LegalizeReform history
Data Protection Act 2018
32 versions
· 2018-05-23
2026-04-07
Data Protection Act 2018
2026-03-31
Data Protection Act 2018
2026-03-10
Data Protection Act 2018
2026-01-29
Data Protection Act 2018
2025-08-19
Data Protection Act 2018
2025-06-19
Data Protection Act 2018
2025-04-01
Data Protection Act 2018
2024-12-13
Data Protection Act 2018
2024-03-08
Data Protection Act 2018
2024-01-01
Data Protection Act 2018
2023-12-31
Data Protection Act 2018
2023-12-26
Data Protection Act 2018
2023-05-05
Data Protection Act 2018
2023-02-01
Data Protection Act 2018
2022-11-30
Data Protection Act 2018
2022-07-30
Data Protection Act 2018
2022-03-18
Data Protection Act 2018
2022-01-31
Data Protection Act 2018
2021-12-17
Data Protection Act 2018
2021-12-15
Data Protection Act 2018
2021-01-28
Data Protection Act 2018
2020-12-31
Data Protection Act 2018
Changes on 2020-12-31
@@ -8,11 +8,11 @@
- (1) This Act makes provision about the processing of personal data.
- (2) Most processing of personal data is subject to the GDPR.
- (3) Part 2 supplements the GDPR (see Chapter 2) and applies a broadly equivalent regime to certain types of processing to which the GDPR does not apply (see Chapter 3).
- (4) Part 3 makes provision about the processing of personal data by competent authorities for law enforcement purposes and implements the Law Enforcement Directive.
- (2) Most processing of personal data is subject to the UK GDPR.
- (3) Part 2 supplements the UK GDPR.
- (4) Part 3 makes provision about the processing of personal data by competent authorities for law enforcement purposes ....
- (5) Part 4 makes provision about the processing of personal data by the intelligence services.
@@ -26,7 +26,7 @@
##### 2
- (1) The GDPR, the applied GDPR and this Act protect individuals with regard to the processing of personal data, in particular by—
- (1) The UK GDPR and this Act protect individuals with regard to the processing of personal data, in particular by—
- (a) requiring personal data to be processed lawfully and fairly, on the basis of the data subject's consent or another specified basis,
@@ -34,7 +34,7 @@
- (c) conferring functions on the Commissioner, giving the holder of that office responsibility for monitoring and enforcing their provisions.
- (2) When carrying out functions under the GDPR, the applied GDPR and this Act, the Commissioner must have regard to the importance of securing an appropriate level of protection for personal data, taking account of the interests of data subjects, controllers and others and matters of general public interest.
- (2) When carrying out functions under the UK GDPR and this Act, the Commissioner must have regard to the importance of securing an appropriate level of protection for personal data, taking account of the interests of data subjects, controllers and others and matters of general public interest.
#### Terms relating to the processing of personal data
@@ -68,7 +68,7 @@
- (5) “*Data subject*” means the identified or identifiable living individual to whom personal data relates.
- (6) “Controller” and “*processor*”, in relation to the processing of personal data to which Chapter 2 or 3 of Part 2, Part 3 or Part 4 applies, have the same meaning as in that Chapter or Part (see sections 5, 6, 32 and 83 and see also subsection (14)(d)).
- (6) “Controller” and “*processor*”, in relation to the processing of personal data to which ... Part 2, Part 3 or Part 4 applies, have the same meaning as in that ... Part (see sections 5, 6, 32 and 83 and see also subsection (14)(d)).
- (7) “*Filing system*” means any structured set of personal data which is accessible according to specific criteria, whether held by automated means or manually and whether centralised, decentralised or dispersed on a functional or geographical basis.
@@ -76,33 +76,35 @@
- (9) “*The data protection legislation*” means—
- (a) the GDPR,
- (b) the applied GDPR,
- (a) the UK GDPR,
- (b) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (c) this Act,
- (d) regulations made under this Act, and
- (e) regulations made under section 2(2) of the European Communities Act 1972 which relate to the GDPR or the Law Enforcement Directive.
- (10) “*The GDPR*” means [Regulation (EU) 2016/679](https://www.legislation.gov.uk/european/regulation/2016/0679) of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).
- (11) “*The applied GDPR*” means the GDPR as applied by Chapter 3 of Part 2.
- (12) “*The Law Enforcement Directive*” means [Directive (EU) 2016/680](https://www.legislation.gov.uk/european/directive/2016/0680) of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA.
- (e) regulations made under section 2(2) of the European Communities Act 1972 which relate to the EU GDPR or the Law Enforcement Directive.
- (10) “*The UK GDPR*” means [Regulation (EU) 2016/679](https://www.legislation.gov.uk/eur/2016/679) of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation), as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (and see section 205(4)).
- (10A) “*The EU GDPR*” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) as it has effect in EU law.
- (11) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (12) “*The Law Enforcement Directive*” means [Directive (EU) 2016/680](https://www.legislation.gov.uk/eudr/2016/680) of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA.
- (13) “*The Data Protection Convention*” means the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data which was opened for signature on 28 January 1981, as amended up to the day on which this Act is passed.
