e7c52c18c0]: S. 186 heading substituted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 106(4)(a), 142(1); S.I. 2025/904, reg. 2(k)

[^key-703e2e342cfcb4603846990fa8e2b775]: Sch. 15 para. 7 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-707883b75ea25f6b0172d7b5ee3087c2]: Sch. 19 para. 414 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-70a01922df5cc62d22d2f08b0cbb9ff1]: Words in s. 210(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 89 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-70a8bfc934b51491b5e05c60a48c0fcd]: Sch. 19 para. 124 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-710228ff8d8794d510393ca565e31582]: Sch. 1 para. 8 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-712146671e659734df04e3c276c8a6ec]: Sch. 19 para. 175 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-714ef724e239da840290e187126b6550]: Sch. 2 para. 4(1B) omitted (8.3.2024) by virtue of The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024 (S.I. 2024/342), regs. 1(2), 2(3)

[^key-71991999d3f30393eac1b24ed8828c51]: Sch. 15 para. 12 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-71dea759dbffeefab580aeb644dc5c34]: Words in s. 187(1)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 81(3)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-71f3222fd4b877a586e08d163019b411]: Words in s. 79(4) substituted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(8)(c), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

[^key-7285958890d3383878df626a9c90418f]: Sch. 19 para. 291 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-729c091eec1d54911a073b69bce236e3]: Word in s. 170(2)(a) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 11 para. 22; S.I. 2026/82, reg. 2(z12)

[^key-72ba0767b30e3e4aaa628d751ad94496]: S. 114A and cross-heading inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 117(2), 142(1); S.I. 2025/904, reg. 2(r)

[^key-72cb372c18446331d54d7581b2844122]: Sch. 19 para. 283 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-72d1e7bc8a1a8cdb24823c5c186808fa]: Sch. 19 para. 364 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-72fc14e4074bc221cce83073cc6b4954]: Words in Sch. 2 para. 10(2)(c)(iv) inserted (E.W.) (23.7.2019) by Public Services Ombudsman (Wales) Act 2019 (anaw 3), s. 77(1), Sch. 5 para. 28; S.I. 2019/1096, reg. 2

[^key-72fccd4d6ebac9d3e017e3797b580ef5]: S. 14 omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 6 para. 11; S.I. 2026/82, reg. 2(z8) (with reg. 5)

[^key-730bc1c474fbdbd93f519027acff36fe]: S. 146 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-737325028727ba2041f2f0de7660090b]: S. 205(2)(la) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 117(4)(b), 142(1); S.I. 2025/904, reg. 2(r)

[^key-73798ad4ecbb7ae34845e132f9a11398]: Words in s. 52(6) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 6 para. 13(6); S.I. 2026/82, reg. 2(z8) (with reg. 5)

[^key-73831303993667d8f859b9488103ac73]: Words in s. 151(8)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 62 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-7391cf8e2ee42e601b02ca8e23000688]: Words in s. 168 heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 69(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-739c1f855803d04d32431eb1509216b9]: Words in s. 76(1)(d) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 7(4)(c); S.I. 2026/82, reg. 2(z10)

[^key-73a5bdb2a7cc14d028614db4749623ee]: Words in s. 204(1)(g) omitted (2.12.2019 at 00:01) by virtue of Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 227(2)(b) (with ss. 117, 209, 210); S.I. 2019/1434, reg. 2(b)

[^key-73e6fdaac8c2a2ceb6b3e1ac469fcfb7]: Sch. 19 para. 245 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-73f61be4aeced86ac6a16de662af58f7]: Words in Sch. 21 para. 4(1) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(3)(a) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-742f3892a7615fbe038b411efd2afeab]: Sch. 10 para. 2 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^key-7439244a501d4ccda7b7ab1b68d56133]: Words in s. 143(9) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 60 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-74428c9d29b310b26608d6b4d093fa12]: S. 160(5A) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 100(6)(b), 142(1); S.I. 2026/82, reg. 2(s)

[^key-7477a257b589b1a659d9da8bb1f814ee]: Sch. 19 para. 260 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-748f9db9dd425e0dbebe2451c4618aa0]: Words in s. 189(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 83(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-74ae32c1534b7fb225df9f0b0a326da8]: S. 102 in force at 16.9.2019 by S.I. 2019/1188, reg. 2(b)

[^key-75281d50b8538d7c6f962df982798322]: Word in s. 120(1)(b) omitted (31.12.2023 immediately before the end of 2023) by virtue of The Data Protection (Fundamental Rights and Freedoms) (Amendment) Regulations 2023 (S.I. 2023/1417), regs. 1(2), 3(2)

[^key-752abb171027a20f86431c530a4f4ac7]: Words in s. 209(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 88 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-753f1687fbeaa53726164aa1e83b0e09]: Sch. 14 para. 7 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

[^key-75438dcd3d6caeec4575bd25fb3b15df]: Words in Sch. 2 para. 2(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(6)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-759e72068bf5cf175f5d6b8e09afd019]: Sch. 19 para. 62 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-75e47e526bd371fad97da14f5ce0b720]: Sch. 19 para. 426 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-75e7207d12d4887e8870cd0d8b680f5b]: S. 17C omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 14 (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-75fa556cead4d7860cebbae93d9ce5ea]: Sch. 20 para. 43 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-764b5a189b5ddc8f21ff15d3aadd46f8]: Words in s. 7(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 10(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-76c627fd558f2827e55ea322c5601a0c]: Words in Sch. 17 para. 4 substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 100(12)(b)(ii), 142(1); S.I. 2026/82, reg. 2(s)

[^key-76d8987f83cd23085268f88605eab012]: Sch. 2 para. 8 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-770e5734455a727a1728da1020faca17]: Words in s. 76(2) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 7(5); S.I. 2026/82, reg. 2(z10)

[^key-7716f17e15cfe1f6e1c380c980402f84]: Words in s. 16(1)(c) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 20(2)(d) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-774f89899f61e3fd5faa9f3af3ea0924]: Words in Sch. 3 para. 1 substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(4) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-7790bea0d0dc4a0926d24673942c24b3]: Words in s. 15(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-77ee27866c6c95ed5687861f463894f2]: Sch. 19 para. 366 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-782907df884cc218df28335e04f9b6bc]: Sch. 7 para. 4 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-783664aa6922d312a1494de208ee446e]: Sch. 19 para. 57 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-78821949ef2cd79dbfb3b1bc8aedb9e2]: Sch. 19 para. 17 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-789b1fb0bff945a128559c3def13e851]: Words in s. 186A(5) substituted (29.1.2026) by The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (S.I. 2026/82), reg. 12(4)

[^key-78db76102146a4973fbe100f48e3ab2d]: Sch. 19 para. 422 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-79af9794db26153d08755ea59021b7f1]: Words in s. 183B(5)(b) substituted (29.1.2026) by The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (S.I. 2026/82), reg. 12(3)

[^key-79e7068c8e4cd6fd22e23d24f813e766]: Words in s. 6(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 9 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-79ecfa480be800660f1c1ae8309a399e]: Words in s. 43(1)(a) substituted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 79(2)(a), 142(1); S.I. 2025/996, reg. 2(1)(a) (with reg. 3)

[^key-7a5a1fef2d738d7c657db0fb599f1871]: Sch. 10 para. 1 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^key-7a8fc913f5df2ae9c65b684b305d36db]: Sch. 2 para. 22 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-7aac6a775a9db704483930b3b42f67b9]: Words in Sch. 2 para. 26(9)(c) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(21)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-7acebc72466e110599be1c7c05f2d8a7]: Words in s. 5(7) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 6(6)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-7b08ad8bb36134d0d4900f86e600578c]: Sch. 21 para. 4(6) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(3)(c) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-7b259fddaf883dcc4820053ea22fcd9b]: Word in s. 3(9)(c) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 11 para. 14(a); S.I. 2025/904, reg. 2(y)

[^key-7b42535826b9e64165b9e42d1465e55e]: Words in s. 149(9)(b) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 100(3)(b), 142(1); S.I. 2026/82, reg. 2(s)

[^key-7b7a7abcbe377f85ee79df3619288d0c]: Sch. 12 para. 3 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

[^key-7bccbbbdba88ddb2e2eba7451840f2a4]: Sch. 19 para. 386 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-7bf18aacb7021b4679ff9e76c5cec185]: Words in s. 15(2)(f) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(8)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-7bf8d12b13a9cff5b5baf9f27218e5d6]: Words in s. 188(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 82 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-7c26211f16d823ce5f8c9572b2d5bcfa]: Word in s. 125 heading substituted (19.6.2025 for specified purposes, 20.8.2025 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), ss. 92(3)(a), 142(1)(2)(h); S.I. 2025/904, reg. 2(f)

[^key-7c6e6bf1f7eda1d129edeabdb0d2866a]: Sch. 19 para. 316 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-7c87c5571d73717e0f69793bd63591ac]: Sch. 19 para. 81 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-7ccfab7aba2fe39c0b4ff439f2977e25]: Sch. 2 para. 24 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-7ce231d6f630571ef964323847674614]: Words in s. 15(4) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(10)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-7d0051e33f3cb632344762d050370d86]: Sch. 2 para. 4(4) omitted (31.1.2022) by virtue of The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2022 (S.I. 2022/76), regs. 1(2), 2(2)(d)

[^key-7d89094841f817acd1c11f3f6eb706bd]: Sch. 19 para. 107 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-7d8b698fae1da1e113089210b4918385]: Words in s. 28(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 36(3)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-7d8bb035bbc8f61fa799d1e1688f3235]: Sch. 19 para. 255 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-7d8cce3dcb21f22fda7befab54189f3b]: Sch. 19 para. 309 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-7d998ffaf214abab0fddc3208d040196]: Words in s. 149(2)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 61 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-7dd7220b049ee579447ab74a0155c8a7]: Words in Sch. 1 para. 41 substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 91(5) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-7e1a7fbb2a9c83863114daca737a02ce]: Sch. 19 para. 133 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-7e5af03968fdea50821c2a9e04d4cb7f]: Sch. 18 para. 2 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-7e5daf372d0ee7c8c9274a054f9d68a4]: Sch. 19 para. 229 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-7e8a96925239e5ff10b4c1f795f37f75]: Words in s. 5(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 6(2)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-7edbfe20fdfb17c08b5476ec862c2702]: Sch. 14 para. 8 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

[^key-7ef94efaaff0ee10936b4c95ef7a9bcb]: Words in s. 15(2)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(4)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-7efaa3da5db557e39ab7614ad5231e36]: Words in s. 149(2)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 61 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-7f00e74cd3a9eb7a899739fc11c8d773]: Words in Sch. 20 para. 50 substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 101(5) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-7f0faad6aea3cdd25a004443eaac8e79]: S. 54(4)-(6) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 76(6)(d), 142(1); S.I. 2026/82, reg. 2(h) (with reg. 4)

[^key-7f421b709d4b29a3c22625c805399f04]: Words in s. 79(12) substituted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(8)(i), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

[^key-7f611cef7c9785e78160c449fcd3cf59]: Sch. 19 para. 166 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-7fb49ddb4c78e0617a283d46b8fd297a]: Sch. 19 para. 360 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-7fcae51576d2c15f60236eee6cb91fa1]: Sch. 7 para. 23 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-7fd06888fb048ef993ef93ef456b6b5a]: Sch. 19 para. 186 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-8073dd715b8ba844756ab6ffb34393c2]: Words in s. 207(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 87(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-809083dbfb858646f59b715b5eb1406c]: S. 20 omitted (20.8.2025) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 11 para. 15; S.I. 2025/904, reg. 2(y)

[^key-80aece53fcb0b6da0c128b207cec4326]: Sch. 19 para. 51 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-811106a76f9598073e3be0f7aee49e14]: Sch. 17 para. 3A and cross-heading inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 100(12)(a), 142(1); S.I. 2026/82, reg. 2(s)

[^key-81281ac0c84a46bf1301b64aa0388e21]: S. 9 omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 12 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-812f736d922e3056b472b473c1393f22]: Sch. 3 para. 16 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-813ee7d39f52ef91dc62338317d85979]: S. 207(1A) inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 87(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-814a1f152d26e451009dbffda902ef68]: Sch. 20 para. 44 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-814a6ce67a6a96c8ae4c9adc8a3d0941]: Sch. 19 para. 242 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-8168051fc970431e296c2ac4b1ff2bab]: Words in Sch. 2 para. 13 substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(12) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-816d2aa6bc1c3851c4bfbfc17229dd0e]: Words in s. 26(2)(d) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 34(3)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-81deaf853b1516dd630825a728ac8038]: Sch. 1 para. 25 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-81f2c5858b72110814b0b26f826ff5fe]: Word in Sch. 1 para. 10 heading substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 11 para. 28(2); S.I. 2026/82, reg. 2(z12)

[^key-820044391a685be40d41c5c8cf8e22e4]: Ss. 148A-148C and cross-heading inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 100(2), 142(1); S.I. 2026/82, reg. 2(s)

[^key-822383846c852126639e302c4f8d3d5e]: Words in s. 3(10) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 4(4)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-82414ea480fe391b01b01fb4e26587de]: S. 79(13) omitted (5.9.2025) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 88(8)(j), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

[^key-8293f14cb956099346b10c81f37389f6]: Sch. 19 para. 206 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-82b2319cae98bf9d18d415b5900b1b8d]: Sch. 19 para. 83 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-82e6d6ee170d0749ef39b3a4e333d6d6]: Sch. 19 para. 235 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-83076b9bd062b17b55b3f3900b7b16ca]: Words in Sch. 16 para. 4(2) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 101(3)(c), 142(1); S.I. 2026/82, reg. 2(t) (with reg. 6)

[^key-83378423b48f16d54ba90d2ae9044d24]: Sch. 19 para. 129 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-835ab8f4363d0fb83f0c4cf209c3a562]: Words in s. 17(7) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 22(5)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-8378189986c623d4592091758ed051d5]: Sch. 19 para. 362 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-837eca93d325a90e6a14ec91f892ebda]: Sch. 8 para. 8(1)(b)(iia) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 11 para. 30; S.I. 2026/82, reg. 2(z12)

[^key-83a763dd81dbb8571ef5ab019fcdb125]: Sch. 10 para. 3 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^key-83b36e0f8528921cbbf895c351bf7713]: S. 115(1) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 47(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-83b4b960f436c0a11f244dc3d71d2274]: Sch. 20 para. 60 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-83cd0e4be4bc9319fbb76e9a6ba71e9c]: S. 51(4)(aa) inserted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 79(7)(c), 142(1); S.I. 2025/996, reg. 2(1)(a) (with reg. 3)

[^key-83da7441fd879e24ad1e9bf9355724bc]: Sch. 19 para. 189 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-83e672a87c0d79e60c67f56b75e7939b]: Words in s. 43(1)(d) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 6 para. 12; S.I. 2026/82, reg. 2(z8) (with reg. 5)

[^key-83e7b4be5485db05a2217193e409052e]: Words in s. 15(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(9)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-847feaddc6148bc37c46c1a3e5b8905c]: Words in s. 17(1)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 22(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-8497f1214ba7ccd2b9dc5d3d6fe6bba4]: Word in s. 51(6) inserted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 79(7)(d), 142(1); S.I. 2025/996, reg. 2(1)(a) (with reg. 3)

[^key-84eda6b71dbe3fa5e5686e74405328d3]: Words in s. 129(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 54 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-85309b04599203eba01a0b910cc8317f]: Words in s. 182(7) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 22(4) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-853556fb17545841a06d58d5f0af9994]: S. 139(1A)(1B) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 91(4), 142(1) (with s. 91(5)); S.I. 2025/904, reg. 2(e)

[^key-8536ab473caeb847327e2f5e6d40132d]: Sch. 20 para. 49 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-85568ff5ac8fb1d7859fa5d6150a01c8]: Sch. 19 para. 327 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-8564aee4975abbac8de52f238041a422]: Words in s. 3(14)(c) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 4(7)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-85d06a39ca0878ef9dbbbb42d71fbd78]: Sch. 10 para. 9 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^key-85e1aaebfff1e99eeab9dc20a359c058]: Words in s. 205(1) inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 85(2)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-8665babc9bd153c4dbd66185ba2f8336]: Sch. 19 para. 372 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-86a457172ca3a7770aff39e9c0ad8ecb]: Words in s. 206 Table substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 86(5) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-86afa8b38318d38d9a1c0a277db14ba1]: Sch. 19 para. 247 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-86c0f2e4ef516da39d4241866b656e32]: Sch. 19 para. 65 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-86ea667053fa639fd3f9de2728af1019]: Words in Sch. 17 para. 4 substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 100(12)(b)(i), 142(1); S.I. 2026/82, reg. 2(s)

[^key-8737925ef099c354b79a2dee4ef45379]: Sch. 19 para. 144 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-873a9a81f73c6a07542ec3514b86b3e0]: Words in s. 43(1)(b) substituted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 79(2)(b), 142(1); S.I. 2025/996, reg. 2(1)(a) (with reg. 3)

[^key-87644839deaefcefaa5289d143de43b3]: Words in Sch. 3 substituted (1.7.2022) by Health and Care Act 2022 (c. 31), s. 186(6), Sch. 1 para. 1(1)(2); S.I. 2022/734, reg. 2(a), Sch. (with regs. 13, 29, 30)

[^key-88136afa0ef1df300a43059fe5b24e85]: Sch. 14 para. 6 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

[^key-882fa25ed9d1559430a3c58aa7cf5fb7]: Words in s. 96(1) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 80(4)(a), 142(1); S.I. 2026/82, reg. 2(j) (with reg. 5)

[^key-88604e36ed44217ed8948f4855ef1e2a]: Words in Sch. 1 para. 4(b) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 87(2)(b), 142(1); S.I. 2026/82, reg. 2(o)

[^key-888b5b35cd29f20bcaae1dbca8f16d61]: Words in s. 28 heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 36(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-88a3135321752bf6d4a55db7f2e0cf2f]: Sch. 19 para. 352 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-88c6eca9edbc9735a9c60756508aaa04]: Sch. 16 para. 9 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-88ce0d1dbc7fe3a0c4496cb8423c1963]: Sch. 8 para. 3 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-89ae400598f2d597e634bb358b6bd862]: Sch. 19 para. 53 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-8a054058020c4298c356c8dab6602b0b]: Words in Sch. 2 para. 11 table omitted (31.12.2020) by virtue of The Consumer Protection (Enforcement) (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/203), regs. 1, 5(a); 2020 c. 1, Sch. 5 para. 1(1)

[^key-8a06802189467de7bfd2c3bce4fa1840]: S. 205(4)(5) inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 85(7) (with reg. 5) (as amended by S.I. 2020/1586, regs. 1(2), 5(2)); 2020 c. 1, Sch. 5 para. 1(1)

[^key-8a3b5bb5e99ea65efdafbe742d8645aa]: Words in s. 4(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 5(2)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-8aa8998b53e72cee3848ea89a3f8efcf]: Sch. 20 para. 27 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-8ad456033e37cf5339189b447f441ea7]: Sch. 19 para. 238 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-8b31548a22fdf2062e26812b3f8a4cd8]: Sch. 19 para. 261 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-8b51cd157e46935889ef5f9158b92e3a]: Words in s. 6 cross-heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 8 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-8bd408574505811db2c82cae1b36a826]: Sch. 19 para. 198 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-8bdf2f9115303fb799f509ce612d36e1]: Sch. 7 para. 48 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-8be42a9b4ca72b465ef3e53b07fce39f]: Sch. 19 para. 343 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-8c1041f35a0b088d2c6574d402bd386c]: Ss. 50A-50D substituted for ss. 49, 50 (19.6.2025 for specified purposes, 5.2.2026 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), ss. 80(3), 142(1)(2)(h); S.I. 2026/82, reg. 2(j) (with reg. 5)

[^key-8c2497c1133310d316d82accef38e97a]: Words in s. 3(14)(d) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 4(7)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-8c3774348306ed27397be307974b45b9]: Sch. 7 para. 25 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-8c5ff1d9f832e281549b01d69284832a]: Words in Sch. 20 para. 18(6)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 101(4)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-8cf9d6a275e743f533eb559dab94edde]: Words in s. 24(5) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 32(5)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-8cff94f874bcf79b507759af01a7f312]: S. 126 in force at 23.7.2018 for specified purposes by S.I. 2018/625, reg. 3(c)

[^key-8d0a6b8a209b4ce122af409aeeba27bd]: S. 15 cross-heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 18 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-8d58a5c874287d0bdc585648c49f5321]: S. 51(2)(aa) inserted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 79(7)(b), 142(1); S.I. 2025/996, reg. 2(1)(a) (with reg. 3)

[^key-8d7025c26d4306ebf37846aafc6ac184]: Words in s. 76(1)(c) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 7(4)(b)(ii); S.I. 2026/82, reg. 2(z10)

[^key-8d9d7cdf97e575d2a5c03f8e3c76a63d]: Sch. 15 para. 10 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-8ddd7db9cbd1f85a5d9da877704c4c39]: Words in s. 168(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 69(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-8dedc7ecc2ab08385cf725c2325091ce]: Word in Sch. 2 para. 2(1)(a) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 11 para. 29(2); S.I. 2026/82, reg. 2(z12)

[^key-8deea6ad2e1ca2aa03a2df3af2489d28]: Sch. 20 para. 6 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-8e33d9698917e5f35b620ce7b474ccc1]: Words in s. 149(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 61 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-8e7dfedb656f3087cc752ddd2b3b4127]: Sch. 1 para. 5 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-8eacd628fdb59503091436d5cc4e3698]: Sch. 19 para. 380 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-8eea3e6bdf7c7820f434b8c876de250f]: Words in s. 80(2) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 46(3)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-8efaf1436cbf85d5d8e08d9cba2a529d]: Word in s. 184(4) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 11 para. 25; S.I. 2026/82, reg. 2(z12)

[^key-8f06068680301e2c3ed98acf8976fc95]: Sch. 19 para. 167 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-8f1f87eac9c9e51e89136342ce6694ad]: Sch. 19 para. 94 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-8f48b1c7ac191d68b6f2c80fbc631de8]: S. 160(7)(e) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 101(4), 142(1); S.I. 2026/82, reg. 2(t) (with reg. 6)

[^key-8f7fd51f2b17bc66f5766dfce21ff80d]: Words in s. 76(1)(c) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 43 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-8fbe292ba1de6fbf2a9d7d97a4bad919]: Sch. 7 para. 29 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-8fee20a32a0c94dd1be0c59c92f7d22d]: Sch. 19 para. 28 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-9006f6f60d2f3cd5a380a45e92c3daf0]: Words in s. 77(7)(a) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 9(4); S.I. 2026/82, reg. 2(z10)

[^key-905f3924a8759d0b5e86546e2ec79c8f]: Words in Sch. 18 para. 5(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 99(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-908fd5d459d7a579cab7061f3e5f0f93]: S. 5(4)(5)(6) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 6(5) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-90adc6d9082b6906eaaeb77d1ce53b7f]: Sch. 19 para. 142 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-90bc58b2418f34aa3e7689fce7c114d7]: Words in Sch. 2 para. 6 cross-heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(10) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-90e3bcc87d1d97af47cc5209d5ca6b8e]: Words in s. 24(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 32(4)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-9135d5f0ba7a938b8e0908d3b822308e]: Sch. 20 para. 22 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-9190e828ff0d3346d5cf7c2bd7d0f1c2]: S. 3(8A) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 117(3), 142(1); S.I. 2025/904, reg. 2(r)

[^key-9191ac97c4be79c02fb2a00b6516f9c4]: Sch. 19 para. 356 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-91c2b0d1083a5749e792bb8cc09b84fd]: Words in Sch. 3 para. 12 cross-heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(13) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-91f7b5de6c9148c918065d61457bce4a]: Sch. 19 para. 418 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-920dd296746894521060038ea62d1636]: S. 73(4)(aa) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 3(5)(a); S.I. 2026/82, reg. 2(z10)

[^key-92602c48b03bd64557bffe924a7a3393]: Sch. 7 para. 39 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-926294555a21e585ef6c49d64cb54163]: Words in s. 24(5) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 32(5)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-92a1d6beec195a72e4c0ded237db7052]: Sch. 19 para. 322 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-92a2fbba444a2180ed2d6977278c2304]: Sch. 20 para. 12 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-92a89703ae0bccb19e3aa6357a2199fe]: Words in s. 52(1) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 6 para. 13(2); S.I. 2026/82, reg. 2(z8) (with reg. 5)

[^key-92d6e74f37be3e97e68bdee8fdc6cda3]: Sch. 19 para. 319 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-92e4fbc7da5832de351cee8561572d00]: S. 160(4)(aa)(ab) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 98(5), 142(1); S.I. 2026/82, reg. 2(q)

[^key-9327a9e51950d697f6ab1419608e7b34]: Sch. 19 para. 351 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-932fb2eb6cef1d6174f128001bbe0202]: S. 140 cross-heading inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 95, 142(1); S.I. 2025/904, reg. 2(h)

[^key-9415718b0fd9928accda1024defbb8f1]: Sch. 19 para. 246 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-946d65c9a908a33d2a45bde886433013]: Words in Sch. 5 para. 1(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 95(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-948150c615699b482cbd70f81369f052]: S. 204(1)(l) inserted (13.12.2024) by The Anaesthesia Associates and Physician Associates Order 2024 (S.I. 2024/374), art. 1(3), Sch. 5 para. 7

[^key-9494a2ed2dae96290f9c0461356a1bd3]: Words in s. 149(2)(c) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 61 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-94d96ee0fcb3bd0d69d2d1921830ed5c]: Words in s. 110(2)(c) inserted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(9)(c), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

[^key-94dd0e117ae91630c416e9e8439ee602]: Words in Sch. 1 para. 1(3) substituted (15.12.2021) by The UK Statistics (Amendment etc.) (EU Exit) Regulations 2021 (S.I. 2021/1300), regs. 1, 2

[^key-9511ece09469c0730d75ca0d615a38e3]: S. 78(A1) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 10(2); S.I. 2026/82, reg. 2(z10)

[^key-953b9df49e10ea57d7c67ec16df9d1c0]: Act excluded (30.9.2020) by The Channel Tunnel (Arrangements with the Kingdom of the Netherlands) Order 2020 (S.I. 2020/916), arts. 1(2)(b)4(4)

[^key-9554afd386ff1a76b263966b60fc1907]: Sch. 19 para. 132 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-956ddefbb071412616ffde4240a5ba73]: S. 119A inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 51 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-95787e0b7f0ab5b7c704ec6bec9bc401]: Words in s. 149(4)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 61 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-95ee23ccfabc5e4a2c7fa00670a15fe8]: Sch. 20 para. 8 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-9667d028d4f7acb47a263b481d8f79bc]: Words in s. 206 Table omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 86(4) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-969f5ea1c155862f9d516708188b069a]: Words in Sch. 3 para. 21 cross-heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(20) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-9702e78daee1441e8db8fb0bd641a1d1]: S. 145 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-973b20ca86f76226ec3ba9a60c4213af]: S. 193 in force at 23.7.2018 by S.I. 2018/625, reg. 3(j)

[^key-9752e1069ab46baa7cce26833ac60d44]: Sch. 19 para. 117 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-979aacc7d31ac8899ef8e697205ff797]: Sch. 19 para. 382 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-97e067252fcbf8e5342f0f777a6e4426]: Words in Sch. 18 para. 4(6)(a) substituted (1.4.2025) by The Disclosure (Scotland) Act 2020 (Consequential Provisions and Modifications) Order 2025 (S.I. 2025/423), art. 2(1), Sch. 2 para. 3(3)

[^key-9807634b4b75f4054b7300d638b00f9f]: Sch. 19 para. 323 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-98420a05a42f64a95594aefa455c12e3]: Words in Sch. 2 para. 20(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(18) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-984b46e4d04043311d1864dca246bc02]: Sch. 19 para. 150 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-98672c153973b4c37fe47a5be90b157b]: Sch. 20 para. 11 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-9898e0a5f30638665e4860f70c0daca0]: Sch. 16 para. 1 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-989b498271c18a95f66ed51054086cd6]: S. 191 in force at 23.7.2018 in so far as not already in force by S.I. 2018/625, reg. 3(h)

[^key-98f916de1fd0822bc276904898d720c5]: Sch. 19 para. 312 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-98fa005db175e358483a9c7e427babf0]: Sch. 19 para. 29 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-99764e13e67fc0e364b2a29b26e35863]: S. 18 omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 15 (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-99e7d7d61a4298a0bc3dcc630b5b9294]: Words in s. 77(6) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 9(3); S.I. 2026/82, reg. 2(z10)

[^key-99eac3f5edb1f7ed59bf7b3f0c18b9cb]: Words in Sch. 21 para. 10 heading substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(7) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-9a01dffe8e031e6fd2dba2087a13223d]: Words in Sch. 18 para. 5(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 99(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-9a443c5bd0f1d495d7eb959fe3c7dfdd]: Sch. 1 para. 38 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-9a5a534af2e44027b701cbb835af1113]: S. 108 in force at 16.9.2019 by S.I. 2019/1188, reg. 2(f)

[^key-9a7c2d42c9b42f2c440d1a7e097379dc]: Sch. 19 para. 5 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-9a7f415b585bcfbceb5337eb67913880]: Sch. 19 para. 354 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-9a8be2cf53d7c39ed62f2d07d32d1c20]: Words in s. 1(4) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 2(4) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-9a96e2a08106565ada79467503826cb4]: Sch. 19 para. 7 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-9a9736041c34fdc367335955850c35ae]: Words in s. 159(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 65 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-9ab84fd20d8959180ad4f38e2b805461]: Sch. 19 para. 25 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-9ac63ff5136041fd04722844c4c6f7c9]: Sch. 7 para. 45 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-9acb6d4351d4656b387adbd902b93e6e]: Sch. 19 para. 39 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-9b02a9bec8375c167bc31a5bc6416f2e]: Sch. 20 para. 9 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-9b05bb1b29d1ffb55d5c9c114578c937]: Sch. 7 para. 15 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-9b2171fdeed0aa91e80e081837891a4d]: Sch. 1 para. 33 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-9b4888918161ced5908cf5b16e33b46f]: Sch. 11 para. 11 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^key-9b5992e47d071cdf4bc62d00218e439f]: Sch. 19 para. 193 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-9b9087b9158da4ffd811465a30b1f973]: Sch. 19 para. 146 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-9ba92cb088fb455028dbeb88fcb5edb6]: Words in s. 119A(11) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 11 para. 17; S.I. 2025/904, reg. 2(y)

[^key-9bc333ae2f3f8bcbd3a38bc3a810fb5a]: Sch. 15 para. 3 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-9bc5785e330c32abd43dccc500d5dda8]: Sch. 21 para. 7 omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(5) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-9c101e97812e71a335520eb1c47a6ec6]: Sch. 2 para. 23 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-9cb040d62e9f275b1ff61ca32bcd6148]: Sch. 12A inserted (19.6.2025 for specified purposes, 20.8.2025 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), s. 142(1)(2)(h), Sch. 14 para. 1 (with Sch. 14 paras. 2, 3); S.I. 2025/904, reg. 2(z) (with reg. 1(3))

[^key-9cd6eafc08f53ed26f3cab27f3bd17ed]: Words in s. 17(8) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 22(6)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-9ce1c997de01c079f4e45fdcfb0339c3]: Words in s. 151(1)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 62 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-9ce829069ec9d3018f75efc1d11eddd0]: Words in s. 135(1) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 94(2)(b), 142(1); S.I. 2026/82, reg. 2(p)

[^key-9d710e651e6d63fff04c93e4807f2c24]: Sch. 19 para. 100 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-9dc954c44dc2f1d5fb977d7d90900abc]: Word in s. 44 heading omitted (5.9.2025) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 79(4), 142(1); S.I. 2025/996, reg. 2(1)(a) (with reg. 3)

[^key-9dd7994c42a80efb90cbfa1a45252e1d]: Sch. 12 para. 2 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

[^key-9def3b7505a61a658140ff7ee34bf178]: Sch. 19 para. 49 omitted (21.7.2019) by virtue of The Financial Services and Markets Act 2000 (Prospectus) Regulations 2019 (S.I. 2019/1043), regs. 1(1), 37

[^key-9e04e254fa3d9a8eae87beaaec26dd03]: Words in s. 149(9)(b) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 100(3)(a), 142(1); S.I. 2026/82, reg. 2(s)

[^key-9e24f8af50209b0af1b4ff26a0525e0e]: Sch. 19 para. 279 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-9e3449692e9eee7e556134a9272ef4ee]: S. 146(2)(j)(k) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 98(2)(a), 142(1); S.I. 2026/82, reg. 2(q)

[^key-9e7a5f58b13f91f6d28b4ab819f33a54]: Sch. 2 para. 4(3) omitted (31.1.2022) by virtue of The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2022 (S.I. 2022/76), regs. 1(2), 2(2)(d)

[^key-9e9abcbf54f86bbf9b0784d06d72490e]: Word in Sch. 2 para. 26(9)(d) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 24 (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-9ea61d1ece95e50cb79bdb1b64be7a03]: S. 17 cross-heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 21 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-9ef9aecb69c6cba490e1936f1f0fb107]: Words in s. 157(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 64(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-9f5c56edc1342d98195ad1b32fab06cb]: Sch. 19 para. 8 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-9f72e36003430e39c3757295200a60d4]: Words in s. 182(8)(b) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 22(5)(d) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-9f924437bee18db808d47091eedf71e4]: Sch. 19 para. 213 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-9f9a51d31ece70359c752169867ad4ff]: Words in Sch. 3 para. 20(1)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(19) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-9fd4ec495d0150d2a876611d7d18844f]: Sch. 19 para. 85 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-a00ae0d976446db156c56d104bf8a46d]: Sch. 19 para. 221 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-a0127af1ada079caf6957dccac2808db]: S. 3(10A) inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 4(5) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-a049100b2a7f7e52c5da14c539d6046a]: S. 96(4) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 80(4)(c), 142(1); S.I. 2026/82, reg. 2(j) (with reg. 5)

[^key-a0b98661e146b804075a34298587c3ff]: Sch. 19 para. 174 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-a108ccc8090ee178d30cecfaf943e5e8]: Sch. 19 para. 20 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-a1145e70e881abbcff0d5dc04ab6272b]: Sch. 20 para. 56 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-a1273524e053f511fd09ea5026a748c7]: Words in Sch. 3 para. 2(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(5) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-a1284e67c0464faf7b552d309af526ee]: Words in Sch. 21 para. 4 heading substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(2) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-a168ba5289668a8cd5edfcb49d96d728]: Words in s. 79(10) substituted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(8)(g), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

[^key-a16e898716b82093a021e0d331d6725e]: Sch. 7 para. 18A inserted (1.11.2022 for specified purposes) by Armed Forces Act 2021 (c. 35), s. 24(1), Sch. 4 para. 9; S.I. 2022/1095, reg. 3

[^key-a182758c8bbfb23b0f4de56a33affea8]: Words in s. 206 Table substituted (17.11.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 90(9)(a)(ii), 142(1); S.I. 2025/996, reg. 2(2)(b)

[^key-a1ace6c1cc4bec0d69aec49f273df997]: Words in s. 75 heading substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 6(2); S.I. 2026/82, reg. 2(z10)

[^key-a1c35c4d9fb9c6b8432b9c99b83faa06]: S. 104 in force at 16.9.2019 by S.I. 2019/1188, reg. 2(d)

[^key-a2536056f71e77d12ec0552af9cdb0ae]: Sch. 19 para. 14 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-a2c39c1b8f50d64d3eab992537ab337c]: Words in s. 5(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 6(4) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-a2dc7867f7754a11a35a6a348b1c9035]: Sch. 7 para. 56 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-a31bbbaf0702a16d218d015081e896e0]: S. 45A inserted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 79(6), 142(1); S.I. 2025/996, reg. 2(1)(a) (with reg. 3)

[^key-a3223e88f65edf1e7502f2b1c6679a68]: Words in s. 76(1) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 7(4)(a); S.I. 2026/82, reg. 2(z10)

[^key-a3956bf127b4dff3e08e52e3a45b9de4]: Words in s. 74B(7) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 5(9)(b); S.I. 2026/82, reg. 2(z10)

[^key-a3c0ce05bf3da8355e376954eddca53f]: Sch. 7 para. 52 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-a3c7eb3e7878fac572efde73a8615fd3]: Words in s. 182(8)(a) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 22(5)(c) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-a3ce48c816fb2bf06559889b7357e5f6]: Sch. 19 para. 330 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-a3e5aec1f29a24d1eaf3ac27bcb0f574]: Sch. 3 para. 13 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-a3e5b77cf0824d21fde09cd713fdccb5]: Sch. 19 para. 190 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-a44536bac9a597320eab0a82eead9a1b]: Sch. 2 para. 9 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-a45d5a7b4c8252c5c648eaeb70d56554]: Ss. 124B, 124C inserted (19.6.2025 for specified purposes, 20.8.2025 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), ss. 93, 142(1)(2)(h); S.I. 2025/904, reg. 2(g)

[^key-a4aa35db6bea2e2d38df00cf0ecfb4af]: Sch. 19 para. 282 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-a4b40f818ce15c1720d09e302bf3f262]: Sch. 19 para. 263 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-a4c5e68e10976ef4fd24a41417295228]: Words in s. 186(1) omitted (20.8.2025) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 106(4)(b), 142(1); S.I. 2025/904, reg. 2(k)

[^key-a55bc19846ba8171882b84179089460e]: S. 75(1A) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 6(4); S.I. 2026/82, reg. 2(z10)

[^key-a563ca7f29827ed10138447c14ed491d]: S. 29(1A) inserted (17.11.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 90(3), 142(1); S.I. 2025/996, reg. 2(2)(b)

[^key-a59f8dde3068bf877b888306045bdfab]: Sch. 19 para. 424 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-a5d5816e42d277460429b755f59aaec5]: Sch. 20 para. 16 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-a5d6a3cabaabe61fe8191d35a6959006]: Words in Sch. 2 para. 25(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(19)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-a5eeff55dde4d6b88a20de1eb7c39000]: Sch. 19 para. 378 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-a5f269dcf2171429f01e39e0cc667528]: Sch. 1 para. 28 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-a5f32b7275324384f0c6356c55a7855c]: S. 157(7) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 64(6) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-a623e2942e804444c750d65ec618366c]: Sch. 19 para. 402 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-a625401585854a4edacab4ebf6ddb133]: Sch. 19 para. 156 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-a6329d63514954d20f2d428cfd3f35ec]: Words in s. 187(1)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 81(4)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-a63390fc5b556409349772fb7f0ec1d4]: Sch. 19 para. 145 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-a63f73287f410fd54431d0a02dc24128]: Words in s. 94(10) substituted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 11 para. 16; S.I. 2025/904, reg. 2(y)

[^key-a6604195d497ecc3ddea17c2bd854a34]: Sch. 11 para. 5 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^key-a685afd8e1ad0bb3dd291dc18372de28]: Sch. 19 para. 400 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-a68e38da2bdfa2ea3680d54d36ce44b5]: Sch. 19 para. 419 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-a6b836bb2eded84554fa5fd897590987]: Words in Sch. 2 para. 3(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(7)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-a6dd67613d93c269ece96506ae442a40]: S. 125(5) substituted (19.6.2025 for specified purposes, 20.8.2025 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), ss. 92(3)(d), 142(1)(2)(h); S.I. 2025/904, reg. 2(f)

[^key-a6ea8b0e80d6677a025f42dbe552b801]: Sch. 19 para. 171 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-a6f29ae743c02d47e566e471ff2e85c0]: Sch. 1 para. 12 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-a72770f7a6d3448edd24f63cabe6dfa5]: Words in Sch. 3 para. 6 cross-heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(8) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-a72ed094e92b1e77b75e2da52e1bc7c9]: Word in Sch. 20 para. 14(2) substituted (5.5.2023) by The Data Protection Act 2018 (Transitional Provision) Regulations 2023 (S.I. 2023/414), regs. 1(1), 2(2)

[^key-a7f4fb45d4985c2ae2de3f44e0683a28]: Words in s. 146(12) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 98(2)(d), 142(1); S.I. 2026/82, reg. 2(q)

[^key-a8d6ad38f571bd25bf6e36ce4c60dfb4]: S. 146(11A) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 98(2)(c), 142(1); S.I. 2026/82, reg. 2(q)

[^key-a8f58512cb57f396c3a6b2d0a2120804]: Sch. 19 para. 179 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-a92af31a14937e990ce7e02e2e9d9f29]: Words in s. 10(5) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 13(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-a931c9ae51bd816f5bd69abcac767b27]: S. 160 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-a94119cccf820588c348cc565b00173b]: Sch. 19 para. 47 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-a9e9900b37646b445f84ef39a0d76cc0]: Words in s. 157(2)(a) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 6 para. 16; S.I. 2026/82, reg. 2(z8) (with reg. 5)

[^key-a9ec2bd81e5dda449f1fc6b59fc8c021]: Words in s. 78(4) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 10(7); S.I. 2026/82, reg. 2(z10)

[^key-aa6af2689d3c8dbcfd3393c5949edec1]: Sch. 19 para. 410 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-aa86426e70dd097305ad06632c463ad0]: Words in s. 116(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 48(4) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-ab17241dc6150ceb8d51a34398cf5b43]: S. 164 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-ab3ee4f089fcbc7d49b46a2bbd552991]: Words in s. 180(2)(e) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 75 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-ab59fd7803f594dabdae198bc7ee59b2]: S. 189 in force at 23.7.2018 by S.I. 2018/625, reg. 3(f)

[^key-ab5b474d3b7afb2f028fbe0f93ce632c]: Words in s. 15(2)(c) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(5)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-ab92c540c3a132992c2519ccffece33d]: Sch. 19 para. 216 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-abec216a11c53d30529d354f6e83a50f]: Sch. 15 para. 18 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-ac0d3ccf4233244b994c97cd184120b6]: Sch. 7 para. 43 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-ac3b134b46dc6a134cccaf5d53f4d75d]: S. 182(14) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 22(8) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-acb0285e2b1938c540581efba74d8844]: Sch. 19 para. 367 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-acd9c1db11c3f2dc87e850a09432977c]: Sch. 19 para. 390 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-ad561b17280fb2bb04693918a0e33719]: Sch. 19 para. 194 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-ad7fdedeb20c593a8a57d11ce1f3e37e]: Sch. 11 para. 13 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^key-ae0d40b78ec0ef6eff74768f4ff98744]: S. 204(4)(p) omitted (30.11.2022) by virtue of The Health and Social Care Act (Northern Ireland) 2022 (Consequential Amendments) Order 2022 (S.I. 2022/1174), arts. 1(2), 12(2)

[^key-ae62c8e2190203abcf6e1d2577cb264d]: Sch. 19 para. 37 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-ae7474f0c3ecc17e0da102de1e22069d]: Sch. 19 para. 337 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-aee4aa208301e598dbb8564e8e9b226b]: S. 5: power to amend conferred (19.6.2025 for specified purposes, 20.8.2025 in so far as not already in force) by Regulation (EU) 679/2016, Art. 11A(3) (as inserted by Data (Use and Access) Act 2025 (c. 18), ss. 74(1), 142(1)(2)(h); S.I. 2025/904, reg. 2(c))

[^key-aefe328365b9310832632a3f7bf664db]: S. 180 cross-heading substituted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 104(2), 142(1); S.I. 2025/904, reg. 2(j)

[^key-af00bc19e71787fbc67e62544709eb1b]: Sch. 12 para. 9 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

[^key-af0b63f67e273e6e110ffcb6b31502f4]: Sch. 19 para. 148 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-af704cdbd7c856f0edbefe85c657cb92]: Sch. 19 para. 24 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-b00c0f26a2d6a3755a47ccea8a91b596]: Sch. 19 para. 339 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-b01ad887f3d56c8021072a3f068fbcb6]: Sch. 1 para. 11 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-b02d838bd40974bc580161dcc52bd83c]: Words in Sch. 2 para. 4(1) inserted (31.1.2022) by The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2022 (S.I. 2022/76), regs. 1(2), 2(2)(a)

[^key-b067cdd42587d1724117cfb8de72ee09]: Sch. 19 para. 350 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-b0997f585eed7e7038937ae450f7de4f]: Sch. 19 para. 199 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-b0b94538e5b0cafb0b20aa069c61482f]: Words in Sch. 1 para. 1(3) substituted (31.12.2020) by The UK Statistics (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/489), regs. 1, 3; 2020 c. 1, Sch. 5 para. 1(1)

[^key-b0ca7b55c1d34b9d0878eae9b1f6b388]: Words in s. 78(1) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 10(3)(c); S.I. 2026/82, reg. 2(z10)

[^key-b0db01543b0050f576c5393cc63112bd]: Sch. 16 para. 2 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-b1051ad1ae2b860c2886c33cde88988e]: S. 26(2)(fa) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 17 (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-b14dd74941113a22c1d268f51eb9660d]: Sch. 20 para. 39 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-b19644c907c1538c9f4a2b6db6529dea]: Sch. 19 para. 274 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-b1be5893ae060407bd875c20d32c3938]: Sch. 19 para. 30 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-b1fceaf86c42fac53cc007de0358f87e]: Sch. 19 para. 251 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-b22b598c83a6dff2777903b9fdfdef65]: S. 213(4) inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 90(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-b2961d7046e3dae3d467be51d99d6bc0]: Sch. 3 para. 8(2)(d) substituted (1.7.2022) by Health and Care Act 2022 (c. 31), s. 186(6), Sch. 4 para. 229; S.I. 2022/734, reg. 2(a), Sch. (with regs. 13, 29, 30)

[^key-b2c1ac345b2156d511d9a5e0cc32de4b]: Sch. 20 para. 19 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-b2d226d0cfe537af92b05e90e77440e1]: Words in Sch. 2 para. 28(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(24)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-b2e90f163831a820a96c66b0fee0479c]: Words in s. 17(8) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 22(6)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-b340272b6edde8560df08ced34064a27]: S. 118(1)-(4) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 50(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-b3795eef097c1a571dd91a5a58fbb545]: Sch. 19 para. 397 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-b38545fc0af14c07ceef9e17b64ca5eb]: Sch. 19 para. 336 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-b3fcc9c6b47a21df6520e7240c7ff7bf]: Words in Sch. 2 para. 18 cross-heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(16) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-b43bb1f6638b5994d92beeecf2ab27a2]: S. 207 modified (30.9.2020) by The Channel Tunnel (Arrangements with the Kingdom of the Netherlands) Order 2020 (S.I. 2020/916), arts. 1(2)(b), 4(3)(4)

[^key-b448f0542b76286bd7b6f08b1eba41a2]: Sch. 19 para. 332 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-b452ea5807870d8b5ed178682e71a1c9]: Sch. 3 para. 9 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-b465e86c8c1c06e714d3d2827dbebf59]: Sch. 3 para. 14 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-b46d629f05ec35dd3166d376f05d7e6a]: Words in Sch. 13 para. 3 omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 97(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-b477b7ab6ad0e09aca8432fb6d5825ec]: Sch. 19 para. 181 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-b499f11052d143d8bd9082382676ba08]: Words in Sch. 2 para. 26(9)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(21)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-b4a7bbe1aa38cf9a236d3e2b976a4b43]: Sch. 20 para. 26 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-b4b0a841e37efa02a66d16bb942be198]: Word in Sch. 2 para. 4(1C) omitted (8.3.2024) by virtue of The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024 (S.I. 2024/342), regs. 1(2), 2(4)(a)

[^key-b4c0aed7d7060e936e448ad89b19a7f3]: Words in s. 142(9) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 59(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-b4ee8b33cc28be5d64d57676972fe9cb]: Words in s. 186(2)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 80(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-b50cc128cf93e81329e8f692740f94b8]: Sch. 1 para. 36 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-b54c57bf05b376d8d1296b1b3073711a]: Sch. 19 para. 9 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-b5870932b95e3ca877d17b34543d9485]: S. 24(2)(ca) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 16(b) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-b590a9087442280960754e373c622ce8]: Sch. 19 para. 373 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-b60dc775aac7c701d2165367b07d3c92]: Word in s. 149(2)(b) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 6 para. 15(b); S.I. 2026/82, reg. 2(z8) (with reg. 5)

[^key-b621b1bce175765bffd77f862862781f]: S. 79(1)-(3) omitted (5.9.2025) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 88(8)(a), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

[^key-b62d921feb3097216f65a44384e7c28a]: Sch. 2 para. 7 modified by S.I. 1999/677, art. 7(1)(2) (as substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 237 (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g))

[^key-b66bfe28770e7c763a748c72fa460f03]: Sch. 19 para. 318 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-b67a57ad7f0934155bdc77e2a131f1fa]: Sch. 2 para. 7 modified by S.I. 1999/3145, art. 9(1)(2) (as substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 238 (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g))

[^key-b69d717e1e9c428be52a8405917b6a47]: Sch. 11 para. 14 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^key-b6bbed2a6cf684bdb26ac707b67928e4]: S. 186(2A) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 106(4)(c), 142(1); S.I. 2025/904, reg. 2(k)

[^key-b6ee800cbbca868e5b81fc389982dfb8]: Sch. 19 para. 225 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-b6fec47aa194969dfe8a3a6fea4187d8]: Sch. 19 para. 64 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-b7ec9fe5f8e02209dbf599741d3c734a]: Words in s. 187(1)(a) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 81(3)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-b809b11818db07b6251c81d14a36f7e5]: Sch. 1 para. 31 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-b82114f65ed3bebd5667c90d730bb0a7]: Words in s. 206 Table omitted (20.8.2025) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 11 para. 27; S.I. 2025/904, reg. 2(y)

[^key-b85964a87061e13a255bedfd6fa9b9c3]: Sch. 19 para. 278 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-b8ac6fb172d66af4a5e7441a6e2e92e5]: Words in s. 204(1)(g) omitted (2.12.2019 at 00:01) by virtue of Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 227(2)(a) (with ss. 117, 209, 210); S.I. 2019/1434, reg. 2(b)