- (14) In Parts 5 to 7, except where otherwise provided—
- (a) references to the GDPR are to the GDPR read with Chapter 2 of Part 2 and include the applied GDPR read with Chapter 3 of Part 2 ;
- (b) references to Chapter 2 of Part 2, or to a provision of that Chapter, include that Chapter or that provision as applied by Chapter 3 of Part 2;
- (c) references to personal data, and the processing of personal data, are to personal data and processing to which Chapter 2 or 3 of Part 2, Part 3 or Part 4 applies;
- (d) references to a controller or processor are to a controller or processor in relation to the processing of personal data to which Chapter 2 or 3 of Part 2, Part 3 or Part 4 applies.
- (a) references to the UK GDPR are to the UK GDPR read with Part 2;
- (b) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (c) references to personal data, and the processing of personal data, are to personal data and processing to which ... Part 2, Part 3 or Part 4 applies;
- (d) references to a controller or processor are to a controller or processor in relation to the processing of personal data to which ... Part 2, Part 3 or Part 4 applies.
- (15) There is an index of defined expressions in section 206.
@@ -116,47 +118,43 @@
- (1) This Part is relevant to most processing of personal data.
- (2) Chapter 2 of this Part—
- (a) applies to the types of processing of personal data to which the GDPR applies by virtue of Article 2 of the GDPR, and
- (b) supplements, and must be read with, the GDPR.
- (3) Chapter 3 of this Part—
- (a) applies to certain types of processing of personal data to which the GDPR does not apply (see section 21), and
- (b) makes provision for a regime broadly equivalent to the GDPR to apply to such processing.
- (2) This Part—
- (a) applies to the types of processing of personal data to which the UK GDPR applies by virtue of Article 2 of the UK GDPR, and
- (b) supplements, and must be read with, the UK GDPR.
- (3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### Definitions
##### 5
- (1) Terms used in Chapter 2 of this Part and in the GDPR have the same meaning in Chapter 2 as they have in the GDPR.
- (2) In subsection (1), the reference to a term's meaning in the GDPR is to its meaning in the GDPR read with any provision of Chapter 2 which modifies the term's meaning for the purposes of the GDPR.
- (3) Subsection (1) is subject to any provision in Chapter 2 which provides expressly for the term to have a different meaning and to section 204.
- (4) Terms used in Chapter 3 of this Part and in the applied GDPR have the same meaning in Chapter 3 as they have in the applied GDPR.
- (5) In subsection (4), the reference to a term's meaning in the applied GDPR is to its meaning in the GDPR read with any provision of Chapter 2 (as applied by Chapter 3 ) or Chapter 3 which modifies the term's meaning for the purposes of the applied GDPR.
- (6) Subsection (4) is subject to any provision in Chapter 2 (as applied by Chapter 3 ) or Chapter 3 which provides expressly for the term to have a different meaning.
- (7) A reference in Chapter 2 or Chapter 3 of this Part to the processing of personal data is to processing to which the Chapter applies.
- (1) Terms used in ... this Part and in the UK GDPR have the same meaning in this Part as they have in the UK GDPR.
- (2) In subsection (1), the reference to a term's meaning in the UK GDPR is to its meaning in the UK GDPR read with any provision of this Part which modifies the term's meaning for the purposes of the UK GDPR.
- (3) Subsection (1) is subject to any provision in this Part which provides expressly for the term to have a different meaning and to section 204.
- (4) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (5) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (6) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (7) A reference in ... this Part to the processing of personal data is to processing to which this Part applies.
- (8) Sections 3 and 205 include definitions of other expressions used in this Part.
### CHAPTER 2 — The GDPR
### Meaning of certain terms used in the GDPR
### CHAPTER 2 — The UK GDPR
### Meaning of certain terms used in the UK GDPR
#### Meaning of “controller”
##### 6
- (1) The definition of “controller” in Article 4(7) of the GDPR has effect subject to—
- (1) The definition of “controller” in Article 4(7) of the UK GDPR has effect subject to—
- (a) subsection (2),
@@ -164,7 +162,7 @@
- (c) section 210.
- (2) For the purposes of the GDPR, where personal data is processed only—
- (2) For the purposes of the UK GDPR, where personal data is processed only—
- (a) for purposes for which it is required by an enactment to be processed, and
@@ -176,7 +174,7 @@
##### 7
- (1) For the purposes of the GDPR, the following (and only the following) are “public authorities” and “public bodies” under the law of the United Kingdom—
- (1) For the purposes of the UK GDPR, the following (and only the following) are “public authorities” and “public bodies” ...—
- (a) a public authority as defined by the Freedom of Information Act 2000,
@@ -186,7 +184,7 @@
subject to subsections (2), (3) and (4).
- (2) An authority or body that falls within subsection (1) is only a “public authority” or “*public body*” for the purposes of the GDPR when performing a task carried out in the public interest or in the exercise of official authority vested in it.
- (2) An authority or body that falls within subsection (1) is only a “public authority” or “*public body*” for the purposes of the UK GDPR when performing a task carried out in the public interest or in the exercise of official authority vested in it.
- (3) The references in subsection (1)(a) and (b) to public authorities and Scottish public authorities as defined by the Freedom of Information Act 2000 and the Freedom of Information (Scotland) Act 2002 (asp 13) do not include any of the following that fall within those definitions—
@@ -208,7 +206,7 @@
- (iii) by the Charter Trustees Regulations 1996 (S.I. 1996/263).
- (4) The Secretary of State may by regulations provide that a person specified or described in the regulations that is a public authority described in subsection (1)(a) or (b) is not a “public authority” or “*public body*” for the purposes of the GDPR.