[^key-b8acde08ea2a80a6fcb78d2122163702]: Words in Sch. 3 para. 11 cross-heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(11) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-b8b61b3422cb1c2f989b7859d8fe3c85]: Words in s. 25(2)(b) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 33(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-b8bb776d4ce7a80859a0cd4e072721de]: Sch. 19 para. 72 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-b8ecea97a092c0a76388cfeca5963182]: Words in s. 206 Table inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 86(6) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-b93822e6be019e9b1da50e3d149d0512]: Sch. 19 para. 314 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-b94b200a4666765f964f6b64e6e3d0b1]: Sch. 1 para. 13 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-b9933b917dda2c289091db4c60012665]: Words in s. 189(4)(d) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 83(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-b9957e2a5a2f701bf8221842166c966d]: Sch. 1 para. 14(1)(b)(iia) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 11 para. 28(5); S.I. 2026/82, reg. 2(z12)

[^key-b9fb3ca41d32a811b10aaa5281713ab0]: Sch. 16 para. 7 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-ba50110eb56a510d248a092ced92efea]: Sch. 20 para. 10 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-bb92ccaf6d40e7fe52d46a80c4f8d067]: Words in Sch. 21 para. 4(4)(a) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(3)(b) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-bba1972fdaeb5c6bfb595609de9e7fca]: S. 73(3) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 3(4); S.I. 2026/82, reg. 2(z10)

[^key-bbc49c524804fb2ab905465728240522]: Words in s. 170(7) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 71 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-bbf1a58d25121030163f2ecc32091b86]: Word in s. 82(1)(b) substituted (17.11.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 89(2)(b)(iii), 142(1); S.I. 2025/996, reg. 2(2)(a)

[^key-bc2a530dd3f0d4818c8cbe412b184952]: S. 42A inserted (19.6.2025 for specified purposes, 20.8.2025 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), ss. 74(5), 142(1)(2)(h); S.I. 2025/904, reg. 2(c)

[^key-bc3021df4d077fdfe7d839e771ba45e1]: Words in s. 126(4) substituted (19.6.2025 for specified purposes, 20.8.2025 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), ss. 92(4), 142(1)(2)(h); S.I. 2025/904, reg. 2(f)

[^key-bc71876f7b085a331fb2523e66d417c1]: S. 188 in force at 23.7.2018 in so far as not already in force by S.I. 2018/625, reg. 3(e)

[^key-bd4de8f85f3e7210b241c119815eb03b]: Sch. 19 para. 125 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-bd7353c4ff1428096418d9207dd0851a]: Sch. 19 para. 75 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-bda1051a1d1b0d9d9e9c369c328cf110]: S. 93 in force at 16.9.2019 by S.I. 2019/1188, reg. 2(a)

[^key-bdb76943ea02d98f95919369d09bb043]: Sch. 1 para. 6 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-bdbe08dca4db3985f45c3f7d98c4371f]: Words in Sch. 3 heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-bdca30164de5570a8928702ed862e347]: Sch. 19 para. 256 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-be0e43ced31d335546a8059944d317db]: Sch. 19 para. 50 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-be1bf0983596986c0b786e77ad4ce52e]: Sch. 19 para. 275 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-be21e957c0ac10ddafc37dd24c11484d]: Sch. 19 para. 105 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-be312be66278b219bf36807ebc298dca]: S. 21(1)-(4) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 29(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-bed1bbe545b86b3f34cd73fe1006e0b1]: Words in s. 79(8) substituted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(8)(f)(i), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

[^key-bedf5d2451f593d3f59d1740c5bd6e9c]: S. 139(2) omitted (20.8.2025) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 11 para. 20; S.I. 2025/904, reg. 2(y)

[^key-bef50065785b938e25237c6aa68a6597]: Sch. 19 para. 285 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-bf1901e085f9376f525dcebcaece26ab]: Sch. 12 para. 6 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

[^key-bf1d3584bf9342d0842c99952cad6f81]: S. 21(8) inserted (25.1.2023) by Advanced Research and Invention Agency Act 2022 (c. 4), s. 13(1), Sch. 3 para. 15(3); S.I. 2023/58, reg. 2

[^key-bf2d61f28feb2f6a4a05e3ea8b3954db]: Sch. 2 para. 28 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-bf35de83a0f437b87a9cef54c610a040]: Sch. 19 para. 172 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-bf49ad3664960bfa081e22b1676fed42]: Sch. 2 para. 4(1A) omitted (8.3.2024) by virtue of The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024 (S.I. 2024/342), regs. 1(2), 2(3)

[^key-bf6f2f5cefba8471451edb23ada87197]: Sch. 20 para. 42 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-bf995fccad30924b62ebc61e36091eea]: Sch. 19 para. 52 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-bfa38f6ea2f2d1ae4ff2e67570068933]: Sch. 7 para. 54 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-bfe88656543ff8d5238b037df8a8af1b]: Sch. 19 para. 433 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-bfe8ef2d0b7e57490a5fd744b237a5af]: S. 21 heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 29(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-c007da42893720a87d1ccc5f31b29e94]: S. 164(5)(ba) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 100(8)(b), 142(1); S.I. 2026/82, reg. 2(s)

[^key-c0286c159abd916463bf0ef6a009374d]: Sch. 1 para. 19 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-c03eb89cbce80a935ecb6347de5c299b]: Words in Sch. 2 para. 26(9)(d) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(21)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-c08398fac9ea431bbf20d8d55cdcc986]: Sch. 15 para. 13 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-c088d98cf8145c1a34b102fd333f5481]: Sch. 19 para. 113 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-c0b2f29bccc13f15dc49d5e39f492432]: Words in s. 182(11) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 22(7) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-c1385fd85cc9aa1ac18e428d1255229e]: Sch. 19 para. 208 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-c16f610c170d5b1d37b2f712191af2cc]: Sch. 11 para. 12 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^key-c1d3f43f097f9a6407e04871a09dba04]: Sch. 19 para. 335 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-c23720bc5fe8d01d4cdc6ce3eb96a7a0]: Word in s. 35(8) substituted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 74(4)(b), 142(1); S.I. 2025/904, reg. 2(c)

[^key-c24fe2bf46c2f469339fd6168916f31d]: Words in s. 125(9) substituted (19.6.2025 for specified purposes, 20.8.2025 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), ss. 92(3)(e), 142(1)(2)(h); S.I. 2025/904, reg. 2(f)

[^key-c27fc7f3663f78e184ed53b5cb3fa95a]: Words in s. 36(1)(b) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 71(8)(b)(ii), 142(1); S.I. 2026/82, reg. 2(d)

[^key-c283492444369915cc8328a5db21ac24]: Words in s. 41(1) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 86(7), 142(1); S.I. 2026/82, reg. 2(n)

[^key-c2993c748626851ac752a159c968c2f3]: Sch. 19 para. 68 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-c2ac2fbd7eae86c3237b0fea08970942]: Sch. 19 para. 147 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-c2c5d116ce6a43c27f2a73f15736bc95]: S. 135(5) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 94(2)(f), 142(1); S.I. 2026/82, reg. 2(p)

[^key-c2ef1f00c16c6ae79e671982664ebcb6]: Sch. 1 para. 7 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-c30e1b55c0964dff6ce0025bc68780b2]: S. 74B(7)(a) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 5(9)(c); S.I. 2026/82, reg. 2(z10)

[^key-c356bafc244fdc4ace9be54cbc58a2b8]: Sch. 19 para. 220 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-c36bb938b5c589478fc26017aba6c037]: Sch. 7 para. 1 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-c3878a9352147db7dfa9f90c863bf7d5]: Sch. 19 para. 79 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-c3db4b87743d73511206b4ae86bb0bbf]: Sch. 11 para. 2 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^key-c42e79588cd90b927e90e98fb9ba2512]: Words in s. 74B(6)(b) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 5(8)(a); S.I. 2026/82, reg. 2(z10)

[^key-c444d824a5b6f20e42cd95b28ec028cb]: Sch. 19 para. 13 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-c4616ae590a3753a8f2fa526f5ab1598]: Sch. 19 para. 412 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-c47d8b667ae682e06b898703297fc17f]: Sch. 20 para. 34 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-c4aa80bf6800be1023988219c3bbbb5b]: Sch. 19 para. 248 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-c4c698ffcad1fdfc1ee117a7b7f0135e]: Words in s. 78(5)(a) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 10(8); S.I. 2026/82, reg. 2(z10)

[^key-c4f6f551c02ad0529dcfe52319f44e5b]: Words in s. 45(5) inserted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(4)(b), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

[^key-c51320ded27a1bd50bf68bdae0baf46b]: Words in s. 27(5) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 35 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-c51b193aa656263473481500b9b47e2b]: Sch. 7 para. 24 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-c546bf86c8f31d0e9c29c51ed58b7835]: Sch. 15 para. 19 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-c55ae1876443a0b2fefba9ec810b9025]: Sch. 19 para. 109 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-c56e46dc215f18e71b09f349196ffd4c]: Sch. 19 para. 31 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-c5ee47c63d27ac9ec02a5ee22620d081]: Sch. 19 para. 170 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-c68c32f2f423229e644dabde516e73e8]: Sch. 19 para. 92 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-c6d237308dfd9e4ace550674cf51eb1c]: S. 24(2)(ca)(cb) inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 32(3)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-c6de1710ac870a50c6fae7c72c3e704e]: Sch. 1 para. 26 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-c6eabe9620a932c80ccb60c149f39305]: Sch. 20 para. 57 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-c6ff067d2b1a1e1fd14fed19077a1e27]: Words in s. 173(2)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 73 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-c77367f91e1d7c046076b6ba11f17199]: Sch. 1 para. 22 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-c7ea9a9c87ca4e89d73dbd273cfa8393]: Words in s. 4(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 5(2)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-c7f86e0fd7e97d7dc7de053dc830c822]: Words in s. 17(6) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 22(4)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-c8009cd3f34a2fb8b93f511fd91c3911]: Words in s. 54(1) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 76(6)(a), 142(1); S.I. 2026/82, reg. 2(h) (with reg. 4)

[^key-c80351c1f89ae0c5b0904b8cee685403]: Words in s. 78(3) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 10(6); S.I. 2026/82, reg. 2(z10)

[^key-c830a9cae371d430b44b2aa6a4bf2b0f]: Words in s. 74B(6)(b) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 5(8)(c); S.I. 2026/82, reg. 2(z10)

[^key-c878a510ff3f0a3cdbe94d08100e3f1f]: Words in s. 76 heading substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 7(2); S.I. 2026/82, reg. 2(z10)

[^key-c8842a494d6ce371ae2b0bfd423daf8a]: Sch. 19 para. 244 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-c8b189bd190418a0b8c08dc36a21b784]: Words in s. 54(1) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 75(3), 142(1); S.I. 2026/82, reg. 2(g)

[^key-c8b210ff5beb76a0a92b2c6d4bd6e5eb]: Words in Sch. 3 para. 5 cross-heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(6) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-c8e2994c25fb458736a5c26eaf716e23]: S. 162 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-c914990c72253d6c460805018090a05a]: Sch. 7 para. 53 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-c928d8c9711cfedfaf94e5e46642337c]: Sch. 19 para. 292 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-c950a89def036cb9e2d4a761b45c11a0]: Sch. 20 para. 61 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-c95234e363a715e0b865be6ac18a3963]: Sch. 15 para. 8 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-c989dc3d9a5b51c09bf8b938e230f75b]: Words in s. 209(4) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 88 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-c99271dec5b91e51a9f814f1c8a4b5c2]: Words in Sch. 20 para. 18(2)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 101(4)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-c9c90b260f03b04a3210ddf5cf427c98]: S. 147(6)(b) and word omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 99, 142(1); S.I. 2026/82, reg. 2(r)

[^key-c9dd5c6539aaab7b9c7d8c2530ffbb16]: Sch. 19 para. 187 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-ca51874e189552fc41a0821aa974d708]: Words in Sch. 1 para. 13(1)(a) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 11 para. 28(4); S.I. 2026/82, reg. 2(z12)

[^key-ca55331b740b2f84383f97045a5d7b5c]: Sch. 20 para. 25 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-ca96e304fa8efb2d21e87e6971b2da03]: Sch. 19 para. 428 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-cae8564f5eee567291017b4476a12666]: S. 186A inserted (1.1.2024) by Data (Use and Access) Act 2025 (c. 18), ss. 106(5)(7), 142(1); S.I. 2025/904, reg. 2(k)

[^key-cb2511796c16bd899c755ab035c92cf8]: Act applied (31.12.2020) by Regulation (EU) No. 625/2017, Art. 143 (as substituted by The Official Controls (Animals, Feed and Food, Plant Health etc.) (Amendment) (EU Exit) Regulations 2020 (S.I. 2020/1481), regs. 1, 27(3) (with reg. 46))

[^key-cb3108a589d4abf7f4623f8e5fbdc4b6]: Sch. 19 para. 185 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-cb40895550fff4b1df945a592f3d2928]: S. 26(2)(g)(iv) inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 34(3)(e)(ii) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-cb488232f6394d8ef31bca7d0e16a533]: Sch. 3 para. 4 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-cb4bb25b28e2a4cebdd3008f0007e5a3]: Words in s. 52(3) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 6 para. 13(3); S.I. 2026/82, reg. 2(z8) (with reg. 5)

[^key-cb60abcf455a1fb39b192e2fb65b8e33]: Sch. 20 para. 21 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-cb7a6630c560b4d7f879a0ea0c77fbd1]: Words in s. 206 Table inserted (17.11.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 90(9)(b), 142(1); S.I. 2025/996, reg. 2(2)(b)

[^key-cb9887b74f9ddbd87db8262dc983986d]: Sch. 19 para. 89 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-cbafc2b11db1365fec90797f8b94de74]: Words in s. 35(6)(b) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 74(4)(a), 142(1); S.I. 2025/904, reg. 2(c)

[^key-cc268dff7489493500857e0da3d30cf8]: Sch. 19 para. 281 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-cc7111f2b8b984b394cb92bb7c3a96cd]: Sch. 19 para. 58 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-cc8fef6eab17a4ac6bac35664627a6a3]: Words in s. 28(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 36(3)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-ccac30bcd9ef201935aa8d55dd2c7179]: Sch. 19 para. 4 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-ccb74de70cc7a0e82e0af0edf88a190e]: Sch. 7 para. 8 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-ccd32dfe47587c5622c9eb7238443189]: Sch. 19 para. 273 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-cd0fcadfa37c156db132b641258a55e0]: Sch. 1 para. 35 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-cd3fcd3b3b24247e2c9c80b93ed010a3]: Words in s. 52(5) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 6 para. 13(5); S.I. 2026/82, reg. 2(z8) (with reg. 5)

[^key-cd796f7f465a287a7ad8f6cceb0ffdd1]: S. 68(7)(d) omitted (5.9.2025) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 88(6), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

[^key-cda6697838e6a39b03259abc790960d5]: Sch. 18 para. 3(2)(fa) inserted (1.12.2023) by Northern Ireland Troubles (Legacy and Reconciliation) Act 2023 (c. 41), s. 63(4), Sch. 13 para. 10 (with s. 61); S.I. 2023/1293, reg. 2(k)

[^key-cdd8c10a5150531bb30b7690485fc5fc]: Pt. 2 Ch. 3 applied (31.12.2020) by Regulation (EU) No. 625/2017, Art. 143 (as substituted by The Official Controls (Animals, Feed and Food, Plant Health etc.) (Amendment) (EU Exit) Regulations 2020 (S.I. 2020/1481), regs. 1, 27(3) (with reg. 46))

[^key-cdf6ef8adaf644a19027e1ed1cdb2254]: Sch. 19 para. 355 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-ce61eaf66563099c85e4f387c32e5c33]: Act applied (30.9.2020) by The Channel Tunnel (Arrangements with the Kingdom of the Netherlands) Order 2020 (S.I. 2020/916), arts. 1(2)(b), 4(3)

[^key-ce6b81a167b4265731f5b10cf3fa3b85]: Sch. 2 para. 27(4) inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(23)(d) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-ce78857695492590423f593605c8ec36]: Sch. 7 para. 32 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-ce8f58e41e39345fa68025d5f759b383]: Sch. 7 para. 20 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-cef4c775a0b9e54df85f16deac5eafea]: Sch. A1 inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 72(8), 142(1); S.I. 2025/904, reg. 2(b)

[^key-cf05969d527787ceebd91cdb9d0c97c8]: Words in s. 76(1)(c) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 7(4)(b)(i); S.I. 2026/82, reg. 2(z10)

[^key-cf185b11f6eb430ea7b837e8c88bd7b6]: Words in s. 80(4) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 46(4) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-cf7b12fa6e29df3664f564217fb41aec]: Sch. 19 para. 320 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-cfa904e383c8454f90dcaaceeb630997]: Sch. 19 para. 54 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-cfd00f9390a56e61349aa5a1f9a1ffa9]: Sch. 19 para. 240 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-cfd37790b8a4ffc332af6e54afe597a3]: Words in s. 187(1) substituted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 81(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-d00de55d7e460f218dbfdfc1cc28e86a]: Sch. 19 para. 84 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-d035aebb324ef6e0087dfa27a2360edd]: Sch. 19 para. 394 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-d0f66d6d5861f68ffafba417b3b6cd8d]: Sch. 19 para. 233 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-d0fd51828a41aca7cb26f8a6708a3c8b]: Words in s. 115(6) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 47(7) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-d114d373a470ef9c52798d2916ae07af]: Words in Sch. 2 para. 1 cross-heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(4) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-d1152f324a931564f92cc8544265fbed]: Word in s. 82(1) inserted (17.11.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 89(2)(b)(i), 142(1); S.I. 2025/996, reg. 2(2)(a)

[^key-d142e8d668e46fcefe4fda5df5ec3327]: Sch. 3 para. 3 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-d148ab93ff75155701358f9231d9b294]: S. 44 cross-heading substituted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 79(3), 142(1); S.I. 2025/996, reg. 2(1)(a) (with reg. 3)

[^key-d16c7a54102fa53493454b8eb8c8f1f3]: S. 23 omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 31 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-d171d83535850d556ca50d4c0a9131d1]: Words in Sch. 19 para. 432(5)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 100(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-d1c4a5b8f04832edf2cb03e6ea265e7c]: Sch. 1 para. 17 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-d215058b7b57e3a9731a7ad5e4301724]: Words in s. 11(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 14 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-d21cee9d28e7ef117ac498fbed58738e]: Sch. 14 para. 10 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

[^key-d246561fbd24e4e3fc88730fdaad884d]: Sch. 7 para. 51 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-d28d939c5b88e9d83db1ae875c3e2f99]: Sch. 19 para. 35 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-d2992e1a702c7fd6a6c636a5bb840e57]: Sch. 3 para. 10 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-d2ab903fec483b11ddcbb071e3ef3ab0]: Sch. 5 para. 2 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-d2b3c86cc8ebfa8022b13d7f3cb9ebdf]: S. 74 omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 41 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-d2b9ba5521020831be5beef0f2b1990f]: Words in s. 173(2)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 73 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-d2e0447457ca59340f34c196ea9c9bbb]: Words in s. 45(5) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 76(5), 142(1); S.I. 2026/82, reg. 2(h) (with reg. 4)

[^key-d2fd9c6100b620310997d76d277b9f80]: Sch. 19 para. 99 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-d30e265bd0e7290a2fd7d7064c8670b8]: Sch. 19 para. 262 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-d389ab58efdc2e62d3686cf163bc479c]: Sch. 19 para. 296 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-d3c84fd6416aecc51ba5440265479cbe]: Sch. 19 para. 365 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-d3e1d574f1063ebf020fe69e09894006]: Words in s. 15(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(9)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-d3e6a542361c641611591efb60fe9e38]: Sch. 19 para. 137 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-d4911fd8900176bfede61e0e047b8c61]: Word in Sch. 1 para. 10(1)(a) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 11 para. 28(3); S.I. 2026/82, reg. 2(z12)

[^key-d49a6d2b560c968a1b1a08e01ce6a029]: S. 3(14)(b) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 4(7)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-d49e29b37e647fdc02fe14d8a452418e]: Words in Sch. 21 para. 9(3)(a) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(6)(b)(i) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-d4f3fe3c5fbdf78dd7e443f27080c092]: Sch. 7 para. 44 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-d50b2691f5d850d9368511bef6e62dee]: Sch. 19 para. 321 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-d534be7b3720f9991fab190ffff1752e]: Words in s. 174(2)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 74 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-d5814a5c9f9acb766d2ce56a6703bb8e]: Sch. 11 para. 8 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^key-d5d81d1e5de7c304de8030c77285cf59]: Words in s. 52(4) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 6 para. 13(4); S.I. 2026/82, reg. 2(z8) (with reg. 5)

[^key-d66a0382c6eee93acf592ffe2d2762bb]: Words in s. 119A(1) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 20(2) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-d6f4e27ae8c0a8a0d6b9afb5b4427125]: S. 7(1)(ba) inserted (25.1.2023) by Advanced Research and Invention Agency Act 2022 (c. 4), s. 13(1), Sch. 3 para. 14(a); S.I. 2023/58, reg. 2

[^key-d7b53c8fbbc309eb53cd104cacb820d5]: S. 146A inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 98(3), 142(1); S.I. 2026/82, reg. 2(q)

[^key-d7d2530b8c04272f421e5f13fc49a57f]: Sch. 15 para. 15 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-d7f2eb02ca7f034aafd56f74b579aba9]: Sch. 19 para. 161 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-d7f3b3ea581183119f32ef174c1446a7]: Sch. 19 para. 396 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-d82894d6535af83d3105500941158fc7]: Word in s. 186(3)(b) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 80(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-d8543783ecce9fc324879502be7a7702]: Sch. 19 para. 398 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-d89a6ff40d1b9a78fe4c101979ac8c96]: Sch. 20 para. 7 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-d8d73be9be172f479c33caf3c2fc1670]: Words in s. 210(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 89 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-d905a49f85abea49a90d25e4d78b00cb]: Words in s. 174(2)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 74 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-d90ea73c93bcf268873fb7da4680904a]: Sch. 19 para. 165 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-d90f8aa7af43aed9d99961342328f905]: Words in s. 36(1)(b) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 71(8)(b)(i), 142(1); S.I. 2026/82, reg. 2(d)

[^key-d926ea66208808cf0ac6cd8080a79d94]: Sch. 1 para. 16 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-d94801f9ba7734b896eb73e9c7d3ab3c]: Word in s. 6 substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 67(2), 142(1); S.I. 2026/82, reg. 2(a)

[^key-d975bf9312ec73c1e21013621d4551b6]: Sch. 2 para. 14 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-d99c33910706cc9759a015d3c9510423]: Words in s. 48(4) inserted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(5)(b)(ii), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

[^key-d9d4a5328d371f45edc310525d5e56ca]: S. 195 in force at 23.7.2018 by S.I. 2018/625, reg. 3(l)

[^key-d9da4db861a50088202986f496b2f52f]: S. 17A and cross-heading omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 12 (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-d9e75b820dadd4eac2b1032ec6c6a4da]: Sch. 19 para. 258 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-d9ef046124282afd82fbdc97d2c50598]: Sch. 7 para. 38 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-d9fc1bc3658d88f2d897556d637f92a5]: Word in Sch. 21 para. 9(1) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(6)(a)(ii) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-da4d8d7b0fe43481acfe3f79e34c5771]: Sch. 19 para. 188 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-da5474989e672f513cfd5369bd8c73d9]: Sch. 19 para. 41 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-da640f7e42c73ddf470ab5d98d90bf50]: Sch. 2 para. 7 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-dab432b68eaa55e8793ff7fdf2cde91f]: S. 53(4A) inserted (19.6.2025 for specified purposes, 5.2.2026 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), ss. 75(2)(a), 142(1)(2)(h); S.I. 2026/82, reg. 2(g)

[^key-dab6528400a65dd48f125dfd149128c0]: Words in Sch. 3 Pt. 1 heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-dab72f344c2223ac494a5ec5e4725a5a]: Sch. 19 para. 153 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-daf9e0252da094394cda1b40a87dfe22]: Sch. 7 para. 49 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-dbdad71b9ade64a8f7fdfc45c071f848]: Words in Sch. 3 para. 17(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(15) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-dbea2923e027af3545aabd9fb13d1561]: Words in s. 53(1) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 6 para. 14(2); S.I. 2026/82, reg. 2(z8) (with reg. 5)

[^key-dc25bdac0f1e8b11ebb0a1d301e0e786]: Words in s. 149(2)(e) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 21 (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-dc321b64fd0fcd1ec60ef61441b8fafc]: Sch. 8 para. 6 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-dc40b789ba49496fa957bb0b48f33a2b]: Sch. 19 para. 77 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-dc44819fb13fa8e6ea18a61ad3fab776]: Sch. 19 para. 276 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-dcdb72650fa4d8b42926e24c738770ee]: S. 82(2A) inserted (19.6.2025 for specified purposes, 17.11.2025 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), ss. 89(2)(c), 142(1)(2)(h); S.I. 2025/996, reg. 2(2)(a)