- (4) The Secretary of State may by regulations provide that a person specified or described in the regulations that is a public authority described in subsection (1)(a) or (b) is not a “public authority” or “*public body*” for the purposes of the UK GDPR.
- (5) Regulations under this section are subject to the affirmative resolution procedure.
@@ -218,7 +216,7 @@
##### 8
In Article 6(1) of the GDPR (lawfulness of processing), the reference in point (e) to processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of the controller's official authority includes processing of personal data that is necessary for—
In Article 6(1) of the UK GDPR (lawfulness of processing), the reference in point (e) to processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of the controller's official authority includes processing of personal data that is necessary for—
- (a) the administration of justice,
@@ -234,11 +232,7 @@
##### 9
In Article 8(1) of the GDPR (conditions applicable to child's consent in relation to information society services)—
- (a) references to “16 years” are to be read as references to “13 years”, and
- (b) the reference to “*information society services*” does not include preventive or counselling services.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
### Special categories of personal data
@@ -246,7 +240,7 @@
##### 10
- (1) Subsections (2) and (3) make provision about the processing of personal data described in Article 9(1) of the GDPR (prohibition on processing of special categories of personal data) in reliance on an exception in one of the following points of Article 9(2)—
- (1) Subsections (2) and (3) make provision about the processing of personal data described in Article 9(1) of the UK GDPR (prohibition on processing of special categories of personal data) in reliance on an exception in one of the following points of Article 9(2)—
- (a) point (b) (employment, social security and social protection);
@@ -258,13 +252,13 @@
- (e) point (j) (archiving, research and statistics).
- (2) The processing meets the requirement in point (b), (h), (i) or (j) of Article 9(2) of the GDPR for authorisation by, or a basis in, the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 1 of Schedule 1.
- (3) The processing meets the requirement in point (g) of Article 9(2) of the GDPR for a basis in the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 2 of Schedule 1.
- (2) The processing meets the requirement in point (b), (h), (i) or (j) of Article 9(2) of the UK GDPR for authorisation by, or a basis in, the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 1 of Schedule 1.
- (3) The processing meets the requirement in point (g) of Article 9(2) of the UK GDPR for a basis in the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 2 of Schedule 1.
- (4) Subsection (5) makes provision about the processing of personal data relating to criminal convictions and offences or related security measures that is not carried out under the control of official authority.
- (5) The processing meets the requirement in Article 10 of the GDPR for authorisation by the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 1, 2 or 3 of Schedule 1.
- (5) The processing meets the requirement in Article 10(1) of the UK GDPR for authorisation by the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 1, 2 or 3 of Schedule 1.
- (6) The Secretary of State may by regulations—
@@ -282,13 +276,13 @@
##### 11
- (1) For the purposes of Article 9(2)(h) of the GDPR (processing for health or social care purposes etc), the circumstances in which the processing of personal data is carried out subject to the conditions and safeguards referred to in Article 9(3) of the GDPR (obligation of secrecy) include circumstances in which it is carried out—
- (1) For the purposes of Article 9(2)(h) of the UK GDPR (processing for health or social care purposes etc), the circumstances in which the processing of personal data is carried out subject to the conditions and safeguards referred to in Article 9(3) of the UK GDPR (obligation of secrecy) include circumstances in which it is carried out—
- (a) by or under the responsibility of a health professional or a social work professional, or
- (b) by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law.
- (2) In Article 10 of the GDPR and section 10, references to personal data relating to criminal convictions and offences or related security measures include personal data relating to—
- (2) In Article 10 of the UK GDPR and section 10, references to personal data relating to criminal convictions and offences or related security measures include personal data relating to—
- (a) the alleged commission of offences by the data subject, or
@@ -302,9 +296,9 @@
- (1) The Secretary of State may by regulations specify limits on the fees that a controller may charge in reliance on—
- (a) Article 12(5) of the GDPR (reasonable fees when responding to manifestly unfounded or excessive requests), or
- (b) Article 15(3) of the GDPR (reasonable fees for provision of further copies).
- (a) Article 12(5) of the UK GDPR (reasonable fees when responding to manifestly unfounded or excessive requests), or
- (b) Article 15(3) of the UK GDPR (reasonable fees for provision of further copies).
- (2) The Secretary of State may by regulations—
@@ -320,15 +314,15 @@
- (1) This section applies where a controller is a credit reference agency (within the meaning of section 145(8) of the Consumer Credit Act 1974).
- (2) The controller's obligations under Article 15(1) to (3) of the GDPR (confirmation of processing, access to data and safeguards for third country transfers) are taken to apply only to personal data relating to the data subject's financial standing, unless the data subject has indicated a contrary intention.
- (3) Where the controller discloses personal data in pursuance of Article 15(1) to (3) of the GDPR, the disclosure must be accompanied by a statement informing the data subject of the data subject's rights under section 159 of the Consumer Credit Act 1974 (correction of wrong information).
- (2) The controller's obligations under Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) are taken to apply only to personal data relating to the data subject's financial standing, unless the data subject has indicated a contrary intention.
- (3) Where the controller discloses personal data in pursuance of Article 15(1) to (3) of the UK GDPR, the disclosure must be accompanied by a statement informing the data subject of the data subject's rights under section 159 of the Consumer Credit Act 1974 (correction of wrong information).
#### Automated decision-making authorised by law: safeguards
##### 14
- (1) This section makes provision for the purposes of Article 22(2)(b) of the GDPR (exception from Article 22(1) of the GDPR for significant decisions based solely on automated processing that are authorised by law and subject to safeguards for the data subject's rights, freedoms and legitimate interests).
- (1) This section makes provision for the purposes of Article 22(2)(b) of the UK GDPR (exception from Article 22(1) of the UK GDPR for significant decisions based solely on automated processing that are required or authorised under the law of the United Kingdom or a part of the United Kingdom and subject to safeguards for the data subject's rights, freedoms and legitimate interests).
- (2) A decision is a “*significant decision*” for the purposes of this section if, in relation to a data subject, it—
@@ -342,7 +336,7 @@
- (b) it is required or authorised by law, and
- (c) it does not fall within Article 22(2)(a) or (c) of the GDPR (decisions necessary to a contract or made with the data subject's consent).
- (c) it does not fall within Article 22(2)(a) or (c) of the UK GDPR (decisions necessary to a contract or made with the data subject's consent).
- (4) Where a controller takes a qualifying significant decision in relation to a data subject based solely on automated processing—
@@ -354,7 +348,7 @@
- (ii) take a new decision that is not based solely on automated processing.
- (5) If a request is made to a controller under subsection (4), the controller must, within the period described in Article 12(3) of the GDPR—
- (5) If a request is made to a controller under subsection (4), the controller must, within the period described in Article 12(3) of the UK GDPR—
- (a) consider the request, including any information provided by the data subject that is relevant to it,
@@ -366,7 +360,7 @@
- (ii) the outcome of complying with the request.
- (6) In connection with this section, a controller has the powers and obligations under Article 12 of the GDPR (transparency, procedure for extending time for acting on request, fees, manifestly unfounded or excessive requests etc) that apply in connection with Article 22 of the GDPR.
- (6) In connection with this section, a controller has the powers and obligations under Article 12 of the UK GDPR (transparency, procedure for extending time for acting on request, fees, manifestly unfounded or excessive requests etc) that apply in connection with Article 22 of the UK GDPR.
- (7) The Secretary of State may by regulations make such further provision as the Secretary of State considers appropriate to provide suitable measures to safeguard a data subject's rights, freedoms and legitimate interests in connection with the taking of qualifying significant decisions based solely on automated processing.
@@ -376,45 +370,47 @@
- (b) are subject to the affirmative resolution procedure.
### Restrictions on data subject's rights
### Exemptions etc
#### Exemptions etc
##### 15
- (1) Schedules 2, 3 and 4 make provision for exemptions from, and restrictions and adaptations of the application of, rules of the GDPR.
- (1) Schedules 2, 3 and 4 make provision for exemptions from, and restrictions and adaptations of the application of, rules of the UK GDPR.
- (2) In Schedule 2—
- (a) Part 1 makes provision adapting or restricting the application of rules contained in Articles 13 to 21 and 34 of the GDPR in specified circumstances, as allowed for by Article 6(3) and Article 23(1) of the GDPR;
- (b) Part 2 makes provision restricting the application of rules contained in Articles 13 to 21 and 34 of the GDPR in specified circumstances, as allowed for by Article 23(1) of the GDPR;
- (c) Part 3 makes provision restricting the application of Article 15 of the GDPR where this is necessary to protect the rights of others, as allowed for by Article 23(1) of the GDPR;
- (d) Part 4 makes provision restricting the application of rules contained in Articles 13 to 15 of the GDPR in specified circumstances, as allowed for by Article 23(1) of the GDPR;
- (e) Part 5 makes provision containing exemptions or derogations from Chapters II, III, IV, V and VII of the GDPR for reasons relating to freedom of expression, as allowed for by Article 85(2) of the GDPR;
- (f) Part 6 makes provision containing derogations from rights contained in Articles 15, 16, 18, 19, 20 and 21 of the GDPR for scientific or historical research purposes, statistical purposes and archiving purposes, as allowed for by Article 89(2) and (3) of the GDPR.
- (3) Schedule 3 makes provision restricting the application of rules contained in Articles 13 to 21 of the GDPR to health, social work, education and child abuse data, as allowed for by Article 23(1) of the GDPR.
- (4) Schedule 4 makes provision restricting the application of rules contained in Articles 13 to 21 of the GDPR to information the disclosure of which is prohibited or restricted by an enactment, as allowed for by Article 23(1) of the GDPR.
- (5) In connection with the safeguarding of national security and with defence, see Chapter 3 of this Part and the exemption in section 26.
- (a) Part 1 makes provision adapting or restricting the application of rules contained in Articles 13 to 21 and 34 of the UK GDPR in specified circumstances (of a kind described in Article 6(3) and Article 23(1) of the UK GDPR);
- (b) Part 2 makes provision restricting the application of rules contained in Articles 13 to 21 and 34 of the UK GDPR in specified circumstances (of a kind described in Article 23(1) of the UK GDPR);
- (c) Part 3 makes provision restricting the application of Article 15 of the UK GDPR where this is necessary to protect the rights of others (of a kind described in Article 23(1) of the UK GDPR);
- (d) Part 4 makes provision restricting the application of rules contained in Articles 13 to 15 of the UK GDPR in specified circumstances (of a kind described in Article 23(1) of the UK GDPR);
- (e) Part 5 makes provision containing exemptions or derogations from Chapters II, III, IV and V of the UK GDPR for reasons relating to freedom of expression (of a kind described in Article 85(2) of the UK GDPR);
- (f) Part 6 makes provision containing derogations from rights contained in Articles 15, 16, 18, 19, 20 and 21 of the UK GDPR for scientific or historical research purposes, statistical purposes and archiving purposes ....