[^key-dce28071963c6ace834d117354904185]: Sch. 7 para. 14 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-dd0f181b5dd17d7042dc7e38ce07044c]: S. 111 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^key-dd19920218f3766a11863bfd8609d509]: Words in s. 207(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 87(4) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-dd2b3c609b732e6c74f06eac3ec5403a]: Sch. 19 para. 387 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-dd757ab40e97ddf846173abfa98de010]: Sch. 19 para. 70 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-dd7f364bfaec19b43609544d1cd6ce0d]: S. 75(8) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 18 (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-dd8583cf6b3633e3cd4398106baef5a8]: Sch. 19 para. 249 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-dd90705502d2af3349fa679fa27d61cb]: S. 97(6) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 80(5)(c), 142(1); S.I. 2026/82, reg. 2(j) (with reg. 5)

[^key-ddb140ac11da0a454924fd8b8ffdd0b4]: Words in s. 78(6) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 10(9)(c); S.I. 2026/82, reg. 2(z10)

[^key-ddb24038c52777eed313664ed44d18e8]: Sch. 19 para. 212 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-ddb56eb702b1a635c52b24c4ba095ef3]: Words in s. 25(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 33(2)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-de215a81f0a30f77df6c9d7b3aa62a84]: Sch. 20 para. 55 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-de38b60ee34fb320e926b3a6a4bfa2b2]: Sch. 19 para. 183 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-de4ac3966480d314214c8b4e0b2726c1]: Words in s. 48(6)(a) inserted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(5)(c), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

[^key-de4e64996aab70646e626d9af11ff8da]: S. 135(4) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 94(2)(e), 142(1); S.I. 2026/82, reg. 2(p)

[^key-de7ac3b59d15240bff2525e5f4ee0096]: Sch. 19 para. 218 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-deba1ccec93c5dcf33f3a26797f2173c]: S. 109 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^key-ded61f002bfbb5bef7671b46575c415a]: Sch. 16 para. 2(2)(3) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 101(2), 142(1); S.I. 2026/82, reg. 2(t) (with reg. 6)

[^key-deebf9ef3b2556d2b0b7321f2152e6b2]: Sch. 19 para. 315 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-deff4dd564b399ee67ce282b983c6ef7]: Words in s. 96(3) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 80(4)(b), 142(1); S.I. 2026/82, reg. 2(j) (with reg. 5)

[^key-df310fa6ee2a3dff0c63be234a5da9cb]: Sch. 19 para. 383 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-df4d3f41a1a238306f55678d6a3b9c30]: Sch. 20 para. 32 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-df726e993c279c8b9f39a174ac48a970]: Sch. 19 para. 56 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-df76da218b4fc287b7df92688b5b906a]: Sch. 19 para. 115 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-df9dd5178ce955ad86a004f4f5faf4f3]: Words in s. 86(3)(b) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 74(7)(a), 142(1); S.I. 2025/904, reg. 2(c)

[^key-dfd4e8a4ee7d2bdd2b63992d585ea975]: Sch. 19 para. 234 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-dffa9388dd0ef050a0bc9980aa1f03ca]: Sch. 1 para. 3 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-e0073adcf48ad8394f78eb971946c0b3]: Words in s. 12(1)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 15 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-e02ec6f854ccde9464ef3e9f5f9141a4]: S. 76(2A) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 7(6); S.I. 2026/82, reg. 2(z10)

[^key-e0842c692626b5e774c6753f0719945c]: Words in Sch. 2 para. 16(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(14) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-e0af39578686eeb0c305a1a1b1364dea]: Words in s. 74B(5) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 5(6)(a); S.I. 2026/82, reg. 2(z10)

[^key-e0bccd6b1e4e022c2e677ed1bdb9d8d1]: S. 183A and cross-heading inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 106(2), 142(1); S.I. 2025/904, reg. 2(k)

[^key-e0d2f2b8d26ec60067558dd0962095b3]: Words in s. 187(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 81(5)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-e12b78e0c76fbc4614664fe94a4d6885]: Words in s. 73(5)(a) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 3(6); S.I. 2026/82, reg. 2(z10)

[^key-e19adfb1f3c5862f38fc50a0d9f8f97e]: Sch. 19 para. 160 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-e19cbfe5436f8c558c28e7bfce051537]: Words in s. 15(2)(d) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(6)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-e1a399ea8db8f0e966700b51a7708047]: Sch. 19 para. 265 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-e1adfd83503e23bb12c37b264f983157]: Sch. 19 para. 430 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-e22a317e4dc955876132ce146811edf9]: Sch. 19 para. 340 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-e2348e78adbd3029a227efae614695f4]: S. 74B heading substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 5(2); S.I. 2026/82, reg. 2(z10)

[^key-e2376d4e7ebdd9a757cdbb27840c896f]: Act modified (14.2.2020) by The Northamptonshire (Structural Changes) Order 2020 (S.I. 2020/156), arts. 1, 17(2)(e)

[^key-e25930aa3cf639fbe9dcbc865cf147f2]: S. 113 in force at 25.5.2018 in so far as not already in force by S.I. 2018/625, reg. 2(1)(d)

[^key-e25dd9b1b973623ef52f15cab26e68cb]: Sch. 8 para. 8 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-e277a02441fd6aacb99d8f3da6909db8]: Sch. 8 para. 4 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-e27e0059768399e01f9b0f986d2a5687]: Words in s. 180(2)(d) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 75 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-e292a19194c3f4fab612e8e3dcf45f87]: Words in s. 15(2)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(3)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-e2b0ddf8b668d190eb64e7e6247065b4]: S. 132(2)(d) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 55 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-e2cbe8e7c3f7b29a3482667eec7169ce]: Sch. 19 para. 3 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-e2d548a4783586924138a4f64263651f]: Words in s. 26(2)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 34(3)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-e2dd47d0a543b3e922e9c971f2a8baa4]: Words in s. 24(5) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 32(5)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-e2f701e524ebd1a8781ec9a99b82c6d9]: Words in Sch. 20 para. 58(1) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 115(9), 142(1); S.I. 2026/82, reg. 2(y) (with regs. 8-11)

[^key-e36726ddad796892b59de71bc71fac9c]: Sch. 11 para. 4 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^key-e36f3d79dc2160326592a45b956bcee2]: Words in s. 80(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 46(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-e3bc569ce77a381912f7e45dd5b607a7]: Words in Sch. 3 para. 5(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(7) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-e3c229800630400cd31ee2e7333a1763]: Words in s. 120(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 52(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-e3d2ddb984625a2f569456c91752d449]: Words in s. 74B(6)(b) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 5(8)(b); S.I. 2026/82, reg. 2(z10)

[^key-e3d81e9f8b5c66334909f95bff82cae4]: S. 105 in force at 16.9.2019 by S.I. 2019/1188, reg. 2(e)

[^key-e470ab8179af8528ddd36f612bb0f69d]: Words in s. 28(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 36(4) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-e4afbc3f11ae48f0f055c87060290428]: Sch. 19 para. 385 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-e4b6bf252710a06423eb0634fadfe1eb]: Words in s. 182(8) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 22(5)(a) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-e4bd601efb2a0a88b3b1622f2115e194]: Words in s. 192(6) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 11 para. 26; S.I. 2025/904, reg. 2(y)

[^key-e4d19bddc6c0328454f09fd547393db8]: Sch. 19 para. 268 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-e51209f96eafbb1ab258e63be1650a81]: Sch. 19 para. 136 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-e52d8b5b76715f576de2f9602dc519b7]: Words in s. 73(1) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 3(3)(a); S.I. 2026/82, reg. 2(z10)

[^key-e5b2150a1d39bc03193da3965332e3b3]: Sch. 2 paras. 4A, 4B and cross-headings substituted (8.3.2024) by The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024 (S.I. 2024/342), regs. 1(2), 3

[^key-e61c7bcd6ea2ed4e56a76b4a860e3400]: S. 147 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-e62033720942b217198c1dfe98c8e731]: Sch. 19 para. 347 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-e65c667068c961c23636d717a9fe31b9]: Sch. 19 para. 168 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-e68518991b24f426c7502b2a7e8ed531]: Sch. 19 para. 201 omitted (29.3.2019) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(3), Sch. 4 para. 3

[^key-e6d674ace935bcf1083b558a35b32428]: Words in s. 15(2)(c) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(5)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-e712c58086f46cef490d2739c32196e8]: Words in s. 206 Table substituted (17.11.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 90(9)(a)(i), 142(1); S.I. 2025/996, reg. 2(2)(b)

[^key-e72064e13dd75d5efe7864fb56a44ab9]: Sch. 19 para. 298 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-e73ac3d5a9d77806ecf02f4d54d01d6d]: Words in s. 160 cross-heading inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 102(3), 142(1); S.I. 2025/904, reg. 2(i)

[^key-e75907eba429315009a11c3d22ff06fd]: Sch. 19 para. 202 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-e779a2cbb005a1cb60490514350355b6]: Word in s. 48(4) substituted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(5)(b)(i), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

[^key-e7856245e743d7a5de4a1d03a5a413ed]: Words in s. 2(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 3 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-e792a8125d606098513f47d2e25be7fe]: Words in s. 115(7) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 47(8) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-e7ffa3e81bd3a810e9d34eb945cfc66c]: Sch. 19 para. 163 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-e81956df0d06f6110c0b4ac40cb98a27]: Sch. 19 para. 269 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-e8392aedf57540894d7ffc3e0da6093d]: Words in Sch. 2 para. 27(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(23)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-e848a3d8004e9d924b205afb95f2dc17]: Ss. 74A, 74B inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 42 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-e858284550ffd5cdcd05135f1ac6dbd0]: Words in s. 123(7) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 53 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-e89782710f07812828650321cc604aa4]: Sch. 19 para. 358 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-e8b323b611736c350bc88b75920a0a2e]: Ss. 120A-120D and cross-heading inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 91(3), 142(1) (with s. 91(5)); S.I. 2025/904, reg. 2(e)

[^key-e94472e4cd77ee51f88b9af2fd0297a6]: Sch. 14 Pt. 1 omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 98 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-e966768c7106fe0dc55d7c693755813e]: Sch. 20 para. 4 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-e99058667b9492995c12419ae6af932c]: Words in s. 74B(5) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 5(6)(b); S.I. 2026/82, reg. 2(z10)

[^key-e99403db3867a4daaebe4da8128b05b5]: Sch. 19 para. 369 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-e9b848f9dfd63036d3e70f0dd8886750]: Sch. 7 para. 34 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-e9fc6a460347285c3702107aaf014e3e]: Words in s. 24(2)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 32(3)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-ea395bf42beb4786205aad06d93444ef]: Sch. 19 para. 130 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-ea6f11d03e5cf9bb39766c30d73c6169]: Sch. 19 para. 23 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-ea72ba67e1f77d2bc922e8cd029f82de]: Sch. 20 para. 52 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-ea99f9fb002f73f760fea222fdb9ef92]: Sum in s. 157(5) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 64(4) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-ea9d50e0b1e08135b83edb2cce36af85]: Sch. 2 para. 7 modified by S.I. 2007/1118, art. 5(1)(2) (as substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 324 (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g))

[^key-eaa81af4a8e0c8b3ce342bad34f36ba2]: Words in Sch. 2 para. 27(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(23)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-eb49132cb8ec05a9ceaa0e3d7c7c1ad1]: Sch. 19 para. 177 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-eb4cab607306f7c1339e70bed947d88d]: Sch. 20 para. 15 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-eb5829a0c87d7e2a3d3519615683d044]: S. 135(1A) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 94(2)(c), 142(1); S.I. 2026/82, reg. 2(p)

[^key-eb657c142c3f50225154d09ddb60518c]: Sch. 8 para. 9 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-eb777efcc08de23adede3dd754e4fc67]: S. 78(1A) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 10(4); S.I. 2026/82, reg. 2(z10)

[^key-eb8139f6b70ca4dec02be30470479741]: Words in s. 15(2)(f) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(8)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-eba1269b77655cf79896f883a1632572]: S. 160(1)(ba) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 100(6)(a), 142(1); S.I. 2026/82, reg. 2(s)

[^key-ebbf8e6619bc3e211728d99978469935]: Sch. 19 para. 326 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-ebc3859cb98a52a9be07b9734f108537]: Sch. 19 para. 407 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-ec0464280a18691fbcb6515bd0852c75]: Sch. 15 para. 1 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-ec0cba10767091647b040d74d1178660]: Words in s. 7(1) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 10(2)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-ec3664b19393730fe8eb0e0f28405a08]: S. 91A inserted (19.6.2025 for specified purposes, 20.8.2025 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), ss. 74(8), 142(1)(2)(h); S.I. 2025/904, reg. 2(c)

[^key-ec4c69b934ac57e2e43214a23dcbb96d]: Sch. 11 para. 9 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^key-ec6f56978250d6a8ac23a54c34201ea0]: Word in s. 82(1)(a) substituted (17.11.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 89(2)(b)(ii), 142(1); S.I. 2025/996, reg. 2(2)(a)

[^key-eced7daf0a93577817bcb97bd3948271]: S. 21 cross-heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 28 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-ed498558e2f05ed1eacf387d181f2ea5]: Words in Sch. 3 para. 20 cross-heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(18) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-ed56ea896273a41068d24de6c71e6165]: Sch. 6 omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 96 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-ed873bee9e2a133b42c9b3425efa4063]: S. 204(4)(g) substituted (1.2.2023) by The Health and Social Care Information Centre (Transfer of Functions, Abolition and Transitional Provisions) Regulations 2023 (S.I. 2023/98), reg. 1(2), Sch. para. 20 (with reg. 3)

[^key-edcda9a310fb95ba168f7aa1cb086887]: Sch. 8 para. 5 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-edf909958009b94eaba7a07f5cb7d3ab]: Sch. 19 para. 374 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-ee309db6643b4037ea2a506821cd0818]: Sch. 20 para. 3 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-ee5edfdcab0ee7308291688f5d50b0d9]: S. 44(4)(d) omitted (5.9.2025) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 88(3)(a), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

[^key-ee7439cfb2782d7a6babfbccedd14a04]: Words in s. 164(1) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 100(8)(a), 142(1); S.I. 2026/82, reg. 2(s)

[^key-ee8d24ff7579d381bcf3447e849bb137]: Sch. 19 para. 303 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-ee913b1171c2f96081016642901d4393]: Sch. 7 para. 37 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-eecbeef6e50cfe3fc02d1b95f68648e7]: Sch. 19 para. 86 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-ef34a89ba28c172143123866dc86ac69]: Sch. 19 para. 307 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-ef6078ac24fc77609c82e05a80eb24d7]: Words in s. 15(2)(d) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(6)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-ef6461538bedabe292afcef4ceaeb7e6]: Sch. 19 para. 284 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-ef69a37372aa6c408b351020173dbdf9]: Sch. 15 para. 4 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-efeacacfef60e8ff1a67439770fe3b48]: Sch. 9 para. 4 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^key-efefe38304f75aba67a62c87caf4f25e]: Sch. 15 para. 17 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-f00075df90a95ee9a8cd7964240bac16]: Sch. 7 para. 57 inserted (5.1.2026) by Border Security, Asylum and Immigration Act 2025 (c. 31), ss. 11, 65(1) (with s. 10); S.I. 2025/1318, reg. 2(a)

[^key-f01cfdd076622c51d98828fe590750f4]: Sch. 19 para. 73 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-f06182bbe328e7cc054e5f63e790a846]: Sch. 21 para. 12(2) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(9)(c) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-f06c433a1f0d3269ad70e332bbfc3adf]: Word in s. 182(8) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 22(5)(b) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-f07eab9e4a9bf6d612d592a97af71a89]: Sch. 19 para. 159 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-f106395db15e7bf5a355770eae3d3f6a]: Sch. 19 para. 329 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-f122f0c0c7045d69f3934a6b984c03c8]: Sch. 19 para. 195 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-f13bf41e503097cc8d4107dadef0c470]: Sch. 19 para. 375 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-f13e34f57b68b2f3aa30277188bfcc15]: Sch. 1 para. 10 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-f158013ab7dd597af9cb241fc75b8456]: S. 53(6)(7) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 75(2)(c), 142(1); S.I. 2026/82, reg. 2(g)

[^key-f1ea12c4ad88d4f388ce1587dd4bb8fa]: Sch. 19 para. 116 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-f21be6bd9397adb6cb7d1ab807fe908e]: S. 182(4) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 22(2) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-f251ec0fb7d1f9d415237244a6167b7b]: Sch. 19 para. 237 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-f26231d3616eb287b3ee33c4cae88815]: Words in Sch. 20 Pt. 3 heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 101(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-f2630d51dd1163fd5db4e508baac724b]: Words in s. 94(14) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 76(7)(a), 142(1); S.I. 2026/82, reg. 2(h) (with reg. 4)

[^key-f287d086a4e8e739fe2ef37b6accb6d4]: Sch. 20 para. 36 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-f2cee165d9a934aed6aaf388aefae5c2]: Sch. 21 para. 9(4)(aa) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(6)(c) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-f2da6f3a2b23afc935273439d0cf1789]: Words in s. 15(2)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(4)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-f2e7bbf27eee985d9a2bb76f58d3deb1]: Sch. 19 para. 219 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-f34b44dec21e9a4484c77b8fbc58e937]: Sch. 20 para. 40 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-f3538c932d11050dee0f2e1eb61020d3]: Words in s. 11(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 14 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-f355423658395e822e4494dd0c757c36]: Word in s. 73(1)(a) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 3(3)(b); S.I. 2026/82, reg. 2(z10)

[^key-f36da07bc6957dc9cf0e7e6dcb8769d0]: S. 116(A1) inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 48(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-f36e3f8d2e9c3f68d669cb6b0bbd97d6]: Sch. 7 para. 3 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-f372ec304285c90f7943306b4b88d34f]: Sch. 19 para. 16 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-f3c33a1b55881622df1ea41ec30cb96c]: Sch. 1 para. 37 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^key-f3f9b2e5f89457aeaa4f41a30c82f461]: Sch. 7 para. 41 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-f43a6187e9bc6e537dc0ba0627f09cc0]: Words in s. 83(2) substituted (17.11.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 90(4)(c), 142(1); S.I. 2025/996, reg. 2(2)(b)

[^key-f43ca2a3521eaade711bc4bf7677fd8d]: Words in s. 209(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 88 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-f47223315e48d2332450a35ce52125d7]: S. 184(4)(a)(b) substituted for words (1.4.2025) by The Disclosure (Scotland) Act 2020 (Consequential Provisions and Modifications) Order 2025 (S.I. 2025/423), art. 2(1), Sch. 2 para. 3(2)

[^key-f4979cce47b9db75cf9c23da4f9fa151]: Words in s. 149(4)(c) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 61 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-f49a68891d68ece6c5bea29963860fb9]: Words in s. 54(2) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 76(6)(b)(ii), 142(1); S.I. 2026/82, reg. 2(h) (with reg. 4)

[^key-f4afc6d6129e6908fd5ea3cb69bb36df]: S. 28(5) inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 36(5) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-f4bf067041e8f9f8848359b6b4e202b0]: S. 207(3) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 87(5) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-f553e60aef4a123f0721442edebd1dcf]: S. 172 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-f583eaf405e87a78ff32fe446bbd4660]: S. 55(1)(e) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 84(2), 142(1); S.I. 2025/904, reg. 2(d)

[^key-f58654c59abfc48179fb052b3bb3eb5c]: Words in s. 87(1)(b) substituted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 71(9)(b)(ii), 142(1); S.I. 2026/82, reg. 2(d)

[^key-f5f2be2d52fde50a90249c3696ee9e5c]: S. 207(6) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 87(7) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-f61b1c41d1ef400486d9a7c32e3ef26b]: Sch. 16 para. 5 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-f6981cb83d7c96ee86796f35063db417]: S. 186(3)(c) omitted (20.8.2025) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 106(4)(d)(ii), 142(1); S.I. 2025/904, reg. 2(k)

[^key-f75032a14bb0c5fa124d986aadfb4ead]: Words in s. 78(6) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 10(9)(b); S.I. 2026/82, reg. 2(z10)

[^key-f78da6f023a80509141fa555013b5b91]: Act modified (23.5.2019) by The Buckinghamshire (Structural Changes) Order 2019 (S.I. 2019/957), arts. 1, 15(2)

[^key-f7d821b6c7a960f9c5c64c3d1877b6db]: Words in s. 76(3) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 7(7); S.I. 2026/82, reg. 2(z10)

[^key-f838d49e21c426886f987f4284f2defe]: Words in Sch. 3 para. 12(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(14) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-f87d6b233ea8a6202e701a03a1004ec7]: Words in s. 97(1)(a) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 80(5)(a), 142(1); S.I. 2026/82, reg. 2(j) (with reg. 5)

[^key-f89e2d4a625a493b7c0cd20626e0b437]: Words in Sch. 3 para. 19 cross-heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(16) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-f9037392e04ce91d10ca238c50493e35]: Sch. 7 para. 21 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-f96988967581766c70c8c1dec2b2775e]: Sch. 16 para. 8 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^key-f97a9a1810af918b554cccf9af5908b8]: Sch. 19 para. 345 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-f97af0b42168a85cdcc3daab4547ff7f]: Sch. 20 para. 30 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-f9e750f4945678cf8a4558a867d56cf2]: Sch. 19 para. 389 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-f9ed19a4487f8b68c8c2886e208463fe]: Sch. 20 para. 17 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-fa356a2624ede25a37981cc83a5ee715]: Words in Sch. 2 para. 2(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(6)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-fa38f60b5d4f99f26df799872e6cdbe5]: Words in s. 115(9) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 47(10) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-fa4e7554d445d66534e30acb6686394b]: S. 94(14A)(14B) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 76(7)(b), 142(1); S.I. 2026/82, reg. 2(h) (with reg. 4)

[^key-fa62a71a5dc3350beb4ec0c525bfbdb3]: S. 26(2)(f)(ai) inserted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(2), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

[^key-fa7ac0a67482002a01f5620160e274c2]: S. 74B(1)(2) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 5(3); S.I. 2026/82, reg. 2(z10)

[^key-faa82338427aa33729b4502a5d841e1d]: Sch. 19 para. 266 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-fb61e29e24493921fc39e369e4a42620]: Sch. 19 para. 357 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-fb62be53b81ea9c5ea693e1e273be2bb]: Sch. 1 para. 23(3)(ha) inserted (E.W.) (26.12.2023) by Levelling-up and Regeneration Act 2023 (c. 55), s. 255(2)(c), Sch. 4 para. 217 (with s. 247)

[^key-fb676c41b528ba898415453b8d0f7a90]: Sch. 19 para. 182 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-fb7b533febf48a686748772dc38e418b]: Words in Sch. 3 para. 21(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 93(21) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-fbb4408f502b5114f297c415f831874e]: Sch. 18 para. 4(2)(f) inserted (17.12.2021) by The Age of Criminal Responsibility (Scotland) Act 2019 (Consequential Provisions and Modifications) Order 2021 (S.I. 2021/1458), arts. 1(1), 8(a)

[^key-fc33832f82a4075d15e37423f9a081a3]: S. 125(2) omitted (20.8.2025) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 11 para. 19(2); S.I. 2025/904, reg. 2(y)

[^key-fc59486e66036027803653a12bf23594]: S. 118 heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 50(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-fc6a8eec58cbdca916769f66c1fcf95d]: Sch. 19 para. 209 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-fca3b1b0c73fcd872e13405824270f8e]: S. 194 in force at 23.7.2018 by S.I. 2018/625, reg. 3(k)

[^key-fcf261b8f1782b32726129a6c66bdebd]: Words in s. 15(5) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(12) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-fd0986f7738e6fad0a16aeb00a034882]: Sch. 19 para. 155 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-fd0c1206a5d534731177f0955c0cc52b]: Sch. 19 para. 173 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-fd5a56238fd323f3236b1441a0713b63]: Words in Sch. 2 para. 6 substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(11) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-fdbc640373aa15e11b3c435f27bfb9a5]: Sch. 19 para. 98 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-fdc3238a0e9e132b97466766f336017c]: Sch. 21 para. 6(2) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 9 para. 25(4)(b) (with Sch. 9 Pt. 2); S.I. 2026/82, reg. 2(z11)

[^key-fdd11964dd5f70e3e98b54f18f45480b]: Words in s. 44(5) inserted (5.9.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 88(3)(b), 142(1); S.I. 2025/996, reg. 2(1)(b) (with reg. 4)

[^key-fde9fcf105d0042f1bda9820bf84606a]: Sch. 19 para. 112 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-fe7a3308baf800ac52f925c05dae0942]: S. 24(2)(d) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 32(3)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-fe8ced2c1696c5a472a770ed18c245f4]: S. 192 in force at 23.7.2018 by S.I. 2018/625, reg. 3(i)

[^key-fea2840db43536e89fbad12e76ee7857]: Sch. 12 para. 11 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

[^key-fed272c8d1c4b1280f93db05392dbbfd]: Sch. 7 para. 22 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-fee6c5c48bc9780e4333e44e43bc9ef0]: Sch. 13 para. 1(1)(i) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 97(2)(d) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-fef37e8482c3f3bf900f2bc9a1255f17]: Sch. 19 para. 74 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-ff22ac74c2a5beddde84ab38a67d210a]: Words in Sch. 13 para. 1(1)(e) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 97(2)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^key-ff454fa84136ab51d3f46aa48bc8ca42]: Words in s. 74B(6)(a) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 8 para. 5(7)(b); S.I. 2026/82, reg. 2(z10)