- (3) Schedule 3 makes provision restricting the application of rules contained in Articles 13 to 21 of the UK GDPR to health, social work, education and child abuse data (of a kind described in Article 23(1) of the UK GDPR).
- (4) Schedule 4 makes provision restricting the application of rules contained in Articles 13 to 21 of the UK GDPR to information the disclosure of which is prohibited or restricted by an enactment (of a kind described in Article 23(1) of the UK GDPR).
- (4A) In connection with the manual unstructured processing of personal data held by an FOI public authority, see Chapter 3 of this Part (sections 21, 24 and 25).
- (5) In connection with the safeguarding of national security and with defence, see Chapter 3 of this Part (sections 26 to 28).
#### Power to make further exemptions etc by regulations
##### 16
- (1) The following powers to make provision altering the application of the GDPR may be exercised by way of regulations made by the Secretary of State under this section—
- (a) the power in Article 6(3) for Member State law to lay down a legal basis containing specific provisions to adapt the application of rules of the GDPR where processing is necessary for compliance with a legal obligation, for the performance of a task in the public interest or in the exercise of official authority;
- (b) the power in Article 23(1) to make a legislative measure restricting the scope of the obligations and rights mentioned in that Article where necessary and proportionate to safeguard certain objectives of general public interest;
- (c) the power in Article 85(2) to provide for exemptions or derogations from certain Chapters of the GDPR where necessary to reconcile the protection of personal data with the freedom of expression and information.
- (1) The following powers to make provision altering the application of the UK GDPR may be exercised by way of regulations made by the Secretary of State under this section—
- (a) the power in Article 6(3) ... to lay down a legal basis containing specific provisions to adapt the application of rules of the UK GDPR where processing is necessary for compliance with a legal obligation, for the performance of a task in the public interest or in the exercise of official authority;
- (b) the power in Article 23(1) to make provision restricting the scope of the obligations and rights mentioned in that Article where necessary and proportionate to safeguard certain objectives of general public interest;
- (c) the power in Article 85(2) to provide for exemptions or derogations from certain Chapters of the UK GDPR where necessary to reconcile the protection of personal data with the freedom of expression and information.
- (2) Regulations under this section may—
@@ -422,13 +418,15 @@
- (i) by adding or varying provisions, and
- (ii) by omitting provisions added by regulations under this section, and
- (b) consequentially amend section 15.
- (ii) by omitting provisions added by regulations under this section, ...
- (b) consequentially amend section 15 , and
- (c) consequentially amend the UK GDPR by adding, varying or omitting a reference to section 15, Schedule 2, 3 or 4, this section or regulations under this section.
- (3) Regulations under this section are subject to the affirmative resolution procedure.
### Accreditation of certification providers
### Certification
#### Accreditation of certification providers
@@ -438,7 +436,7 @@
- (a) the Commissioner, or
- (b) the national accreditation body.
- (b) the UK national accreditation body.
- (2) The Commissioner may only accredit a person as a certification provider where the Commissioner—
@@ -446,7 +444,7 @@
- (b) has not published a notice withdrawing that statement.
- (3) The national accreditation body may only accredit a person as a certification provider where the Commissioner—
- (3) The UK national accreditation body may only accredit a person as a certification provider where the Commissioner—
- (a) has published a statement that the body may carry out such accreditation, and
@@ -456,15 +454,15 @@
- (5) Schedule 5 makes provision about reviews of, and appeals from, a decision relating to accreditation of a person as a certification provider.
- (6) The national accreditation body may charge a reasonable fee in connection with, or incidental to, the carrying out of the body's functions under this section, Schedule 5 and Article 43 of the GDPR.
- (7) The national accreditation body must provide the Secretary of State with such information relating to its functions under this section, Schedule 5 and Article 43 of the GDPR as the Secretary of State may reasonably require.
- (6) The UK national accreditation body may charge a reasonable fee in connection with, or incidental to, the carrying out of the body's functions under this section, Schedule 5 and Article 43 of the UK GDPR.
- (7) The UK national accreditation body must provide the Secretary of State with such information relating to its functions under this section, Schedule 5 and Article 43 of the UK GDPR as the Secretary of State may reasonably require.
- (8) In this section—
- “*certification provider*” means a person who issues certification for the purposes of Article 42 of the GDPR;
- “*the national accreditation body*” means the national accreditation body for the purposes of Article 4(1) of Regulation [(EC) No 765/2008](https://www.legislation.gov.uk/european/regulation/2008/0765) of the European Parliament and of the Council of 9 July 2008 setting out the requirements for accreditation and market surveillance relating to the marketing of products and repealing Regulation [(EEC) No 339/93](https://www.legislation.gov.uk/european/regulation/1993/0339).
- “*certification provider*” means a person who issues certification for the purposes of Article 42 of the UK GDPR;
- “*the UK national accreditation body*” means the UK national accreditation body for the purposes of Article 4(1) of Regulation [(EC) No 765/2008](https://www.legislation.gov.uk/eur/2008/765) of the European Parliament and of the Council of 9 July 2008 setting out the requirements for accreditation and market surveillance relating to the marketing of products and repealing Regulation [(EEC) No 339/93](https://www.legislation.gov.uk/eur/1993/339).