[^key-ff63110f11b2b9882390f31a36181e9a]: Sch. 19 para. 80 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^key-ff84a0a5b654d268377d223457dbe16d]: S. 116(1)(a) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 48(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^M_C_704d53e5-8ea8-4eef-b22d-7f7de6543231]: Pt. 5 applied in part (with modifications) by S.I. 2016/696, Sch. 2 (as substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 406 (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g) (with reg. 4))

[^M_C_c0980dbb-b7ee-4cd8-b06a-ea02c9cd8f3e]: Pt. 7 applied in part (with modifications) by S.I. 2016/696, Sch. 2 (as substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 406 (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g) (with reg. 4))

[^M_C_ce3cf4c2-3ef4-4e50-f9bc-ae0fefe190e5]: Pt. 6 applied in part (with modifications) by S.I. 2016/696, Sch. 2 (as substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 406 (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g) (with reg. 4); and as amended (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 105, 142(1); S.I. 2026/82, reg. 2(u))

[^M_C_ef5e908b-c77b-46e7-eca0-1c165fc65218]: S. 13 applied by S.I. 2015/1945, reg. 15(1) (as substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 387(2) (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g))

[^M_F_5eeae256-e644-4456-e6ea-16064ca931c7]: S. 94(2A) inserted (retrospective to 1.1.2024) by Data (Use and Access) Act 2025 (c. 18), ss. 78(4)(5), 142(2)(b)

[^M_F_632f0eda-c0f5-4c2b-c0fd-854fd7b0c9b7]: S. 45(2A) inserted (retrospective to 1.1.2024) by Data (Use and Access) Act 2025 (c. 18), ss. 78(3)(5), 142(2)(b)

[^M_F_67d8e6aa-9733-4c7b-881b-d3d7b3710a92]: S. 56(4) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 84(3), 142(1); S.I. 2025/904, reg. 2(d)

[^M_F_95b495a9-bbd2-4a4d-d703-ea7c74d70465]: S. 59(7A) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 84(4), 142(1); S.I. 2025/904, reg. 2(d)

[^M_F_d572f402-2b66-4807-ea89-c9fa6447e306]: Words in s. 207(7) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 87(8) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[^M_F_dd2a1277-a0f9-4a09-8bfa-fa41e3d1758a]: S. 199(1) omitted (5.2.2026) by virtue of The Data (Use and Access) Act 2025 (Consequential and Other Amendments) Regulations 2025 (S.I. 2025/1331), regs. 2(2), 3; S.I. 2026/82, reg. 2(s)

[^M_I_001184dc-ddbe-45f4-bebc-3ba7048d50bc]: S. 17 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_00c31825-5cfe-4783-9f84-25a44cf57ad7]: S. 138 in force at 25.5.2018 in so far as not already in force by S.I. 2018/625, reg. 2(1)(e)

[^M_I_01c79242-e11a-4de6-89be-22106b74fbb8]: S. 73 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_02552604-33ae-4f0d-9b1c-3860f21b83b5]: S. 92 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^M_I_02957c04-4ec2-4b55-f033-8049c2809d96]: S. 5 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_02df47a5-2247-46d6-a7cf-bf57ddd734ed]: S. 183 in force at 25.5.2018 in so far as not already in force by S.I. 2018/625, reg. 2(1)(g)

[^M_I_052d410d-a4da-48f9-e8a4-126c4f6c971d]: S. 170 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^M_I_0540997b-4e51-47d5-e2c2-f361a535020a]: Sch. 5 para. 4 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_058f5ee4-0c32-422e-d9f3-b212d036db5e]: S. 141 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

[^M_I_06b96688-7c53-468d-c866-e9a1041b7743]: S. 78 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_081cd2df-3e5a-48e3-eb7d-b50353ce04d1]: Sch. 2 para. 11 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_08786450-6023-452f-d34a-08a002a907dd]: S. 87 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^M_I_08c3cc03-d1fe-4cbc-c1d5-def8fafeb216]: S. 132 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

[^M_I_09139abf-9e2b-492e-abb0-a5b57cc064f4]: S. 149 in force at 25.5.2018 in so far as not already in force by S.I. 2018/625, reg. 2(1)(f)

[^M_I_0aab0745-8612-4dd8-bc21-471c8ce93916]: S. 153 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^M_I_0e52a826-4207-49b4-f991-9c54dcab8669]: S. 53 in force at 25.5.2018 in so far as not already in force by S.I. 2018/625, reg. 2(1)(c)

[^M_I_0f364f3e-6f4a-44aa-dd8f-0a98567a9bf9]: S. 202 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^M_I_0f49d291-8dc5-4fb9-8b43-8f905ca39aa8]: S. 6 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_10e78792-3248-45d1-f90b-fb5d0e8b5e88]: S. 10 in force at 25.5.2018 in so far as not already in force by S.I. 2018/625, reg. 2(1)(b)

[^M_I_121a1e60-73cd-4cca-c7fe-190c0ea7fe2c]: Sch. 13 para. 3 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

[^M_I_1431e3f7-9d76-474d-d4be-f3e845bb4da3]: S. 214 in force at Royal Assent, see s. 212(2)(e)

[^M_I_1521588a-7d32-42bf-8bdd-f3cf5940e5ca]: Sch. 2 para. 1 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_1574309e-0fb7-417d-d1d4-23e96c23545f]: S. 64 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_1576d3fb-ced4-4d34-ec38-bcec573f1813]: Sch. 2 para. 26 in force at 25.5.2018 in so far as not already in force by S.I. 2018/625, reg. 2(1)(b)

[^M_I_16855a45-e444-4356-a88e-7307bc6bca55]: S. 4 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_1d2e6766-13b4-4382-84f7-83d00c20fff0]: S. 21 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_1dd6f40b-6c26-4df4-ac0b-b87a0c97b98d]: S. 207 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^M_I_1f1683ef-67fd-402d-f360-a6484a761b03]: S. 136 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

[^M_I_1fbf4d26-7d75-4c01-ffac-2c67de207080]: S. 152 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^M_I_20e5dcba-2a1d-4359-aac2-ad45a251cc65]: Sch. 4 para. 1 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_222d6b89-8e89-402f-8222-65a1dea300f6]: Sch. 2 para. 2 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_2379c414-c179-41f5-8cd2-f26aad3a1969]: S. 59 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_24a7b7bc-8af3-4f9c-ad98-eeaa94929a3b]: S. 100 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^M_I_25166470-99f6-4e01-e8f1-2ad0e67c766a]: S. 165 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^M_I_28822e5a-7910-498b-b1e2-072272c03889]: S. 187 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^M_I_2d9df10b-98d2-4b7a-d660-77cd9369a5d3]: Sch. 1 para. 1 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_2e29e5e1-8c41-46fc-a235-4e7cf9f16ca8]: Sch. 1 para. 39 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_2f511f10-665b-4eb9-911a-9604ed4518ed]: S. 208 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^M_I_30b536c2-931a-4411-f791-891af74cdfba]: S. 186 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^M_I_31363d8d-9c84-4ec2-bbd8-9aaefc6a07cb]: S. 156 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^M_I_327359b9-6ecb-4ac3-b923-ade6d6b62764]: S. 42 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_33219849-c838-46d4-a646-d79f1a433a5b]: S. 43 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_34b2fbf2-1e4a-4d07-d099-1a38465186af]: S. 174 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^M_I_34e0f2d9-f333-43c2-9bd6-92eeb4ab691c]: Sch. 2 para. 25 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_3501de68-dfbc-42d0-a589-dfc6c8230757]: S. 185 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^M_I_372475c2-f786-4737-b481-aead1aa9c3ab]: S. 169 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^M_I_37607f0c-b0d9-437c-c58a-100c9591e505]: S. 95 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^M_I_391b74dc-ff38-40f0-dbeb-d4d0a0c497ae]: S. 15 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_39340472-b308-446c-f416-de36a113b1c3]: S. 71 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_39e992cb-6d25-40c1-ac0f-058943860288]: S. 203 in force at 25.5.2018 in so far as not already in force by S.I. 2018/625, reg. 2(1)(g)

[^M_I_3a0cba3d-d7ac-4e80-ee7b-7c72f2e50667]: S. 171 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^M_I_3b119613-0c1d-4708-9579-efd2c6d18f67]: S. 213(3) in force at 25.5.2018 in so far as not already in force by S.I. 2018/625, reg. 2(1)(g)

[^M_I_3c008b41-f8d1-4af2-c173-ac86397f789e]: S. 205 in force at Royal Assent, see s. 212(2)(c)

[^M_I_3c42d1bb-45b0-432b-c134-e3b599ff9254]: Sch. 3 para. 6 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_3c6a5414-f0bd-4366-fccb-1d6058877e27]: S. 137 in force at 25.5.2018 in so far as not already in force by S.I. 2018/625, reg. 2(1)(e)

[^M_I_3e451190-f0c7-43b2-d2d7-28b88e307c39]: Sch. 3 para. 2 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_3eb6811f-559e-49b4-b278-71c8bc5c9274]: S. 83 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^M_I_3ed2e15f-1eb7-4d90-e4d8-d26085739fbe]: S. 32 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_3f2dff73-cf74-4ec2-b84f-44e3562c005e]: S. 150 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^M_I_3f872866-06d2-4431-ac57-220c7b048d4c]: S. 63 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_3fdbc701-24a4-4f5e-8c4e-72eb7c51289b]: S. 28 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_42dc6850-6533-4b7e-e2cf-6b6c5fb4f747]: Sch. 1 para. 41 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_4469aa8f-c4ad-44c4-86cf-51dfe216cf18]: S. 151 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^M_I_457ae041-da77-46a3-d696-f4a38d15111e]: Sch. 1 para. 4 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_4980a4df-9065-411f-8d52-22ed992ade58]: S. 27 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_4c598a02-f07f-4955-c51b-f55c7e310fb5]: S. 90 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^M_I_4e625dca-ee3f-4024-dc84-bf345f2b6fe0]: S. 114 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

[^M_I_4f1080c2-21a7-4c82-a89d-e7adfbd426fc]: Sch. 3 para. 11 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_536accb5-c56e-4c05-9321-92e7d2337856]: S. 131 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

[^M_I_5532b144-5184-4c2c-fac1-a8163905e00c]: Sch. 5 para. 6 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_567c4630-0496-412d-a23f-202d19bddefa]: Sch. 17 para. 1 in force at 23.7.2018, see s. 212(3)(d)

[^M_I_57447cf7-8ba0-44f8-cfaa-e84f882e8cb3]: Sch. 17 para. 4 in force at 23.7.2018, see s. 212(3)(d)

[^M_I_593f54de-1e08-4c3e-f3ef-64051cc8d266]: S. 179 in force at 23.7.2018, see s. 212(3)(e)

[^M_I_59507319-9aa1-4a5c-ac20-f136b7a16ed9]: Sch. 3 para. 19 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_5ac45927-8647-4884-f5fd-427e5e0afe77]: Sch. 3 para. 5 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_5b228de6-605b-4834-9a81-b844135e2a47]: Sch. 1 para. 23 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_5cfac277-dd58-4090-a5d4-d01c3206f604]: S. 45 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_5cff7ca7-5185-44a0-80a7-3edfa76b406e]: S. 13 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_5d7d1c41-5513-4c30-a5e3-a6742f62188f]: S. 143 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^M_I_5d97a9f6-9446-4bef-ef73-af80493561f2]: S. 16 in force at 25.5.2018 in so far as not already in force by S.I. 2018/625, reg. 2(1)(b)

[^M_I_5dd63e8c-7050-440c-ffbc-309ef77d1ea8]: Sch. 4 para. 2 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_5dde3a45-9cfb-4ac5-d29f-59b7cc0c5cc6]: S. 84 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^M_I_5f2b7364-a500-4bc5-8808-3acc657acdb2]: S. 173 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^M_I_5fece20b-b02a-4ab5-e6e2-55118404f6f8]: S. 180 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^M_I_6001f914-95f9-4acb-9746-21a3beccdfac]: S. 12 in force at 25.5.2018 in so far as not already in force by S.I. 2018/625, reg. 2(1)(b)

[^M_I_6129bc53-30fe-4987-b421-da8cd719e3ce]: S. 201 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^M_I_62c67ce5-a2dd-494a-9ee1-9f07c9499112]: S. 122 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

[^M_I_6537d08e-b9ed-4eef-e7da-07245fa6f534]: Sch. 2 para. 12 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_65d310f2-daa6-4635-ef8b-9b4d9f30fef9]: S. 62 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_6927ea01-1dd8-471d-d354-6d65ef9e17ea]: Sch. 20 para. 50 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^M_I_6a194b3a-8c27-4fd1-cd4c-62fef9e77291]: S. 120 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

[^M_I_6ad9a872-b68b-4e05-f1b5-92db9c6d0ff9]: Sch. 4 para. 5 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_6b25091d-f95a-49dc-af77-daa527fdefdc]: Sch. 17 para. 2 in force at 23.7.2018, see s. 212(3)(d)

[^M_I_6cd0a813-77e1-4596-c329-d593cdd2dbf1]: Sch. 3 para. 21 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_6cd3ee9f-f812-4907-a50d-0987130ea669]: S. 88 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^M_I_6e331738-092a-40d0-93dd-2a952272df54]: S. 57 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_6e4ced79-902f-4770-e83a-88b5e6a453bb]: S. 106 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^M_I_704d1a2f-01f6-43d0-b29b-6c6f0d266fc1]: S. 198 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^M_I_71950d7e-e7f1-400d-9c57-0b88753b8e0c]: S. 61 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_71f9449e-04bd-4ecf-c35a-74de3baff40e]: Sch. 4 para. 4 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_7313d5f1-d03c-4749-c489-1b35781632bf]: S. 116 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

[^M_I_7479f073-2b58-49f7-eead-ccd6b6136180]: S. 101 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^M_I_747e79f4-6fdf-44ee-990d-39b4e75d805e]: S. 86 in force at 25.5.2018 in so far as not already in force by S.I. 2018/625, reg. 2(1)(d)

[^M_I_74c7c8a7-9076-4400-ae7b-7ad3a58732e1]: S. 25 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_75071e78-a5cb-478a-fa3d-66d25657b076]: S. 7 in force at 25.5.2018 in so far as not already in force by S.I. 2018/625, reg. 2(1)(b)

[^M_I_76d1e4f8-9926-4de2-b335-e4d438edb989]: Sch. 1 para. 2 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_76da4643-8e05-4859-98a5-b82748f4a71d]: S. 81 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_77433870-fe51-4301-8ff2-9116afefa523]: S. 36 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_790341d6-a730-4825-e4e6-b3e84cad95a1]: S. 82 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^M_I_79a2e3de-32a3-47c6-dda7-6b7747943801]: S. 178 in force at 23.7.2018, see s. 212(3)(d)

[^M_I_79c91ef1-9e52-4174-d7df-1e4ebb635fb1]: S. 129 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

[^M_I_7e22bcd2-6790-4c27-f846-8a797b1d9af6]: S. 75 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_801a1b0a-c984-4f73-8ba2-f8e1aded63a1]: S. 51 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_81571ff7-69ee-497b-8b80-fa5821132c00]: S. 142 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^M_I_823d7c60-4c49-4046-d084-63e3c878f220]: S. 8 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_82c6bc0d-d6c8-4662-fcf6-6abbc290f7b3]: S. 139 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

[^M_I_85c6af85-3c5b-4fbd-c7b8-108ae565afaa]: S. 124 not in force at Royal Assent; s. 124 in force at 23.7.2018, see s. 212(3)(a)

[^M_I_8683177b-98ef-4022-ab04-ccc580bc3b1d]: S. 155 in force at 25.5.2018 in so far as not already in force by S.I. 2018/625, reg. 2(1)(f)

[^M_I_881dda53-b717-425e-8142-f7976a8174ac]: S. 1 in force at Royal Assent, see s. 212(2)(a)

[^M_I_88b1f4ff-8813-4b5e-b9a5-ae521fbe2d3d]: S. 52 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_88b3c1b8-12f9-4400-fad2-2beaaa55d5d8]: S. 56 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_8ae9281f-1097-4ee9-f76f-cd8d2525eaf6]: S. 157 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^M_I_8b28819f-21e9-42ca-ceee-9cc24642e1b9]: Sch. 18 para. 3 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^M_I_8b635f20-89f5-477b-c0d5-4573b279e85c]: S. 206 in force at Royal Assent, see s. 212(2)(c)

[^M_I_8c4e8eb0-b9be-4aad-a48e-efa68a2db249]: S. 134 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

[^M_I_8d05751c-7143-47de-bcd1-a3b12c1ad737]: S. 215 in force at Royal Assent, see s. 212(2)(e)

[^M_I_8ffde057-b2ea-4c81-f8a2-5e4ab1649225]: S. 31 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_914e676a-4978-4c72-c25a-93ef98860f67]: S. 210 in force at Royal Assent, see s. 212(2)(d)

[^M_I_91518b62-ba84-4e47-8efb-1caae5146c11]: S. 118 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

[^M_I_9278b394-0992-4b27-bae4-d00400b4d831]: S. 135 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

[^M_I_9319e916-ac87-4c59-8966-b78ac4d7c085]: S. 38 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_9504db77-a6a3-4319-cd7f-6718d98acc5e]: S. 115 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

[^M_I_951502fa-9a2b-40d8-d4ce-01c07b097405]: S. 85 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^M_I_95a2e458-7d97-4c0c-d3e1-9597b82c7433]: S. 159 in force at 25.5.2018 in so far as not already in force by S.I. 2018/625, reg. 2(1)(f)

[^M_I_9804b0d5-f37d-4150-cd3c-319757236e8d]: S. 167 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^M_I_9951b2ec-9217-4fc3-95b1-addd36ccf015]: S. 97 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^M_I_9b03e9ed-2411-4cba-9edd-c070b61a84dd]: S. 94 in force at 25.5.2018 in so far as not already in force by S.I. 2018/625, reg. 2(1)(d)

[^M_I_a0eafee7-b1a2-4679-980c-920a0708b921]: S. 212 in force at Royal Assent, see s. 212(2)

[^M_I_a2d52cf4-c053-479c-c668-54966a9a7c22]: S. 181 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^M_I_a5399a90-4a75-4c74-8cec-23321c0d3fd7]: S. 3 in force at Royal Assent, see s. 212(2)(a)

[^M_I_a5d31172-3333-4d92-cb20-64b812344a40]: S. 121 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

[^M_I_a5f292bd-7e59-4888-837d-a728629d45a7]: Sch. 4 para. 3 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_a7b85df0-21b3-4b80-eb4c-29019ab49964]: S. 24 in force at 25.5.2018 in so far as not already in force by S.I. 2018/625, reg. 2(1)(b)

[^M_I_a875bc54-5a88-4079-b1a7-42f2b60fce36]: S. 130 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

[^M_I_ab2d64c7-b166-45cf-842d-36ad8f908e2c]: S. 117 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

[^M_I_ac809192-b0ed-46f9-a62f-0f0de7957e50]: Sch. 18 para. 4 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^M_I_ada71e33-07ba-4f0f-b434-a6f29f070716]: S. 34 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_ae1d0dcc-6b09-429f-811e-2060266818a4]: S. 46 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_aec3683b-69c6-440f-846b-8b8313671bf5]: S. 69 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_aecdacc1-8de8-41fe-c6cc-6112170429ed]: S. 182 in force at royal Assent, see s. 212(2)(b)

[^M_I_af26b735-43a6-4688-d21f-f9bd1cba69c5]: S.65 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_af7cd330-6e0e-46b0-959b-43e0629e5b85]: S. 29 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_afff2c96-a61d-45a1-9697-c158ca44e9bb]: S. 39 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_b0c5485c-7f92-431a-89b0-c2732c0cad58]: Sch. 5 para. 1 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_b201d095-3f70-45b4-bcb5-b8532434c8c3]: S. 76 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_b309e3cd-87fd-499e-e10a-8fcbdb13e144]: Sch. 17 para. 3 in force at 23.7.2018, see s. 212(3)(d)

[^M_I_b374618b-16d6-4d87-a6f2-861983f24085]: S. 70 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_b41aa1df-b4ef-4d59-aa1e-3231f2ac52c0]: Sch. 3 para. 20 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_b508ce3f-d940-4150-ad62-23f86f38b8e6]: S. 177 in force at 23.7.2018, see s. 212(3)(c)

[^M_I_b67c4109-933e-4919-ceba-5e061b4d1a4c]: S. 26 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_b7567b75-8af2-4940-a45e-066c4b97aad9]: Sch. 18 para. 5 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^M_I_b816fd11-02d6-4987-c11f-0d83ef14b625]: S. 66 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_b95b6920-026f-4737-9af1-834d885f9073]: Sch. 2 para. 4 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_b96af367-24b4-4dc8-b449-1b4d146a45be]: Sch. 3 para. 17 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_bbfafeaf-251f-4c63-a3fa-3a94ee9d5627]: S. 77 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_bc96b136-0fac-464a-9d2c-66928756f962]: Sch. 2 para. 16 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_bd2610c7-1c20-44bd-bd54-f7cec50cefdf]: Sch. 2 para. 20 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_bd3c94e7-fdb6-4e2b-d809-a216b5858fdf]: S. 197 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^M_I_bda4ce16-7f3c-4e8b-e70c-4e6ca89870e7]: S. 40 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_be21f886-50bc-4cee-c077-68024050f541]: S. 89 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^M_I_bf3711a7-f203-49fa-ba50-dc4a9245ae9a]: S. 60 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_bf754d04-725e-47e5-c2fe-e6a885c6ab5f]: S. 98 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^M_I_c01a7bb6-930f-48f0-8635-3493ff4a9711]: S. 213(1) in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^M_I_c1f33cf3-e662-4b89-ea75-a314be526ffa]: S. 48 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_c242106f-aec0-42e7-f82c-694506ebb5cb]: S. 54 in force at 25.5.2018 in so far as not already in force by S.I. 2018/625, reg. 2(1)(c)

[^M_I_c31292b9-3b55-4525-fc37-2e8b8ac3de16]: S. 119 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

[^M_I_c37eeacc-733b-4fd9-b03b-d8d029a82ea7]: Sch. 3 para. 1 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_c3ecc2f3-1e54-4634-b1c6-9e30f80388ab]: Sch. 2 para. 10 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_c4b1bc31-4297-4571-8e6c-379f07b22ce8]: S. 199 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^M_I_c5924cf3-6bec-4577-ae67-0fd578ee36d6]: S. 67 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_c853ced2-b522-4a39-9482-405217ecdbe7]: Sch. 2 para. 18 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_c9599237-f3b7-4742-8db0-d7e47ccf0bc5]: S. 204 in force at Royal Assent, see s. 212(2)(c)

[^M_I_c9efecfa-212d-48fe-915c-89c2c23bc21e]: Sch. 3 para. 8 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_cd6fe374-e332-4c0e-875f-aa4dc41075f6]: S. 68 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_ceb541c1-8cb6-4499-ecd5-6697f46331ba]: S. 209 in force at Royal Assent, see s. 212(2)(d)

[^M_I_cec05f16-9b5b-470b-ac33-a60370739aab]: S. 211 in force at 25.5.2018 in so far as not already in force by S.I. 2018/625, reg. 2(1)(g)

[^M_I_d0d73c42-8e30-469d-f331-baaea535f1cb]: Sch. 3 para. 7 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_d12995b4-0d48-4403-a1e6-4860af1c5761]: S. 30 in force in so far as not already in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_d2cfddfb-2465-4e45-adcb-81429283652b]: S. 168 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^M_I_d3fc4004-a877-407a-8153-3ccc2d14ad91]: Sch. 2 para. 6 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_d4e0fb9d-6ef7-4135-b67d-0ea7d2c25a58]: Sch. 18 para. 1 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^M_I_d69dd7f5-3ead-4b03-f72c-ff3b578ecd5b]: S. 55 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_d74e4721-9593-445e-c9b1-9870df442f1f]: Sch. 20 para. 18 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^M_I_d765c579-e863-4d87-e87a-47552f8f0930]: S. 35 in force in so far as not already in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_d7cf0043-ae6a-4697-de33-cdf539128035]: Sch. 2 para. 13 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_d8bf8ebd-5b17-40a5-d484-6165cc688e0f]: S. 96 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^M_I_da00e592-0ae8-4de3-8731-7adb2f7bc113]: S. 184 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^M_I_da01c4c2-f825-40ab-f69c-0d6e773451b9]: S. 2 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(a)

[^M_I_da07269f-db52-4980-a0c1-b39b712f7b3a]: S. 107 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^M_I_dbf566ba-d952-47d7-bc7b-5680d691f29a]: Sch. 2 para. 3 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_dcaef763-924e-4781-d81d-b11a8ad30472]: S. 33 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_dd2d81f5-ec2f-4277-e4c8-6dee20e72e31]: S. 11 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_e0e612ed-1ee3-42f6-ce07-e7e69f860bfc]: S. 166 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

[^M_I_e1c3ecd2-e265-426e-82eb-d847cb9cfe68]: S. 72 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_e27ca271-6da8-48a7-c4bb-7fd1cdf1d86a]: S. 41 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_e2a5d092-6e8a-4f38-c7b8-f59f831094c1]: S. 58 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_e449d474-a66a-41e2-eb50-e0b9d3cc4cf2]: S. 200 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^M_I_ea160988-028f-4a8b-9a09-9f3741dc5fe9]: S. 79 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_ef23244d-e6ce-4d81-fe87-8e68e4a1f316]: Sch. 13 para. 1 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

[^M_I_efe9e3d5-b2a4-42b5-9cde-33f394f571dc]: Sch. 3 para. 12 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

[^M_I_f1846588-44ae-4fac-d1f9-edbe1422eb8a]: S. 47 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_f6307649-dc46-4555-c8e1-53277a328689]: S. 44 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_f6b8d06c-a195-4339-ba67-6da913de9380]: S. 91 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^M_I_f7576ea7-8886-4705-ec43-bade7812bb41]: S. 140 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

[^M_I_f7c8792b-5c3b-472d-b608-e90d8d4ccd14]: S. 133 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e)

[^M_I_fa535b92-b84f-4c76-ca76-66cb9287babf]: S. 196 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

[^M_I_fc37a490-9fdd-4944-e768-4b107cf4c21d]: S. 99 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

[^M_I_fd61ef18-6fb5-4eb5-8aa6-e67333347875]: S. 37 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^M_I_ffacd87e-5a20-492e-de3c-99476f317c17]: S. 80 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)

[^key-8f2b2401a00979810a31b65e3185a134]: S. 13A inserted (E.W.) (31.3.2026) by Victims and Prisoners Act 2024 (c. 21), ss. 31(4), 81(2) (with s. 32); S.I. 2026/317, reg. 2

[^key-0e53649fe7127715ffc24ffc24bc0ea5]: S. 13A extended (S. and N.I.) (31.3.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 11 para. 32(b); S.I. 2026/317, reg. 3

[^key-0c2113f4e7b5a353dbe5dfefe87ffae7]: Sch. 19 para. 191 omitted (7.4.2026) by virtue of Employment Rights Act 2025 (c. 36), s. 159(3), Sch. 10 para. 90 (with s. 147, Sch. 11); S.I. 2026/323, reg. 4(1)(55)(e)

[^key-ce45bf3908add1b4e434190b665b2b07]: Sch. 19 para. 197 omitted (7.4.2026) by virtue of Employment Rights Act 2025 (c. 36), s. 159(3), Sch. 10 para. 90 (with s. 147, Sch. 11); S.I. 2026/323, reg. 4(1)(55)(e)

Limits on fees that may be charged by controllers

17A

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

17B

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

17C

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

National security and defence exemption

74A

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

74B

(1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(3) The Secretary of State must, on an ongoing basis, monitor developments in third countries and international organisations that could affect decisions to make regulations giving approval under section 74AA or to amend or revoke such regulations.