### Transfers of personal data to third countries etc
@@ -472,7 +470,7 @@
##### 18
- (1) The Secretary of State may by regulations specify, for the purposes of Article 49(1)(d) of the GDPR—
- (1) The Secretary of State may by regulations specify, for the purposes of Article 49(1)(d) of the UK GDPR—
- (a) circumstances in which a transfer of personal data to a third country or international organisation is to be taken to be necessary for important reasons of public interest, and
@@ -480,7 +478,7 @@
- (2) The Secretary of State may by regulations restrict the transfer of a category of personal data to a third country or international organisation where—
- (a) the transfer is not authorised by an adequacy decision under Article 45(3) of the GDPR, and
- (a) the transfer cannot take place based on adequacy regulations (see section 17A), and
- (b) the Secretary of State considers the restriction to be necessary for important reasons of public interest.
@@ -506,7 +504,7 @@
- (c) processing of personal data that is necessary for statistical purposes.
- (2) Such processing does not satisfy the requirement in Article 89(1) of the GDPR for the processing to be subject to appropriate safeguards for the rights and freedoms of the data subject if it is likely to cause substantial damage or substantial distress to a data subject.
- (2) Such processing does not satisfy the requirement in Article 89(1) of the UK GDPR for the processing to be subject to appropriate safeguards for the rights and freedoms of the data subject if it is likely to cause substantial damage or substantial distress to a data subject.
- (3) Such processing does not satisfy that requirement if the processing is carried out for the purposes of measures or decisions with respect to a particular data subject, unless the purposes for which the processing is necessary include the purposes of approved medical research.
@@ -526,5047 +524,5011 @@
##### 20
Section 5(1) (terms used in this Chapter to have the same meaning as in the GDPR) does not apply to references in this Chapter to a court and, accordingly, such references do not include a tribunal.
### CHAPTER 3 — Other general processing
Section 5(1) (terms used in this Part to have the same meaning as in the UK GDPR) does not apply to references in this Part to a court and, accordingly, such references do not include a tribunal.
### CHAPTER 3 — Exemptions for manual unstructured processing and for national security and defence purposes
### Definitions
#### Processing to which this Chapter applies
##### 21
- (1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (4) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (5) In this Chapter, “*FOI public authority*” means—
- (a) a public authority as defined in the Freedom of Information Act 2000, or
- (b) a Scottish public authority as defined in the Freedom of Information (Scotland) Act 2002 (asp 13).
- (6) References in this Chapter to personal data “held” by an FOI public authority are to be interpreted—
- (a) in relation to England and Wales and Northern Ireland, in accordance with section 3(2) of the Freedom of Information Act 2000, and
- (b) in relation to Scotland, in accordance with section 3(2), (4) and (5) of the Freedom of Information (Scotland) Act 2002 (asp 13),
but such references do not include information held by an intelligence service (as defined in section 82) on behalf of an FOI public authority.
- (7) But personal data is not to be treated as “held” by an FOI public authority for the purposes of this Chapter, where—
- (a) section 7 of the Freedom of Information Act 2000 prevents Parts 1 to 5 of that Act from applying to the personal data, or
- (b) section 7(1) of the Freedom of Information (Scotland) Act 2002 (asp 13) prevents that Act from applying to the personal data.
### ...
#### Application of the GDPR to processing to which this Chapter applies
##### 22
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### Power to make provision in consequence of regulations related to the GDPR
##### 23
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
### Exemptions etc
#### Manual unstructured data held by FOI public authorities
##### 24
- (1) The provisions of the UK GDPR and this Act listed in subsection (2) do not apply to personal data to which the UK GDPR applies by virtue of Article 2(1A) (manual unstructured personal data held by FOI public authorities).
- (2) Those provisions are—
- (a) in Chapter II of the UK GDPR (principles)—
- (i) Article 5(1)(a) to (c), (e) and (f) (principles relating to processing, other than the accuracy principle),
- (ii) Article 6 (lawfulness),
- (iii) Article 7 (conditions for consent),
- (iv) Article 8(1) and (2) (child's consent),
- (v) Article 9 (processing of special categories of personal data),
- (vi) Article 10 (data relating to criminal convictions etc), and
- (vii) Article 11(2) (processing not requiring identification);
- (b) in Chapter III of the UK GDPR (rights of the data subject)—
- (i) Article 13(1) to (3) (personal data collected from data subject: information to be provided),
- (ii) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided),
- (iii) Article 20 (right to data portability), and
- (iv) Article 21(1) (objections to processing);
- (c) in Chapter V of the UK GDPR, Articles 44 to 49 (transfers of personal data to third countries or international organisations);
- (ca) in Part 2 of this Act, sections 17A, 17B and 17C (transfers to third countries);
- (cb) in Part 5 of this Act, section 119A (standard clauses for transfers to third countries);
- (d) in Part 7 of this Act, sections 170 and 171 (offences relating to personal data).
(see also paragraph 1(2) of Schedule 18).
- (3) In addition, the provisions of the UK GDPR listed in subsection (4) do not apply to personal data to which the UK GDPR applies by virtue of Article 2(1A) where the personal data relates to appointments, removals, pay, discipline, superannuation or other personnel matters in relation to—
- (a) service in any of the armed forces of the Crown;
- (b) service in any office or employment under the Crown or under any public authority;
- (c) service in any office or employment, or under any contract for services, in respect of which power to take action, or to determine or approve the action taken, in such matters is vested in—
- (i) Her Majesty,
- (ii) a Minister of the Crown,
- (iii) the National Assembly for Wales,
- (iv) the Welsh Ministers,
- (v) a Northern Ireland Minister (within the meaning of the Freedom of Information Act 2000), or
- (vi) an FOI public authority.
- (4) Those provisions are—
- (a) the remaining provisions of Chapters II and III (principles and rights of the data subject);
- (b) Chapter IV (controller and processor);
- (c) Chapter IX (specific processing situations).
- (5) A controller is not obliged to comply with Article 15(1) to (3) of the UK GDPR (right of access by the data subject) in relation to personal data to which the UK GDPR applies by virtue of Article 2(1A) if—
- (a) the request under Article 15 does not contain a description of the personal data, or
- (b) the controller estimates that the cost of complying with the request so far as relating to the personal data would exceed the appropriate maximum.
- (6) Subsection (5)(b) does not remove the controller's obligation to confirm whether or not personal data concerning the data subject is being processed unless the estimated cost of complying with that obligation alone in relation to the personal data would exceed the appropriate maximum.
- (7) An estimate for the purposes of this section must be made in accordance with regulations under section 12(5) of the Freedom of Information Act 2000.
- (8) In subsections (5) and (6), “*the appropriate maximum*” means the maximum amount specified by the Secretary of State by regulations.
- (9) Regulations under subsection (8) are subject to the negative resolution procedure.
#### Manual unstructured data used in longstanding historical research
##### 25
- (1) The provisions of the UK GDPR listed in subsection (2) do not apply to personal data to which the UK GDPR applies by virtue of Article 2(1A) (manual unstructured personal data held by FOI public authorities) at any time when—
- (a) the personal data—
- (i) is subject to processing which was already underway immediately before 24 October 1998, and
- (ii) is processed only for the purposes of historical research, and
- (b) the processing is not carried out—
- (i) for the purposes of measures or decisions with respect to a particular data subject, or
- (ii) in a way that causes, or is likely to cause, substantial damage or substantial distress to a data subject.
- (2) Those provisions are—
- (a) in Chapter II ...(principles), Article 5(1)(d) (the accuracy principle), and
- (b) in Chapter III ... (rights of the data subject)—
- (i) Article 16 (right to rectification), and
- (ii) Article 17(1) and (2) (right to erasure).
- (3) The exemptions in this section apply in addition to the exemptions in section 24.
#### National security and defence exemption
##### 26
- (1) A provision of the UK GDPR or this Act mentioned in subsection (2) does not apply to personal data to which the UK GDPR applies if exemption from the provision is required for—
- (a) the purpose of safeguarding national security, or
- (b) defence purposes.
- (2) The provisions are—
- (a) Chapter II of the UK GDPR (principles) except for—
- (i) Article 5(1)(a) (lawful, fair and transparent processing), so far as it requires processing of personal data to be lawful;
- (ii) Article 6 (lawfulness of processing);
- (iii) Article 9 (processing of special categories of personal data);
- (b) Chapter III of the UK GDPR (rights of data subjects);
- (c) in Chapter IV of the UK GDPR—
- (i) Article 33 (notification of personal data breach to the Commissioner);
- (ii) Article 34 (communication of personal data breach to the data subject);
- (d) Chapter V of the UK GDPR (transfers of personal data to third countries or international organisations);
- (e) in Chapter VI of the UK GDPR—
- (i) Article 57(1)(a) and (h) (Commissioner's duties to monitor and enforce the UK GDPR and to conduct investigations);
- (ii) Article 58 (investigative, corrective, authorisation and advisory powers of Commissioner);
- (f) Chapter VIII of the UK GDPR (remedies, liabilities and penalties) except for—
- (i) Article 83 (general conditions for imposing administrative fines);
- (ii) Article 84 (penalties);
- (fa) in Part 2 of this Act, sections 17A, 17B and 17C (transfers to third countries);
- (g) in Part 5 of this Act—
- (i) in section 115 (general functions of the Commissioner), subsections (3) and (8);
- (ii) in section 115, subsection (9), so far as it relates to Article 58(2)(i) of the UK GDPR;
- (iii) section 119 (inspection in accordance with international obligations);
- (iv) section 119A (standard clauses for transfers to third countries);
- (h) in Part 6 of this Act—
- (i) sections 142 to 154 and Schedule 15 (Commissioner's notices and powers of entry and inspection);
- (ii) sections 170 to 173 (offences relating to personal data);
- (i) in Part 7 of this Act, section 187 (representation of data subjects).
#### National security: certificate
##### 27
- (1) Subject to subsection (3), a certificate signed by a Minister of the Crown certifying that exemption from all or any of the provisions listed in section 26(2) is, or at any time was, required in relation to any personal data for the purpose of safeguarding national security is conclusive evidence of that fact.
- (2) A certificate under subsection (1)—
- (a) may identify the personal data to which it applies by means of a general description, and
- (b) may be expressed to have prospective effect.
- (3) Any person directly affected by a certificate under subsection (1) may appeal to the Tribunal against the certificate.