(4) Where the Secretary of State becomes aware that the data protection test is no longer met in relation to transfers approved, or of a description approved, in regulations under section 74AA, the Secretary of State must, to the extent necessary, amend or revoke the regulations.

(5) Where regulations under section 74AA are amended or revoked in accordance with subsection (4), the Secretary of State must enter into consultations with the third country or international organisation concerned with a view to improving the protection provided to data subjects with regard to the processing of personal data in the country or by the organisation.

(6) The Secretary of State must publish—

(a) a list of the third countries ... and international organisations, and the descriptions of such countries ... and organisations, which are for the time being approved by regulations under section 74AA as places or persons to which personal data may be transferred, and

(b) a list of the third countries ... and international organisations, and the descriptions of such countries ... and organisations, which have been but are no longer approved by such regulations.

(7) In the case of regulations under section 74AA which approve only certain transfers to a third country or international organisation that are specified or described in the regulations (in accordance with section 74AA(4)(b))—

(a) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(b) the lists published under subsection (6) must specify or describe the relevant transfers.

119A

(1) The Commissioner may issue a document specifying standard data protection clauses which the Commissioner considers are capable of securing that the data protection test set out in Article 46 of the UK GDPR or section 75 of this Act (or both) is met in relation to transfers of personal data.

(2) The Commissioner may issue a document that amends or withdraws a document issued under subsection (1).

(3) A document issued under this section—

(a) must specify when it comes into force,

(aa) may make provision generally or in relation to types of transfer described in the document,

(b) may make different provision for different purposes, and

(4) Before issuing a document under this section, the Commissioner must consult the Secretary of State and such of the following as the Commissioner considers appropriate—

(a) trade associations;

(b) data subjects;

(5) After a document is issued under this section—

(a) the Commissioner must send a copy to the Secretary of State, and

(b) the Secretary of State must lay it before Parliament.

(6) If, within the 40-day period, either House of Parliament resolves not to approve the document then, with effect from the end of the day on which the resolution is passed, the document is to be treated as not having been issued under this section (so that the document, and any amendment or withdrawal made by the document, is to be disregarded for the purposes of Article 46(2)(d) of the UK GDPR).

(7) Nothing in subsection (6)—

(a) affects any transfer of personal data previously made in reliance on the document, or

(b) prevents a further document being laid before Parliament.

(8) The Commissioner must publish—

(a) a document issued under this section, and

(b) a notice identifying any document which, under subsection (6), is treated as not having been issued under this section.

(9) The Commissioner must keep under review the clauses specified in a document issued under this section for the time being in force.

(10) In this section, “the 40-day period” means—

(a) if the document is laid before both Houses of Parliament on the same day, the period of 40 days beginning with that day, or

(b) if the document is laid before the Houses of Parliament on different days, the period of 40 days beginning with the later of those days.

(11) In calculating the 40-day period, no account is to be taken of any whole days that fall within a period during which Parliament is dissolved or prorogued or during which both Houses of Parliament are adjourned for more than 4 days.

(12) In this section, “trade association” includes a body representing controllers or processors.

SCHEDULE 21

Part 1 — Interpretation

Merger of the directly applicable GDPR and the applied GDPR

1

In this Schedule, “the applied GDPR” means the EU GDPR as applied by Chapter 3 of Part 2 before IP completion day.

Part 2 — Continuation of existing acts etc

2

(1) On and after IP completion day, references in an enactment to the UK GDPR (including the reference in the definition of “the data protection legislation” in section 3(9)) include—

(a) the EU GDPR as it was directly applicable to the United Kingdom before IP completion day, read with Chapter 2 of Part 2 of this Act as it had effect before IP completion day, and

(b) the applied GDPR, read with Chapter 3 of Part 2 of this Act as it had effect before IP completion day.

(2) On and after IP completion day, references in an enactment to, or to a provision of, Chapter 2 of Part 2 of this Act (including general references to this Act or to Part 2 of this Act) include that Chapter or that provision as applied by Chapter 3 of Part 2 of this Act as it had effect before IP completion day.

(3) Sub-paragraphs (1) and (2) have effect—

(a) in relation to references in this Act, except as otherwise provided;

(b) in relation to references in other enactments, unless the context otherwise requires.

3

(1) Anything done in connection with the EU GDPR as it was directly applicable to the United Kingdom before IP completion day, the applied GDPR or this Act—

(a) if in force or effective immediately before IP completion day, continues to be in force or effective on and after IP completion day, and

(b) if in the process of being done immediately before IP completion day, continues to be done on and after IP completion day.

(2) References in this paragraph to anything done include references to anything omitted to be done.

Part 3 — Transfers to third countries and international organisations

4

(1) On and after IP completion day, for the purposes of the UK GDPR and Part 2 of this Act, a transfer of personal data to a third country or an international organisation is to be treated as approved by regulations made under Article 45A of the UK GDPR if, at the time of the transfer, paragraph 5 specifies, or specifies a description which includes—

(a) in the case of a third country, the country or a relevant territory or sector within the country, or

(b) in the case of an international organisation, the organisation.

(2) Sub-paragraph (1) has effect subject to provision in paragraph 5 providing that only particular transfers to the country, territory, sector or organisation may rely on a particular provision of paragraph 5 for the purposes of sub-paragraph (1).

(3) The Secretary of State may by regulations—

(a) repeal sub-paragraphs (1) and (2) and paragraph 5;

(b) amend paragraph 5 so as to omit a third country, territory, sector or international organisation specified, or of a description specified, in that paragraph;

(c) amend paragraph 5 so as to replace a reference to, or description of, a third country, territory, sector or organisation with a narrower reference or description, including by specifying or describing particular transfers of personal data and making provision described in sub-paragraph (2).

(4) Regulations under this paragraph may, among other things——

(a) identify a transfer of personal data by any means, including by reference to the controller or processor, the recipient, the personal data transferred or the means by which the transfer is made or by reference to relevant legislation, schemes, lists or other arrangements or documents, as they have effect from time to time;

(b) confer a discretion on a person.

(5) Regulations under this paragraph are subject to the negative resolution procedure.

(6) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

5

(1) The following are specified for the purposes of paragraph 4(1)—

(a) an EEA state;

(b) Gibraltar;

(c) a Union institution, body, office or agency set up by, or on the basis of, the Treaty on the European Union, the Treaty on the Functioning of the European Union or the Euratom Treaty;

(d) an equivalent institution, body, office or agency set up by, or on the basis of, the Treaties establishing the European Economic Area;

(e) a third country which is the subject of a decision listed in sub-paragraph (2), other than a decision that, immediately before IP completion day, had been repealed or was suspended;

(f) a third country, territory or sector within a third country or international organisation which is the subject of an adequacy decision made by the European Commission before IP completion day on the basis of Article 45(3) of the EU GDPR, other than a decision that, immediately before IP completion day, had been repealed or was suspended.

(2) The decisions mentioned in sub-paragraph (1)(e) are the following—

(a) Commission Decision 2000/518/EC of 26th July 2000 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided in Switzerland;

(b) Commission Decision 2002/2/EC of 20th December 2001 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided by the Canadian Personal Information Protection and Electronic Documents Act;

(c) Commission Decision 2003/490/EC of 30th June 2003 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Argentina;

(d) Commission Decision 2003/821/EC of 21st November 2003 on the adequate protection of personal data in Guernsey;

(e) Commission Decision 2004/411/EC of 28th April 2004 on the adequate protection of personal data in the Isle of Man;

(f) Commission Decision 2008/393/EC of 8th May 2008 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Jersey;

(g) Commission Decision 2010/146/EU of 5th March 2010 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection provided by the Faeroese Act on processing of personal data;

(h) Commission Decision 2010/625/EU of 19th October 2010 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Andorra;

(i) Commission Decision 2011/61/EU of 31st January 2011 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by the State of Israel with regard to automated processing of personal data;

(j) Commission Implementing Decision 2012/484/EU of 21st August 2012 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by the Eastern Republic of Uruguay with regard to automated processing of personal data;

(k) Commission Implementing Decision 2013/65/EU of 19th December 2012 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by New Zealand;

(m) Commission Implementing Decision (EU) 2019/419 of 23rd January 2019 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by Japan under the Act on the Protection of Personal Information.

(3) Where a decision described in sub-paragraph (1)(e) or (f) states that an adequate level of protection of personal data is ensured only for a transfer specified or described in the decision, only such a transfer may rely on that provision and that decision for the purposes of paragraph 4(1).

(4) The references to a decision in sub-paragraphs (1)(e) and (f) and (2) are to the decision as it had effect in EU law immediately before IP completion day, subject to sub-paragraphs (5) and (6).

(5) For the purposes of this paragraph, where a reference to legislation, a list or another document in a decision described in sub-paragraph (1)(e) or (f) is a reference to the legislation, list or document as it has effect from time to time, it is to be treated as a reference to the legislation, list or other document as it has effect at the time of the transfer.

(6) For the purposes of this paragraph, where a decision described in sub-paragraph (1)(e) or (f) relates to—

(a) transfers from the European Union (or the European Community) or the European Economic Area, or

(b) transfers to which the EU GDPR applies,

it is to be treated as relating to equivalent transfers to or from the United Kingdom or transfers to which the UK GDPR applies (as appropriate).

6

(1) In the provisions listed in sub-paragraph (2)—

(a) references to regulations made under Article 45A of the UK GDPR (other than references to making such regulations) include the provision made in paragraph 5;

(b) references to the revocation of such regulations include the repeal of all or part of paragraph 5.

(2) Those provisions are Articles 13(1)(f), 14(1)(f), 45C, 49(1) and 49A(1) of the UK GDPR.

(3) In its application to transfers treated as approved by virtue of paragraph 1, Article 45C(5) of the UK GDPR (transfers approved by regulations: monitoring) has effect as if the reference to Article 45A(4)(b) were omitted.

7

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

8

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

9

(1) The requirement for safeguards to be provided under Article 46(1A)(a)(i) of the UK GDPR may be satisfied on and after IP completion day as described in sub-paragraphs (2) to (4), subject to sub-paragraph (5).

(2) The safeguards may be provided for by any binding corporate rules authorised by the Commissioner which, immediately before IP completion day, provided for the appropriate safeguards referred to in Article 46(1) of the EU GDPR by virtue of Article 46(5) of the EU GDPR.

(3) The safeguards may be provided for by a version of binding corporate rules described in sub-paragraph (2) incorporating changes where—

(a) all of the changes are made in consequence of the withdrawal of the United Kingdom from the EU , of provision made by regulations under section 8 or 23 of the European Union (Withdrawal) Act 2018 or of the amendment of Chapter 5 of the UK GDPR by the Data (Use and Access) Act 2025, and

(b) none of the changes alters the effect of the rules.

(4) The following changes are to be treated as falling within sub-paragraph (3)(a) and (b)—

(a) changing references to adequacy decisions made by the European Commission into references to equivalent provision made by regulations under section 17A or by or under paragraphs 4 to 6 of this Schedule;

(aa) changing references to provision made by regulations under section 17A into references to provision made by regulations made under Article 45A of the UK GDPR;

(b) changing references to transferring personal data outside the European Union or the European Economic Area into references to transferring personal data outside the United Kingdom.

(5) Sub-paragraphs (2) to (4) cease to apply in relation to binding corporate rules if, on or after IP completion day, the Commissioner withdraws the authorisation of the rules (or, where sub-paragraph (3) is relied on, the authorisation of the rules mentioned in sub-paragraph (2)).

(5A) For the purposes of sub-paragraph (2), binding corporate rules which, immediately before IP completion day, provided for the appropriate safeguards referred to in Article 46(1) of the EU GDPR by virtue of Article 46(5) of the EU GDPR but which were authorised other than by the Commissioner are to be treated as authorised by the Commissioner where—

(a) a valid notification of the rules has been made to the Commissioner,

(b) the Commissioner has approved them, and

(5B) A notification is valid if it—

(a) is made by a controller or processor established in the United Kingdom,

(b) is made to the Commissioner before the end of the period of 6 months beginning with IP completion day, and

(i) the name and contact details of the data protection officer or other contact point for the controller or processor, and

(ii) such other information as the Commissioner may reasonably require.

(5C) Where a valid notification is made the Commissioner must, without undue delay—

(a) decide whether or not to approve the rules, and

(b) notify the controller or processor of that decision.

(6) The Commissioner must keep the operation of this paragraph under review.

(7) In this paragraph—

“adequacy decision” means a decision made on the basis of—Article 45(3) of the EU GDPR, orArticle 25(6) of Directive 95/46/EC of the European Parliament and of the Council of 24th October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data;

“binding corporate rules” has the meaning given in Article 4(20) of the UK GDPR.

(8) This paragraph has effect in addition to Article 46(2) and (3) of the UK GDPR.

10

(1) On and after IP completion day, for the purposes of Part 3 of this Act, a transfer of personal data to a third country or an international organisation is to be treated as approved by regulations made under section 74AA if, at the time of the transfer, paragraph 11 specifies, or specifies a description which includes—

(a) in the case of a third country, the country or a relevant territory or sector within the country, or

(b) in the case of an international organisation, the organisation.

(2) Sub-paragraph (1) has effect subject to provision in paragraph 11 providing that only particular transfers to the country, territory, sector or organisation may rely on a particular provision of paragraph 11 for the purposes of sub-paragraph (1).

(3) The Secretary of State may by regulations—

(a) repeal sub-paragraphs (1) and (2) and paragraph 11;

(b) amend paragraph 11 so as to omit a third country, territory, sector or international organisation specified, or of a description specified, in that paragraph;

(c) amend paragraph 11 so as to replace a reference to, or description of, a third country, territory, sector or organisation with a narrower reference or description, including by specifying or describing particular transfers of personal data and by making provision described in sub-paragraph (2).

(4) Regulations under this paragraph may, among other things—

(a) identify a transfer of personal data by any means, including by reference to the controller or processor, the recipient, the personal data transferred or the means by which the transfer is made or by reference to relevant legislation, schemes, lists or other arrangements or documents, as they have effect from time to time;

(b) confer a discretion on a person.

(5) Regulations under this paragraph are subject to the negative resolution procedure.

(6) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

11

(1) The following are specified for the purposes of paragraph 10(1)—

(a) an EEA state;

(aa) Switzerland;

(b) Gibraltar;

(c) a third country, a territory or sector within a third country or an international organisation which is the subject of an adequacy decision made by the European Commission before IP completion day on the basis of Article 36(3) of the Law Enforcement Directive, other than a decision that, immediately before IP completion day, had been repealed or was suspended.

(2) Where a decision described in sub-paragraph (1)(c) states that an adequate level of protection of personal data is ensured only for a transfer specified or described in the decision, only such a transfer may rely on that provision and that decision for the purposes of paragraph 10(1).

(3) The reference to a decision in sub-paragraph (1)(c) is to the decision as it had effect in EU law immediately before IP completion day, subject to sub-paragraphs (4) and (5).

(4) For the purposes of this paragraph, where a reference to legislation, a list or another document in a decision described in sub-paragraph (1)(c) is a reference to the legislation, list or document as it has effect from time to time, it is to be treated as a reference to the legislation, list or other document as it has effect at the time of the transfer.

(5) For the purposes of this paragraph, where a decision described in sub-paragraph (1)(c) relates to—

(a) transfers from the European Union (or the European Community) or the European Economic Area, or

(b) transfers to which the Law Enforcement Directive applies,

it is to be treated as relating to equivalent transfers from the United Kingdom or transfers to which Part 3 of this Act applies (as appropriate).

12

(1) In sections 74B and 76(A1)—

(a) references to regulations made under section 74AA (other than references to making such regulations) include the provision made in paragraph 11;

(b) references to the revocation of such regulations include the repeal of all or part of paragraph 11.

(2) In its application to transfers treated as approved by virtue of paragraph 10, section 74B(7) (transfers approved by regulations: monitoring) has effect as if the reference to section 74AA(4)(b) were omitted.

Part 4 — Repeal of provisions in Chapter 3 of Part 2

13

(1) Regulations made under section 23 before IP completion day continue in force until they are revoked, despite the repeal of that section by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019.

(2) The provisions listed in section 186(3) include regulations made under section 23 before IP completion day (and not revoked).

(3) Sub-paragraphs (1) and (2) do not have effect so far as otherwise provided by the law of England and Wales, Scotland or Northern Ireland.

14

(1) This paragraph applies to a certificate issued under section 27 of this Act which has effect immediately before IP completion day.

(2) A reference in the certificate to a provision of the applied GDPR has effect, on and after IP completion day, as it if were a reference to the corresponding provision of the UK GDPR or this Act.

Part 5 — The Information Commissioner

15

The repeal of section 132(2)(d) by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 has effect only in relation to a disclosure of information made on or after IP completion day.

Part 6 — Enforcement

16

In relation to an infringement, before IP completion day, of a provision of the EU GDPR (as it was directly applicable to the United Kingdom) or the applied GDPR—

(a) Article 83(5) and (6) of the UK GDPR and section 157(5)(a) and (b) of this Act have effect as if for “£17,500,000” there were substituted “ 20 million Euros ”;

(b) Article 83(4) of the UK GDPR and section 157(6)(a) and (b) of this Act have effect as if for “£8,700,000” there were substituted “ 10 million Euros ”;

(c) the maximum amount of a penalty in sterling must be determined by applying the spot rate of exchange set by the Bank of England on the day on which the penalty notice is given under section 155 of this Act.

The applied GPDR

17

(1) This paragraph applies where—

(a) proceedings are brought against a decision made by the Commissioner before IP completion day, and

(b) the Commissioner's decision was preceded by an opinion or decision of the European Data Protection Board in accordance with the consistency mechanism referred to in Article 63 of the EU GDPR.

(2) The Commissioner must forward the Board's opinion or decision to the court or tribunal dealing with the proceedings.

Immigration: safeguards: immigration exemption decisions

4A

(1) A decision under paragraph 4(1) as to whether, and the extent to which, the application of the relevant UK GDPR provisions would be likely to prejudice any of the matters mentioned in paragraph 4(1)(a) and (b) (referred to in this paragraph as “an immigration exemption decision”) must be made in accordance with this paragraph.

(2) An immigration exemption decision must be made—

(a) on a case by case basis,

(b) separately in respect of each of the relevant UK GDPR provisions mentioned in paragraph 4(2)(a) to (f) which relates to the data subject, and

(c) afresh on each occasion on which the Secretary of State considers disapplying or restricting the application of any of the relevant UK GDPR provisions mentioned in paragraph 4(2)(a) to (f) in relation to the data subject.

(3) When making an immigration exemption decision, the Secretary of State must take into account all the circumstances of the case, including at least the following—

(a) any potential vulnerability of the data subject that is relevant to the decision,

(b) all the rights and freedoms of the data subject including the data subject’s Convention rights, and

(i) the United Kingdom’s obligations under the Refugee Convention and the Trafficking Convention,

(ii) any duty under section 55 of the Borders, Citizenship and Immigration Act 2009 (duty regarding the welfare of children), and

(iii) the need to ensure compliance with the UK GDPR.

(4) A decision that the application of a particular relevant UK GDPR provision mentioned in paragraph 4(2)(a) to (f) (or that provision in combination with the provision mentioned in paragraph 4(2)(g), so far as it applies) would be likely to prejudice any of the matters mentioned in paragraph 4(1)(a) and (b) may be made only if—

(a) the application of that provision or those provisions would give rise to a substantial risk of prejudice to any of the matters mentioned in paragraph 4(1)(a) and (b),

(b) that risk outweighs the risk of prejudice to the interests of the data subject concerned that would arise if the exemption in paragraph 4(1) were to apply in relation to that provision or those provisions, and

(c) the application of the exemption in relation to that provision or those provisions is necessary and proportionate to the risks in the particular case.

(5) In this paragraph—

“Convention rights” has the same meaning as in the Human Rights Act 1998 (see section 1(1) of that Act);

“the Refugee Convention” means the Convention relating to the Status of Refugees, done at Geneva on 28 July 1951, and its Protocol;

“the Trafficking Convention” means the Council of Europe Convention on Action against Trafficking in Human Beings, done at Warsaw on 16 May 2005.

Immigration: safeguard: record of decision that exemption applies

4B

(1) Where the Secretary of State makes a decision mentioned in paragraph 4A(4), the Secretary of State must keep a record of it and the reasons for it.

(2) Where sub-paragraph (1) applies, the Secretary of State must also inform the data subject of the decision unless, in the particular circumstances of the case, the Secretary of State considers that doing so may be prejudicial to any of the matters mentioned in paragraph 4(1)(a) and (b).

15A

The Provost Marshal for serious crime.

18A

The Service Police Complaints Commissioner.

The applied GPDR

GDPR: right to an effective remedy against the Commissioner

183B

(1) This section is about the relationship between—

(a) a pre-commencement enactment which imposes a duty, or confers a power, to process personal data, and

(b) a provision of the main data protection legislation containing a requirement relating to the processing of personal data.

(2) The relationship is not changed by section 5(A1) of the European Union (Withdrawal) Act 2018 (removal of the principle of supremacy of EU law) (or the repeal of section 5(1) to (3) of that Act).

(3) Where the provision described in subsection (1)(b) is a provision of, or made under, the UK GDPR, section 5(A2) of the European Union (Withdrawal) Act 2018 (assimilated direct legislation subject to domestic enactments) does not apply to the relationship.

(4) Nothing is to be implied about a relationship described in subsection (1) merely due to the fact that express provision with similar effect to section 183A(1) (or applying that provision) is made in connection with one such relationship but not another.

(5) In this section—

(a) “the main data protection legislation” and “requirement” have the same meaning as in section 183A, and

(b) “pre-commencement enactment” means an enactment so far as passed or made before 20th August 2025.

(6) Section 183A(5) applies for the purposes of subsection (1)(a) of this section as it applies for the purposes of section 183A(1).

186A

(1) This section is about the relationship between—

(a) a pre-commencement enactment which prohibits or restricts the disclosure of information or authorises the withholding of information, and

(b) a provision of the UK GDPR or this Act listed in section 186(2).

(2) The relationship is not changed by section 5(A1) of the European Union (Withdrawal) Act 2018 (removal of the principle of supremacy of EU law) (or the repeal of section 5(1) to (3) of that Act).

(3) Subsection (1) of section 186 does not apply to the relationship so far as there is a contrary intention, whether express or implied (taking account of, among other things, subsection (2) of this section).

(4) Nothing is to be implied about a relationship described in subsection (1) merely due to the fact that express provision stating that section 186(1) applies (or with similar effect) is made in connection with one such relationship but not another.

(5) In this section, “pre-commencement enactment” means an enactment so far as passed or made before 20th August 2025, other than an enactment contained in, or made under, a provision listed in section 186(2) or (3).

Protection of personal data

Relevant international law

9A

(1) Processing of personal data meets the requirement in Article 6(3), 8A(3)(e), 9(2)(g) or 10(1) of the UK GDPR for a basis in, or authorisation by, relevant international law only if it meets a condition in Schedule A1.

(2) A condition in Schedule A1 may be relied on for the purposes of any of those provisions, unless that Schedule provides otherwise.

(3) The Secretary of State may by regulations amend Schedule A1 by adding, varying or omitting—

(a) conditions,

(b) provision about the purposes for which a condition may be relied on, and

(4) Regulations under this section may only add a condition relating entirely or partly to a treaty ratified by the United Kingdom.

(5) Regulations under this section are subject to the affirmative resolution procedure.

(6) In this section, “treaty” and “ratified” have the same meaning as in Part 2 of the Constitutional Reform and Governance Act 2010 (see section 25 of that Act).

Limits on fees that may be charged by controllers

National security and defence exemption

42A

(1) The Secretary of State may by regulations—

(a) make provision so that an additional description of processing of personal data is sensitive processing for the purposes of this Part,

(b) make provision so that added processing is not sensitive processing for the purposes of this Part,

(c) make provision so that a protected condition in Schedule 8 may or may not be relied on in connection with added processing, and

(d) make provision varying such a condition as it relates to added processing.

(2) In subsection (1)—

“added processing” means a description of processing which is sensitive processing by virtue of provision made under subsection (1)(a);

“protected condition in Schedule 8” means a condition in that Schedule other than one that was added to the Schedule by regulations under section 35(6).

(3) Regulations under this section may amend this Part and sections 205 and 206.

(4) Regulations under this section are subject to the affirmative resolution procedure.

50A

(1) For the purposes of sections 50B and 50C—

(a) a decision is based solely on automated processing if there is no meaningful human involvement in the taking of the decision, and

(b) a decision is a significant decision, in relation to a data subject, if—

(i) it produces an adverse legal effect for the data subject, or

(ii) it has a similarly significant adverse effect for the data subject.

(2) When considering whether there is meaningful human involvement in the taking of a decision, a person must consider, among other things, the extent to which the decision is reached by means of profiling.

50B

(1) A significant decision based entirely or partly on sensitive processing may not be taken based solely on automated processing, unless one of the following conditions is met.

(2) The first condition is that the decision is based entirely on processing of personal data to which the data subject has given explicit consent.

(3) The second condition is that the decision is required or authorised by law.

50C

(1) Subject to subsection (3), where a significant decision taken by or on behalf of a controller in relation to a data subject is—

(a) based entirely or partly on personal data, and

(b) based solely on automated processing,

the controller must ensure that safeguards for the data subject’s rights, freedoms and legitimate interests are in place which comply with subsection (2) and any regulations under section 50D(4).

(2) The safeguards must consist of or include measures which—

(a) provide the data subject with information about decisions described in subsection (1) taken in relation to the data subject;

(b) enable the data subject to make representations about such decisions;

(d) enable the data subject to contest such decisions.

(3) Subsections (1) and (2) do not apply in relation to a significant decision if—

(a) exemption from those provisions is required for a reason listed in subsection (4),

(b) the controller reconsiders the decision as soon as reasonably practicable, and

(4) Those reasons are—

(a) to avoid obstructing an official or legal inquiry, investigation or procedure;

(b) to avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;

(d) to safeguard national security;

(e) to protect the rights and freedoms of others.

(5) When considering whether there is meaningful human involvement in the reconsideration of a decision, a person must consider, among other things, the extent to which the conclusion reached on reconsideration is reached by means of profiling.

50D

(1) The Secretary of State may by regulations provide that, for the purposes of sections 50A(1)(a) and 50C(3)(c), there is, or is not, to be taken to be meaningful human involvement in the taking or reconsideration of a decision in cases described in the regulations.

(2) The Secretary of State may by regulations provide that, for the purposes of section 50A(1)(b)(ii), a description of decision is, or is not, to be taken to have a similarly significant adverse effect for the data subject.

(3) Regulations under subsection (1) or (2) may amend section 50A.

(4) The Secretary of State may by regulations make the following types of provision about the safeguards required under section 50C(1)—

(a) provision requiring the safeguards to include measures in addition to those described in section 50C(2),

(b) provision imposing requirements which supplement what section 50C(2) requires the safeguards to consist of or include (including, for example, provision about how and when things described in section 50C(2) must be done or be capable of being done), and

(c) provision about measures which are not to be taken to satisfy one or more of paragraphs (a) to (d) of section 50C(2).

(5) Regulations under this section are subject to the affirmative resolution procedure.

74AA

(1) For the purposes of section 73, the Secretary of State may by regulations approve transfers of personal data to—

(a) a third country, or

(b) an international organisation.

(2) The Secretary of State may only make regulations under this section approving transfers to a third country or international organisation if the Secretary of State considers that the data protection test is met in relation to the transfers (see section 74AB).

(3) In making regulations under this section, the Secretary of State may have regard to any matter which the Secretary of State considers relevant, including the desirability of facilitating transfers of personal data to and from the United Kingdom.

(4) Regulations under this section may, among other things—

(a) make provision by reference to a third country or international organisation specified in the regulations or a description of country or organisation;

(b) approve all transfers of personal data to a third country or international organisation or only transfers specified or described in the regulations;

(i) a sector or geographic area within a third country,

(ii) the controller or processor,

(iii) the recipient of the personal data,

(iv) the personal data transferred,

(v) the means by which the transfer is made, or

(vi) relevant legislation, schemes, lists or other arrangements or documents, as they have effect from time to time;

(d) confer a discretion on a person.

(5) Regulations under this section are subject to the negative resolution procedure.

74AB

(1) For the purposes of section 74AA, the data protection test is met in relation to transfers to a third country or international organisation if the standard of the protection provided for data subjects with regard to law enforcement processing of personal data in the country or by the organisation is not materially lower than the standard of the protection provided for data subjects by or under—

(a) this Part, and

(b) Parts 5 to 7, so far as relevant to law enforcement processing.

(2) In considering whether the data protection test is met in relation to transfers of personal data to a third country or international organisation, the Secretary of State must consider, among other things—

(a) respect for the rule of law and for human rights in the country or by the organisation,

(b) the existence, and powers, of an authority responsible for enforcing the protection of data subjects with regard to the processing of personal data in the country or by the organisation,

(d) rules about the transfer of personal data from the country or by the organisation to other countries or international organisations,

(e) relevant international obligations of the country or organisation, and

(f) the constitution, traditions and culture of the country or organisation.

(3) In subsections (1) and (2)—

(a) the references to the protection provided for data subjects are to that protection taken as a whole,

(b) the references to law enforcement processing are to processing by a competent authority for any of the law enforcement purposes or equivalent types of processing in the third country or by the international organisation (as appropriate), and

(c) the references to processing of personal data in the third country or by the international organisation are references only to the processing of personal data transferred to the country or organisation by means of processing to which this Act applies as described in section 207(2).

(4) When the data protection test is applied only to certain transfers to a third country or international organisation that are specified or described, or to be specified or described, in regulations (in accordance with section 74AA(4)(b))—

(a) the references in subsections (1) to (3) to personal data are to be read as references only to personal data likely to be the subject of such transfers, and

(b) the reference in subsection (2)(d) to transfer to other countries or international organisations is to be read as including transfer within the third country or international organisation.

91A

(1) The Secretary of State may by regulations—

(a) make provision so that an additional description of processing of personal data is sensitive processing for the purposes of this Part,

(b) make provision so that added processing is not sensitive processing for the purposes of this Part,

(c) make provision so that a protected condition in Schedule 10 may or may not be relied on in connection with added processing, and

(d) make provision varying such a condition as it relates to added processing.

(2) In subsection (1)—

“added processing” means a description of processing which is sensitive processing by virtue of provision made under subsection (1)(a);

“protected condition in Schedule 10” means a condition in that Schedule other than one that was added to the Schedule by regulations under section 86(3).

(3) Regulations under this section may amend this Part and sections 205 and 206.

(4) Regulations under this section are subject to the affirmative resolution procedure.

124A

(1) The Commissioner must prepare appropriate codes of practice giving guidance as to good practice in the processing of personal data if required to do so by regulations made by the Secretary of State.

(2) Regulations under this section—

(a) must describe the personal data or processing to which the code of practice is to relate, and

(b) may describe the persons or classes of person to whom it is to relate.

(3) Where a code under this section is in force, the Commissioner may prepare amendments of the code or a replacement code.

(4) Before preparing a code or amendments under this section, the Commissioner must consult the Secretary of State and such of the following as the Commissioner considers appropriate—

(a) trade associations;

(b) data subjects;

(5) A code under this section may include transitional provision or savings.

(6) Regulations under this section are subject to the negative resolution procedure.

(7) In this section—

“good practice in the processing of personal data” means such practice in the processing of personal data as appears to the Commissioner to be desirable having regard to the interests of data subjects and others, including compliance with the requirements of the data protection legislation;

“trade association” includes a body representing controllers or processors.

124B

(1) This section applies where a code is prepared under section 121, 122, 123, 124 or 124A, subject to subsection (11).

(2) The Commissioner must establish a panel of individuals to consider the code.

(3) The panel must consist of—

(a) individuals the Commissioner considers have expertise in the subject matter of the code, and

(b) individuals the Commissioner considers—

(i) are likely to be affected by the code, or

(ii) represent persons likely to be affected by the code.

(4) Before the panel begins to consider the code, the Commissioner must—

(a) publish the code in draft, and

(b) publish a statement that—

(i) states that a panel has been established to consider the code,

(ii) identifies the members of the panel,

(iii) explains the process by which they were selected, and

(iv) explains the reasons for their selection.

(5) Where at any time it appears to the Commissioner that a member of the panel is not willing or able to serve as a member of the panel, the Commissioner may select another individual to be a member of the panel.

(6) Where the Commissioner selects an individual to be a member of the panel under subsection (5), the Commissioner must publish a statement that—

(a) identifies the member of the panel,

(b) explains the process by which the member was selected, and

(7) The Commissioner must make arrangements—

(a) for the members of the panel to consider the code with one another (whether in person or otherwise), and

(b) for the panel to prepare and submit to the Commissioner a report on the code within such reasonable period as is determined by the Commissioner.

(8) If the panel submits to the Commissioner a report on the code within the period determined by the Commissioner, the Commissioner must as soon as reasonably practicable—

(a) make any alterations to the code that the Commissioner considers appropriate in the light of the report, and

(b) publish—

(i) the code in draft,

(ii) the report or a summary of it, and

(iii) in a case where a recommendation in the report to alter the code has not been accepted by the Commissioner, an explanation of why it has not been accepted.

(9) The Commissioner may pay remuneration and expenses to the members of the panel.

(10) This section applies in relation to amendments prepared under section 121, 122, 123, 124 or 124A as it applies in relation to codes prepared under those sections, subject to subsection (11).

(11) The Secretary of State may by regulations provide that this section does not apply, or applies with modifications, in the case of—

(a) a code prepared under section 124A, or

(b) an amendment of such a code,

that is specified or described in the regulations.

(12) Regulations under this section are subject to the negative resolution procedure.

124C

(1) Where a code is prepared under section 121, 122, 123, 124 or 124A, the Commissioner must carry out and publish an assessment of—

(a) who would be likely to be affected by the code, and

(b) the effect the code would be likely to have on them.

(2) This section applies in relation to amendments prepared under section 121, 122, 123, 124 or 124A as it applies in relation to codes prepared under those sections.

164A

(1) A data subject may make a complaint to the controller if the data subject considers that, in connection with personal data relating to the data subject, there is an infringement of the UK GDPR or Part 3 of this Act.

(2) A controller must facilitate the making of complaints under this section by taking steps such as providing a complaint form which can be completed electronically and by other means.

(3) If a controller receives a complaint under this section, the controller must acknowledge receipt of the complaint within the period of 30 days beginning when the complaint is received.

(4) If a controller receives a complaint under this section, the controller must without undue delay—

(a) take appropriate steps to respond to the complaint, and

(b) inform the complainant of the outcome of the complaint.

(5) The reference in subsection (4)(a) to taking appropriate steps to respond to the complaint includes—

(a) making enquiries into the subject matter of the complaint, to the extent appropriate, and

(b) informing the complainant about progress on the complaint.

164B

(1) The Secretary of State may by regulations require a controller to notify the Commissioner of the number of complaints made to the controller under section 164A in periods specified or described in the regulations.

(2) Regulations under this section may provide that a controller is required to make a notification to the Commissioner in respect of a period only in circumstances specified in the regulations.

(3) Regulations under this section may include—

(a) provision about a matter listed in subsection (4), or

(b) provision conferring power on the Commissioner to determine those matters.

(4) The matters are—

(a) the form and manner in which a notification must be made,

(b) the time at which, or period within which, a notification must be made, and

(5) Regulations under this section are subject to the negative resolution procedure.

Schedule 12A

Number of members

1

(1) The Commission is not to be regarded—

(a) as a servant or agent of the Crown, or

(b) as enjoying any status, immunity or privilege of the Crown.

(2) The Commission’s property is not to be regarded—

(a) as property of the Crown, or

(b) as property held on behalf of the Crown.

2

(1) The number of members of the Commission is to be determined by the Secretary of State.

(2) That number must not be—

(a) less than 3, or

(b) more than 14.

(3) The Secretary of State may by regulations substitute a different number for the number for the time being specified in sub-paragraph (2)(b).

(4) Regulations under this paragraph are subject to the negative resolution procedure.

3

(1) The Commission is to consist of—

(a) the non-executive members, and

(b) the executive members.

(2) The non-executive members are—

(a) a chair appointed by His Majesty by Letters Patent on the recommendation of the Secretary of State, and

(b) such other members as the Secretary of State may appoint.

(3) The executive members are—

(a) a chief executive appointed by the non-executive members or in accordance with paragraph 25, and

(b) such other members, if any, as the non-executive members may appoint.

(4) The Secretary of State must consult the chair of the Commission before appointing a non-executive member.

(5) The non-executive members must consult the Secretary of State before appointing the chief executive.

(6) The non-executive members must consult the chief executive about whether there should be any executive members within sub-paragraph (3)(b) and, if so, how many there should be.

(7) The Secretary of State may by direction set a maximum and a minimum number of executive members.

(8) The Commission may appoint one of the non-executive members as a deputy to the chair.

4

The Secretary of State must exercise the powers conferred on the Secretary of State by paragraphs 2 and 3 so as to secure that the number of non-executive members of the Commission is, so far as practicable, at all times greater than the number of executive members.

5

(1) The Secretary of State may not recommend a person for appointment as the chair of the Commission unless the person has been selected on merit on the basis of fair and open competition.

(2) A person may not be appointed as a member of the Commission unless the person has been selected on merit on the basis of fair and open competition.

6

(1) Before—

(a) recommending a person for appointment as the chair of the Commission, or

(b) appointing a person as a non-executive member of the Commission,

the Secretary of State must be satisfied that the person does not have a conflict of interest.

(2) The Secretary of State must check from time to time that none of the non-executive members has a conflict of interest.

(3) The Secretary of State may require a non-executive member to provide whatever information the Secretary of State considers necessary for the purpose of checking that the member does not have a conflict of interest.

(4) A non-executive member who is required to provide information under sub-paragraph (3) must provide it within such period as may be specified by the Secretary of State.

(5) In this Schedule, “conflict of interest”, in relation to a person, means a financial or other interest which is likely to affect prejudicially the discharge by the person of the person’s functions as a member of the Commission.

7

(1) The chair of the Commission holds and vacates office in accordance with the terms of the chair’s appointment, subject to the provisions of this paragraph.

(2) The chair must be appointed for a term of not more than 7 years.

(3) On the recommendation of the Secretary of State, His Majesty may by Letters Patent extend the term of the chair’s appointment but not so the term as extended is more than 7 years.

(4) A person cannot be appointed as the chair more than once.

(5) The chair may be relieved from office by His Majesty at the chair’s own request.

(6) The chair may be removed from office by His Majesty on an Address from both Houses of Parliament.

(7) No motion is to be made in either House of Parliament for such an Address unless the Secretary of State has presented a report to that House stating that the Secretary of State is satisfied that—

(a) the chair is guilty of serious misconduct,

(b) the chair has a conflict of interest (see paragraph 6(5)),

(d) the chair is unable, unfit or unwilling to carry out the chair’s functions.

8

(1) A deputy chair of the Commission may resign that office by giving written notice to the Commission.

(2) A deputy chair of the Commission ceases to hold that office on ceasing to be a non-executive member of the Commission.

(3) A deputy chair of the Commission may be removed from that office by the Commission.

9

(1) This paragraph applies to a non-executive member of the Commission appointed by the Secretary of State.

(2) The member holds and vacates office in accordance with the terms of their appointment, subject to the provisions of this paragraph.

(3) The member must be appointed for a term of not more than 7 years.

(4) The Secretary of State may extend the term of the member’s appointment but not so that the term as extended is more than 7 years.

(5) The Secretary of State may not appoint the member as a non-executive member of the Commission on a subsequent occasion.

(6) The member may resign from office by giving written notice to the Secretary of State and the Commission.

(7) The Secretary of State may remove the member from office by written notice if satisfied that—

(a) the member is guilty of serious misconduct,

(b) the member has a conflict of interest (see paragraph 6(5)),

(d) the member is unable, unfit or unwilling to carry out the member’s functions.

(8) At the time of removing the member from office the Secretary of State must make public the decision to do so.

(9) The Secretary of State must—

(a) give the member a statement of reasons for the removal, and

(b) if asked to do so by the member, publish the statement.

10

(1) The Commission may pay to the non-executive members of the Commission such remuneration and allowances as the Secretary of State may determine.

(2) The Commission may pay, or make provision for paying, to or in respect of the non-executive members of the Commission, such sums by way of pensions, allowances or gratuities (including pensions, allowances or gratuities paid by way of compensation in respect of loss of office) as the Secretary of State may determine.

(3) The Commission may make a payment to a person of such amount as the Secretary of State may determine where—

(a) the person ceases to be a non-executive member of the Commission otherwise than on the expiry of the person’s term of office, and

(b) it appears to the Secretary of State that there are special circumstances which make it appropriate for the person to receive compensation.

11

(1) The executive members of the Commission are to be employees of the Commission.

(2) The executive members are to be employed by the Commission on such terms and conditions, including those as to remuneration, as the non-executive members of the Commission may determine.

(3) The Commission must—

(a) pay to or in respect of the executive members of the Commission such pensions, allowances or gratuities (including pensions, allowances or gratuities paid by way of compensation in respect of loss of office) as the non-executive members of the Commission may determine, and

(b) provide and maintain for them such pension schemes (whether contributory or not) as the non-executive members of the Commission may determine.

12

(1) The Commission may—

(a) appoint other employees, and

(b) make such other arrangements for the staffing of the Commission as it considers appropriate.

(2) In appointing an employee, the Commission must have regard to the principle of selection on merit on the basis of fair and open competition.

(3) Employees appointed by the Commission are to be appointed on such terms and conditions, including those as to remuneration, as the Commission may determine.

(4) The Commission may—

(a) pay to or in respect of those employees such pensions, allowances or gratuities (including pensions, allowances or gratuities paid by way of compensation in respect of loss of employment) as the Commission may determine, and

(b) provide and maintain for them such pension schemes (whether contributory or not) as the Commission may determine.

13

(1) The Commission may establish committees.

(2) A committee of the Commission may consist of or include persons who are neither members nor employees of the Commission.

(3) But a committee of the Commission to which functions are delegated under paragraph 14(1)(c) must include at least one person who is either a member or an employee of the Commission.

(4) Where a person who is neither a member nor an employee of the Commission is a member of a committee of the Commission, the Commission may pay to that person such remuneration and expenses as it may determine.

14

(1) The Commission may delegate any of its functions to—

(a) a member of the Commission,

(b) an employee of the Commission, or

(2) A function is delegated under sub-paragraph (1) to the extent and on the terms that the Commission determines.

(3) A committee of the Commission may delegate any function delegated to it to a member of the committee.

(4) A function is delegated under sub-paragraph (3) to the extent and on the terms that the committee determines.

(5) The power of a committee of the Commission to delegate a function, and to determine the extent and terms of the delegation, is subject to the Commission’s power to direct what a committee established by it may and may not do.

(6) The delegation of a function by the Commission or a committee of the Commission under this paragraph does not prevent the Commission or the committee from exercising that function.

15

The Commission may require a committee of the Commission to give the Commission advice about matters relating to the discharge of the Commission’s functions.

16

(1) The Commission may make arrangements for regulating—

(a) its own procedure, and

(b) the procedure of a committee of the Commission.

(2) The non-executive members of the Commission may by majority make arrangements for regulating the procedure for the carrying out of the separate functions which are conferred on them under this Schedule.

(3) Arrangements under this paragraph may include arrangements as to quorum and the making of decisions by a majority.

(4) The Commission must publish arrangements which it makes under this paragraph.

(5) This paragraph is subject to paragraph 18.

17

The Commission must make arrangements for the keeping of proper records of—

(a) its proceedings,

(b) the proceedings of a committee of the Commission,

(d) anything done by a member or employee of the Commission under paragraph 14(1), and

(e) anything done by a member of a committee of the Commission under paragraph 14(3).

18

(1) This paragraph applies if—

(a) a member of the Commission has a direct or indirect interest in a matter falling to be considered at a meeting of the Commission,

(b) a non-executive member of the Commission has a direct or indirect interest in a matter falling to be considered at a meeting of the non-executive members, or

(c) a member of a committee of the Commission has a direct or indirect interest in a matter falling to be considered at a meeting of the committee.

(2) The member with the interest must declare it.

(3) The declaration must be recorded in the minutes of the meeting.

(4) The member with the interest may not take part in a discussion or decision at the meeting relating to the matter, unless—

(a) in the case of a meeting of the Commission, the other members of the Commission who are present have resolved unanimously that the interest is to be disregarded,

(b) in the case of a meeting of the non-executive members, the other non-executive members who are present have resolved unanimously that the interest is to be disregarded, or

(c) in the case of a meeting of a committee, the other members of the committee who are present have, in the manner authorised by the Commission, resolved that the interest is to be disregarded.

(5) In giving authorisation for the purposes of sub-paragraph (4)(c), the Commission must secure that a resolution for those purposes does not allow a member to take part in a discussion or decision at a meeting of a committee to which functions are delegated under paragraph 14(1)(c) unless the number of other members of the committee in favour of the resolution—

(a) is not less than two thirds of those who are both present and entitled to vote on the resolution, and

(b) is not less than its quorum.

(6) For the purposes of this paragraph, a notification given at or sent to a meeting of the Commission that a person—

(a) is a member of a company or firm, and

(b) is to be regarded as interested in any matter involving that company or firm,

is to be regarded as compliance with sub-paragraph (2) in relation to any such matter for the purposes of that meeting and subsequent meetings of the Commission, of the non-executive members or of a committee.

(7) For the purposes of this paragraph, a notification given at or sent to a meeting of the non-executive members of the Commission or of a committee of the Commission that—

(a) a person is a member of a company or firm, and

(b) is to be regarded as interested in any matter involving that company or firm,

is to be regarded as compliance with sub-paragraph (2) in relation to any such matter for the purposes of that meeting and subsequent meetings of the non-executive members or (as the case may be) of the committee.

(8) A notification described in sub-paragraph (6) or (7) remains in force until it is withdrawn.

(9) A person required to make a declaration for the purposes of this paragraph in relation to any meeting—

(a) is not required to attend the meeting, but

(b) is to be taken to have complied with the requirements of this paragraph if the person takes reasonable steps to secure that notice of the person’s interest is read out, and taken into consideration, at the meeting in question.

19

(1) The validity of proceedings of the Commission, of the non-executive members of the Commission or of a committee of the Commission is not affected by—

(a) a vacancy in the membership of the Commission or of the committee,

(b) a defect in the appointment of a member of the Commission,

(d) a failure to comply with arrangements under paragraph 16 or with a requirement under paragraph 18.

(2) Nothing in sub-paragraph (1)(d) validates proceedings of a meeting which is inquorate unless it is inquorate by reason only of a matter within sub-paragraph (1)(b) or (c).

20

The Secretary of State may make payments to the Commission.

21

(1) All fees, charges, penalties and other sums received by the Commission in carrying out its functions are to be paid to the Secretary of State.

(2) Sub-paragraph (1) does not apply where the Secretary of State otherwise directs.

(3) Any sums received by the Secretary of State under this paragraph are to be paid into the Consolidated Fund.

22

(1) The Commission must keep proper accounts and proper records in relation to them.

(2) The Commission must prepare a statement of accounts in respect of each financial year in the form specified by the Secretary of State.

(3) The Commission must send a copy of each statement of accounts to the Secretary of State and the Comptroller and Auditor General before the end of August next following the financial year to which the statement relates.

(4) The Comptroller and Auditor General must—

(a) examine, certify and report on the statement of accounts, and

(b) send a copy of the certified statement and the report to the Secretary of State.

(5) The Secretary of State must lay before Parliament each document received under sub-paragraph (4)(b).

(6) In this paragraph “financial year” means—

(a) the period beginning with the date on which the Commission is established and ending with the 31 March following that date, and

(b) each successive period of 12 months.

23

(1) The application of the Commission’s seal must be authenticated by the signature of—

(a) the chair of the Commission, or

(b) another person authorised for that purpose by the Commission.

(2) A document purporting to be duly executed under the Commission’s seal or signed on its behalf—

(a) is to be received in evidence, and

(b) is to be taken to be executed or signed in that way, unless the contrary is shown.

(3) This paragraph does not extend to Scotland.

24

The Commission may do anything it thinks appropriate for the purposes of, or in connection with, its functions.

25

(1) The first chief executive of the Commission is to be appointed by the chair of the Commission.

(2) Before making the appointment the chair must consult the Secretary of State.

(3) The appointment must be for a term of not more than 2 years.

(4) The chair may extend the term of the appointment but not so the term as extended is more than 2 years.

(5) For the term of appointment, the person appointed under sub-paragraph (1) is “the interim chief executive”.

(6) Until the expiry of the term of appointment, the powers conferred on the non-executive members by paragraph 11(2) and (3) are exercisable in respect of the interim chief executive by the chair (instead of by the non-executive members).

(7) In sub-paragraphs (5) and (6), the references to the term of appointment are to the term of appointment described in sub-paragraph (3), including any extension of the term under sub-paragraph (4).

26

In this Schedule—

(a) references to pensions, allowances or gratuities include references to any similar benefits provided on death or retirement, and

(b) references to the payment of pensions, allowances or gratuities to or in respect of a person include references to the making of payments towards the provision of pensions, allowances or gratuities to be paid to or in respect of a person.

The applied GPDR

GDPR: right to an effective remedy against the Commissioner

40A

(1) This section is about processing of personal data that is carried out in reliance on the consent of the data subject.

(2) The controller must be able to demonstrate that the data subject consented to the processing.

(3) If the data subject’s consent is given in writing as part of a document which also concerns other matters, the request for consent must be made—

(a) in a manner which clearly distinguishes the request from the other matters,

(b) in an intelligible and easily accessible form, and

(4) Any part of a document described in subsection (3) which constitutes an infringement of this Part is not binding.

(5) The data subject may withdraw the consent at any time (but the withdrawal of consent does not affect the lawfulness of processing in reliance on the consent before its withdrawal).

(6) Processing may only be carried out in reliance on consent if—

(a) before the consent is given, the controller or processor informs the data subject of the right to withdraw it, and

(b) it is as easy for the data subject to withdraw the consent as to give it.

(7) When assessing whether consent is freely given, account must be taken of, among other things, whether the provision of a service is conditional on consent to the processing of personal data that is not necessary for the provision of that service.

141A

(1) This section applies in relation to a notice authorised or required by this Act to be given to a person by the Commissioner.

(2) The notice may be given to the person by—

(a) delivering it by hand to a relevant individual,

(b) leaving it at the person’s proper address,

(d) sending it by email to the person’s email address.

(3) A “relevant individual” means—

(a) in the case of a notice to an individual, that individual;

(b) in the case of a notice to a body corporate (other than a partnership), an officer of that body;

(c) in the case of a notice to a partnership, a partner in the partnership or a person who has the control or management of the partnership business;

(d) in the case of a notice to an unincorporated body (other than a partnership), a member of its governing body.

(4) For the purposes of subsection (2)(b) and (c), and section 7 of the Interpretation Act 1978 (services of documents by post) in its application to those provisions, a person’s proper address is—

(a) in a case where the person has specified an address as one at which the person, or someone acting on the person’s behalf, will accept service of notices or other documents, that address;

(b) in any other case, the address determined in accordance with subsection (5).

(5) The address is—

(a) in a case where the person is a body corporate with a registered office in the United Kingdom, that office;

(b) in a case where paragraph (a) does not apply and the person is a body corporate, partnership or unincorporated body with a principal office in the United Kingdom, that office;

(c) in any other case, an address in the United Kingdom at which the Commissioner believes, on reasonable grounds, that the notice will come to the attention of the person.

(6) A person’s email address is—

(a) an email address published for the time being by that person as an address for contacting that person, or

(b) if there is no such published address, an email address by means of which the Commissioner believes, on reasonable grounds, that the notice will come to the attention of that person.

(7) A notice sent by email is treated as given 48 hours after it was sent, unless the contrary is proved.

(8) In this section, “officer”, in relation to a body corporate, means a director, manager, secretary or other similar officer of the body.

(9) This section does not limit other lawful means of giving a notice.

45A

(1) Sections 44(2) and 45(1) do not require the controller to give the data subject—

(a) information in respect of which a claim to legal professional privilege or, in Scotland, confidentiality of communications could be maintained in legal proceedings, or

(b) information in respect of which a duty of confidentiality is owed by a professional legal adviser to a client of the adviser.

(2) A controller relying on the exemption in subsection (1) must inform the data subject in writing without undue delay of—

(a) the decision to rely on the exemption,

(b) the reason for the decision,

(d) the data subject’s right to lodge a complaint with the Commissioner under section 165, and

(e) the data subject’s right to apply to a court under section 167.

(3) Subsection (2)(a) and (b) do not apply to the extent that complying with them would—

(a) undermine a claim described in subsection (1)(a), or

(b) conflict with a duty described in subsection (1)(b).

(4) The controller must—

(a) record the reason for a decision to rely on the exemption in subsection (1), and

(b) if requested to do so by the Commissioner, make the record available to the Commissioner.

(5) The reference in subsection (1) to sections 44(2) and 45(1) includes sections 35 to 40 so far as their provisions correspond to the rights and obligations provided for in sections 44(2) and 45(1).

Codes of conduct

71A

(1) The Commissioner must encourage expert public bodies to produce codes of conduct intended to contribute to compliance with this Part.

(2) Under subsection (1), the Commissioner must, among other things, encourage the production of codes which take account of the specific features of the various processing sectors.

(3) For the purposes of this section—

(a) “public body” means a body or other person whose functions are, or include, functions of a public nature, and

(b) a public body is “expert” if, in the Commissioner’s opinion, the body has the knowledge and experience needed to produce a code of conduct described in subsection (1).

(4) A code of conduct described in subsection (1) may, for example, make provision with regard to—

(a) lawful and fair processing;

(b) the collection of personal data;

(d) the exercise of the rights of data subjects;

(e) the measures and procedures referred to in sections 56, 57 and 62;

(f) the notification of personal data breaches to the Commissioner and the communication of personal data breaches to data subjects;

(g) the transfer of personal data to third countries or international organisations;

(h) out-of-court proceedings and other dispute resolution procedures for resolving disputes between controllers and data subjects with regard to processing.

(5) The Commissioner must encourage expert public bodies to submit codes of conduct described in subsection (1) to the Commissioner in draft.

(6) Where an expert public body does so, the Commissioner must—

(a) provide the body with an opinion on whether the code correctly reflects the requirements of this Part,

(b) decide whether to approve the code, and

(7) Subsections (5) and (6) apply in relation to amendments of a code of conduct that is for the time being approved under this section as they apply in relation to a code.

78A

(1) A provision mentioned in subsection (2) does not apply to personal data processed for law enforcement purposes if exemption from the provision is required for the purposes of safeguarding national security.

(2) The provisions are—

(a) Chapter 2 of this Part (principles), except for the provisions listed in subsection (3);

(b) Chapter 3 of this Part (rights of the data subject);

(i) section 67 (notification of personal data breach to the Commissioner);

(ii) section 68 (communication of personal data breach to the data subject);

(d) Chapter 5 of this Part (transfers of personal data to third countries etc), except for the provisions listed in subsection (4);

(e) in Part 5—

(i) section 119 (inspection in accordance with international obligations);

(ia) section 119A (standard clauses for transfers to third countries);

(ii) in Schedule 13 (other general functions of the Commissioner), paragraphs 1(1)(a) and (g) and 2;

(f) in Part 6—

(i) sections 142 to 154 and Schedule 15 (Commissioner’s notices and powers of entry and inspection);

(ii) sections 170 to 173 (offences relating to personal data);

(g) in Part 7, section 187 (representation of data subjects).

(3) The provisions of Chapter 2 of this Part (principles) which are excepted from the list in subsection (2) are—

(a) section 35(1) (the first data protection principle) so far as it requires processing of personal data to be lawful;

(b) section 35(2) to (5) (lawfulness of processing and restrictions on sensitive processing);

(d) Schedule 8 (conditions for sensitive processing).

(4) The provisions of Chapter 5 of this Part (transfers of personal data to third countries etc) which are excepted from the list in subsection (2) are—

(a) the following provisions of section 73—

(i) subsection (1)(a) (conditions for transfer), so far as it relates to the condition in subsection (2) of that section, and subsection (2) (transfer must be necessary for a law enforcement purpose);

(ii) subsections (1)(b), (5) and (6) (conditions for transfer of personal data originally made available by a member State);

(b) section 78 (subsequent transfers).

82A

(1) For the purposes of this Part, the Secretary of State may give a notice designating processing of personal data by a qualifying competent authority (a “designation notice”) where—

(a) an application for designation of the processing is made in accordance with this section, and

(b) the Secretary of State considers that designation of the processing is required for the purposes of safeguarding national security.

(2) The Secretary of State may only designate processing by a qualifying competent authority that is carried out by the authority as a joint controller with at least one intelligence service.

(3) The Secretary of State may not designate processing by a qualifying competent authority that consists of the transfer of personal data to—

(a) a country or territory outside the United Kingdom, or

(b) an international organisation.

(4) A designation notice must—

(a) specify or describe the processing and qualifying competent authority that are designated, and

(b) be given to the applicants for the designation (and see also section 82D).

(5) An application for designation of processing of personal data by a qualifying competent authority must be made jointly by—

(a) the qualifying competent authority, and

(b) the intelligence service with which the processing is to be carried out.

(6) An application may be made in respect of more than one qualifying competent authority and in respect of processing with more than one intelligence service.

(7) The application must—

(a) describe the processing, including the intended purposes and means of processing, and

(b) explain why the applicants consider that designation is required for the purposes of safeguarding national security.

(8) Before giving a designation notice, the Secretary of State must consult the Commissioner.

(9) In this section, “joint controller”, in relation to processing of personal data, means a controller whose responsibilities for compliance with this Part in relation to the processing are determined in an arrangement under section 104.

82B

(1) A designation notice must state when it comes into force.

(2) A designation notice ceases to be in force at the earliest of the following times—

(a) at the end of the period of 5 years beginning when the notice comes into force;

(b) (if relevant) at the end of a shorter period specified in the notice;

(3) The Secretary of State may give a further designation notice in respect of processing that is, or has been, the subject of a previous designation notice.

82C

(1) Subsections (2) to (4) apply where processing is the subject of a designation notice for the time being in force.

(2) A person who applied for the designation of the processing must notify the Secretary of State without undue delay if the person considers that the designation is no longer required for the purposes of safeguarding national security.

(3) A person who applied for the designation of the processing must, on a request from the Secretary of State, provide—

(a) a description of the processing that is being, or is intended to be, carried out in reliance on the notice, and

(b) an explanation of why the person considers that designation of the processing continues to be required for the purposes of safeguarding national security.

(4) The Secretary of State must at least annually—

(a) review each designation notice that is for the time being in force, and

(b) consider whether designation of the processing which is the subject of the notice continues to be required for the purposes of safeguarding national security.

(5) The Secretary of State—

(a) may withdraw a designation notice by giving a further notice (a “withdrawal notice”) to the persons who applied for the designation, and

(b) must give a withdrawal notice if the Secretary of State considers that designation of some or all of the processing to which the notice applies is no longer required for the purposes of safeguarding national security (whether as a result of a review required under subsection (4) or otherwise).

(6) A withdrawal notice must—

(a) withdraw the designation notice completely, and

(b) state when it comes into force.

(7) In determining when a withdrawal notice required under subsection (5)(b) comes into force, the Secretary of State must consider—

(a) the desirability of the processing ceasing to be designated as soon as possible, and

(b) where relevant, the time needed to effect an orderly transition to new arrangements for the processing of personal data.

82D

(1) Where the Secretary of State gives a designation notice—

(a) the Secretary of State must send a copy of the notice to the Commissioner, and

(b) the Commissioner must publish a record of the notice.

(2) The record must contain—

(a) the Secretary of State’s name,

(b) the date on which the notice was given,

(d) subject to subsection (3), the rest of the text of the notice.

(3) The Commissioner must not publish the text, or a part of the text, of the notice if—

(a) the Secretary of State has determined that publishing the text or that part of the text—

(i) would be against the interests of national security,

(ii) would be contrary to the public interest, or

(iii) might jeopardise the safety of any person, and

(b) the Secretary of State has notified the Commissioner of that determination.

(4) The Commissioner must keep the record of the notice available to the public while the notice is in force.

(5) Where the Secretary of State gives a withdrawal notice, the Secretary of State must send a copy of the notice to the Commissioner.

82E

(1) A person directly affected by a designation notice may appeal to the Tribunal against the notice.

(2) If, on an appeal under this section, the Tribunal finds that, applying the principles applied by a court on an application for judicial review, the Secretary of State did not have reasonable grounds for giving the notice, the Tribunal may—

(a) allow the appeal, and

(b) quash the notice.

The Information Commission

114A

(1) A body corporate called the Information Commission is established.

(2) Schedule 12A makes further provision about the Commission.

Duties in carrying out functions

120A

It is the principal objective of the Commissioner, in carrying out functions under the data protection legislation—

(a) to secure an appropriate level of protection for personal data, having regard to the interests of data subjects, controllers and others and matters of general public interest, and

(b) to promote public trust and confidence in the processing of personal data.

120B

In carrying out functions under the data protection legislation, the Commissioner must have regard to such of the following as appear to the Commissioner to be relevant in the circumstances—

(a) the desirability of promoting innovation;

(b) the desirability of promoting competition;

(d) the need to safeguard public security and national security;

(e) the fact that children merit specific protection with regard to their personal data because they may be less aware of the risks and consequences associated with processing of personal data and of their rights in relation to such processing.

120C

(1) The Commissioner must prepare a strategy for carrying out the Commissioner’s functions under the data protection legislation in accordance with the Commissioner’s duties under—

(a) sections 120A and 120B,

(b) section 108 of the Deregulation Act 2015 (exercise of regulatory functions: economic growth), and

(2) The Commissioner must—

(a) review the strategy from time to time, and

(b) revise the strategy as appropriate.

(3) The Commissioner must publish the strategy and any revised strategy.

120D

(1) The Commissioner must, at such times as the Commissioner considers appropriate, consult the persons mentioned in subsection (2) about how the manner in which the Commissioner exercises functions under the data protection legislation may affect economic growth, innovation and competition.

(2) The persons are—

(a) such persons exercising regulatory functions as the Commissioner considers appropriate;

(b) such other persons as the Commissioner considers appropriate.

(3) In this section, “regulatory function” has the meaning given by section 111 of the Deregulation Act 2015.

139A

(1) The Commissioner must prepare and publish an analysis of the Commissioner’s performance using key performance indicators.

(2) The analysis must be prepared and published at least annually.

(3) In this section, “key performance indicators” means factors by reference to which the Commissioner’s performance can be measured most effectively.

Documents and notices

161A

(1) The Commissioner must produce and publish an annual report containing the information described in subsections (2) to (5).

(2) The report must include the following information about UK GDPR investigations—

(a) the number of investigations begun, continued or completed by the Commissioner during the reporting period,

(b) the different types of act and omission that were the subject matter of the investigations,

(d) the duration of investigations that ended in the reporting period, and

(e) the different types of outcome in investigations that ended in that period.

(3) The report must include information about the enforcement powers exercised by the Commissioner in the reporting period in connection with—

(a) processing of personal data by a competent authority for any of the law enforcement purposes, and

(b) processing of personal data to which Part 4 applies.

(4) The information included in the report in accordance with subsections (2) and (3) must include information about—

(a) the number of penalty notices given in the reporting period that were given more than 6 months after the notice of intent was given under paragraph 2 of Schedule 16, and

(b) the reasons why that happened.

(5) The report must include a review of how the Commissioner had regard to the guidance published under section 160 when exercising the Commissioner’s enforcement powers as described in subsections (2)(c) and (3).

(6) In this section—

“enforcement powers” means the powers under—Article 58(1)(c) and (d) and (2)(a) and (b) of the UK GDPR,sections 142 to 159 of this Act,paragraph 2(a), (b) and (c) of Schedule 13 to this Act, andSchedules 15 and 16 to this Act;

“the law enforcement purposes” has the meaning given in section 31 of this Act;

“the reporting period” means the period to which the report relates;

“UK GDPR investigation” means an investigation required under Article 57(1)(h) of the UK GDPR (investigations on the application of the UK GDPR).

180A

(1) This section applies where a court is required to determine whether a data subject is entitled to information by virtue of a right under—

(a) Article 15 of the UK GDPR (right of access by the data subject);

(b) Article 20 of the UK GDPR (right to data portability);

(d) section 94 of this Act (intelligence services processing: right of access by the data subject).

(2) The court may require the controller to make available for inspection by the court so much of the information as is available to the controller.

(3) But, unless and until the question in subsection (1) has been determined in the data subject’s favour, the court may not require the information to be disclosed to the data subject or the data subject’s representatives, whether by discovery (or, in Scotland, recovery) or otherwise.

(4) Where the question in subsection (1) relates to a right under a provision listed in subsection (1)(a), (c) or (d), this section does not confer power on the court to require the controller to carry out a search for information that is more extensive than the reasonable and proportionate search required by that provision.

Prohibitions and restrictions etc on processing

183A

(1) A relevant enactment or rule of law which imposes a duty, or confers a power, to process personal data does not override a requirement under the main data protection legislation relating to the processing of personal data.

(2) Subsection (1) does not apply—

(a) to a relevant enactment forming part of the main data protection legislation, or

(b) to the extent that an enactment makes express provision to the contrary referring to this section or to the main data protection legislation (or a provision of that legislation).

(3) Subsection (1) does not prevent a duty or power to process personal data from being taken into account for the purpose of determining whether it is possible to rely on an exception to a requirement under the main data protection legislation that is available where there is such a duty or power.

(4) In this section—

“the main data protection legislation” means the data protection legislation other than provision of or made under—Chapter 6 or 8 of the UK GDPR, orParts 5 to 7 of this Act;

“relevant enactment” means an enactment so far as passed or made on or after 20th August 2025;

“requirement” includes a prohibition or restriction.

(5) The reference in subsection (1) to an enactment or rule of law which imposes a duty, or confers a power, to process personal data is a reference to an enactment or rule of law which, directly or indirectly, requires or authorises the processing of personal data, including (for example)—

(a) by authorising one person to require another person to process personal data, or

(b) by removing restrictions on processing personal data,

and the references in subsection (3) to a duty or power are to be read accordingly.

Schedule A1

This condition is met where the processing is necessary for the purposes of responding to a request made in accordance with the Agreement between the Government of the United Kingdom of Great Britain and Northern Ireland and the Government of the United States of America on Access to Electronic Data for the Purpose of Countering Serious Crime, signed on 3 October 2019.

57

The Border Security Commander.

146A

(1) This section applies where an assessment notice requires a controller or processor to make arrangements for an approved person to prepare a report.

(2) The controller or processor must, within such period as is specified in the assessment notice, nominate to the Commissioner a person to prepare the report.

(3) If the Commissioner is satisfied that the nominated person is a suitable person to prepare the report, the Commissioner must by written notice to the controller or processor approve the nominated person to prepare the report.

(4) If the Commissioner is not satisfied that the nominated person is a suitable person to prepare the report, the Commissioner must by written notice to the controller or processor—

(a) inform the controller or processor that the Commissioner has decided not to approve the nominated person to prepare the report,

(b) inform the controller or processor of the reasons for that decision, and

(5) If the controller or processor does not nominate a person within the period specified in the assessment notice, the Commissioner must by written notice to the controller or processor approve a person who the Commissioner is satisfied is a suitable person to prepare the report to do so.

(6) It is the duty of the controller or processor to give the person approved to prepare the report all such assistance as the person may reasonably require to prepare the report.

Interview notices

148A

(1) This section applies where the Commissioner suspects that a controller or processor—

(a) has failed or is failing as described in section 149(2), or

(b) has committed or is committing an offence under this Act.

(2) For the purpose of investigating the suspected failure or offence, the Commissioner may, by written notice (an “interview notice”), require an individual within subsection (3) to—

(a) attend at a place specified in the notice, and

(b) answer questions with respect to any matter relevant to the investigation.

(3) An individual is within this subsection if the individual—

(a) is the controller or processor,

(b) is or was at any time employed by, or otherwise working for, the controller or processor, or

(4) An interview notice must specify the time at which the individual must attend at the specified place and answer questions (but see the restrictions in subsections (6) and (7)).

(5) An interview notice must—

(a) indicate the nature of the suspected failure or offence that is the subject of the investigation,

(b) provide information about the consequences of failure to comply with the notice, and

(6) An interview notice may not require an individual to attend at the specified place and answer questions before the end of the period within which an appeal can be brought against the notice.

(7) If an appeal is brought against an interview notice, the individual to whom the notice is given need not attend at the specified place and answer questions pending the determination or withdrawal of the appeal.

(8) If an interview notice—

(a) states that, in the Commissioner’s opinion, it is necessary for the individual to attend at the specified place and answer questions urgently, and

(b) gives the Commissioner’s reasons for reaching that opinion,

subsections (6) and (7) do not apply but the notice must not require the individual to attend at the specified place and answer questions before the end of the period of 24 hours beginning when the notice is given.

(9) The Commissioner may cancel or vary an interview notice by written notice to the individual to whom it was given.

148B

(1) An interview notice does not require an individual to answer questions to the extent that requiring the person to do so would involve an infringement of the privileges of either House of Parliament.

(2) An interview notice does not require an individual to answer questions in respect of a communication which is made—

(a) between a professional legal adviser and the adviser’s client, and

(b) in connection with the giving of legal advice to the client with respect to obligations, liabilities or rights under the data protection legislation.

(3) An interview notice does not require an individual to answer questions in respect of a communication which is made—

(a) between a professional legal adviser and the adviser’s client or between such an adviser or client and another person,

(b) in connection with or in contemplation of proceedings under or arising out of the data protection legislation, and

(4) In subsections (2) and (3), references to the client of a professional legal adviser include references to a person acting on behalf of the client.

(5) An interview notice does not require an individual to answer questions if doing so would, by revealing evidence of the commission of an offence, expose the individual to proceedings for that offence.

(6) The reference to an offence in subsection (5) does not include an offence under—

(a) this Act;

(b) section 5 of the Perjury Act 1911 (false statements made otherwise than on oath);

(c) section 44(2) of the Criminal Law (Consolidation) (Scotland) Act 1995 (false statements made otherwise than on oath);

(d) Article 10 of the Perjury (Northern Ireland) Order 1979 (S.I. 1979/1714 (N.I. 19)) (false statutory declarations and other false unsworn statements).

(7) A statement made by an individual in response to an interview notice may not be used in evidence against that individual on a prosecution for an offence under this Act (other than an offence under section 148C) unless in the proceedings—

(a) in giving evidence the individual provides information inconsistent with the statement, and

(b) evidence relating to the statement is adduced, or a question relating to it is asked, by that individual or on that individual’s behalf.

(8) The Commissioner may not give an interview notice with respect to the processing of personal data for the special purposes.

(9) The Commissioner may not give an interview notice to an individual for the purpose of investigating a suspected failure or offence if the controller or processor suspected of the failure or offence is a body specified in section 23(3) of the Freedom of Information Act 2000 (bodies dealing with security matters).

148C

It is an offence for an individual, in response to an interview notice—

(a) to make a statement which the individual knows to be false in a material respect, or

(b) recklessly to make a statement which is false in a material respect.

Interview notices

3A

(1) Sub-paragraph (2) applies where the Commissioner gives an interview notice to an individual during a relevant period.

(2) If the interview notice—

(a) states that, in the Commissioner’s opinion, it is necessary for the individual to comply with a requirement in the notice for the purposes of the relevant review, and

(b) gives the Commissioner’s reasons for reaching that opinion,

subsections (6) and (7) of section 148A do not apply but the notice must not require the individual to comply with the requirement before the end of the period of 24 hours beginning when the notice is given.

(3) During a relevant period, section 148B has effect as if for subsection (8) there were substituted—

(8) The Commissioner may not give an individual an interview notice with respect to the processing of personal data for the special purposes unless a determination under section 174 with respect to the data or the processing has taken effect.

13A

(1) The Secretary of State may by regulations amend the table in Article 17(5) of the UK GDPR.

(2) Regulations under this section are subject to the affirmative resolution procedure.