- (4) If, on an appeal under subsection (3), the Tribunal finds that, applying the principles applied by a court on an application for judicial review, the Minister did not have reasonable grounds for issuing a certificate, the Tribunal may—
- (a) allow the appeal, and
- (b) quash the certificate.
- (5) Where, in any proceedings under or by virtue of the UK GDPR or this Act, it is claimed by a controller that a certificate under subsection (1) which identifies the personal data to which it applies by means of a general description applies to any personal data, another party to the proceedings may appeal to the Tribunal on the ground that the certificate does not apply to the personal data in question.
- (6) But, subject to any determination under subsection (7), the certificate is to be conclusively presumed so to apply.
- (7) On an appeal under subsection (5), the Tribunal may determine that the certificate does not so apply.
- (8) A document purporting to be a certificate under subsection (1) is to be—
- (a) received in evidence, and
- (b) deemed to be such a certificate unless the contrary is proved.
- (9) A document which purports to be certified by or on behalf of a Minister of the Crown as a true copy of a certificate issued by that Minister under subsection (1) is—
- (a) in any legal proceedings, evidence of that certificate;
- (b) in any legal proceedings in Scotland, sufficient evidence of that certificate.
- (10) The power conferred by subsection (1) on a Minister of the Crown is exercisable only by—
- (a) a Minister who is a member of the Cabinet, or
- (b) the Attorney General or the Advocate General for Scotland.
#### National security and defence: modifications to Articles 9 and 32 of the applied GDPR
##### 28
- (1) Article 9(1) of the UK GDPR (prohibition on processing of special categories of personal data) does not prohibit the processing of personal data to which the UK GDPR applies to the extent that the processing is carried out—
- (a) for the purpose of safeguarding national security or for defence purposes, and
- (b) with appropriate safeguards for the rights and freedoms of data subjects.
- (2) Article 32 of the UK GDPR (security of processing) does not apply to a controller or processor to the extent that the controller or the processor (as the case may be) is processing personal data to which the UK GDPR applies for—
- (a) the purpose of safeguarding national security, or
- (b) defence purposes.
- (3) Where Article 32 of the UK GDPR does not apply, the controller or the processor must implement security measures appropriate to the risks arising from the processing of the personal data.
- (4) For the purposes of subsection (3), where the processing of personal data is carried out wholly or partly by automated means, the controller or the processor must, following an evaluation of the risks, implement measures designed to—
- (a) prevent unauthorised processing or unauthorised interference with the systems used in connection with the processing,
- (b) ensure that it is possible to establish the precise details of any processing that takes place,
- (c) ensure that any systems used in connection with the processing function properly and may, in the case of interruption, be restored, and
- (d) ensure that stored personal data cannot be corrupted if a system used in connection with the processing malfunctions.
- (5) The functions conferred on the Commissioner in relation to the UK GDPR by Articles 57(1)(a), (d), (e), (h) and (u) and 58(1)(d) and (2)(a) to (d) of the UK GDPR (which are subject to safeguards set out in section 115) include functions in relation to subsection (3).
## PART 3 — Law enforcement processing
### CHAPTER 1 — Scope and definitions
### Scope
#### Processing to which this Chapter applies
##### 21
- (1) This Chapter applies to the automated or structured processing of personal data in the course of—
- (a) an activity which is outside the scope of European Union law, or
- (b) an activity which falls within the scope of Article 2(2)(b) of the GDPR (common foreign and security policy activities),
provided that the processing is not processing by a competent authority for any of the law enforcement purposes (as defined in Part 3) or processing to which Part 4 (intelligence services processing) applies.
- (2) This Chapter also applies to the manual unstructured processing of personal data held by an FOI public authority.
- (3) This Chapter does not apply to the processing of personal data by an individual in the course of a purely personal or household activity.
- (4) In this section—
- “*the automated or structured processing of personal data*” means—the processing of personal data wholly or partly by automated means, andthe processing otherwise than by automated means of personal data which forms part of a filing system or is intended to form part of a filing system;
- “*the manual unstructured processing of personal data*” means the processing of personal data which is not the automated or structured processing of personal data.
- (5) In this Chapter, “*FOI public authority*” means—
- (a) a public authority as defined in the Freedom of Information Act 2000, or
- (b) a Scottish public authority as defined in the Freedom of Information (Scotland) Act 2002 (asp 13).
- (6) References in this Chapter to personal data “held” by an FOI public authority are to be interpreted—
- (a) in relation to England and Wales and Northern Ireland, in accordance with section 3(2) of the Freedom of Information Act 2000, and
- (b) in relation to Scotland, in accordance with section 3(2), (4) and (5) of the Freedom of Information (Scotland) Act 2002 (asp 13),
but such references do not include information held by an intelligence service (as defined in section 82) on behalf of an FOI public authority.
- (7) But personal data is not to be treated as “held” by an FOI public authority for the purposes of this Chapter, where—
- (a) section 7 of the Freedom of Information Act 2000 prevents Parts 1 to 5 of that Act from applying to the personal data, or
- (b) section 7(1) of the Freedom of Information (Scotland) Act 2002 (asp 13) prevents that Act from applying to the personal data.
### Application of the GDPR
#### Application of the GDPR to processing to which this Chapter applies
##### 22
- (1) The GDPR applies to the processing of personal data to which this Chapter applies but as if its Articles were part of an Act extending to England and Wales, Scotland and Northern Ireland.
- (2) Chapter 2 of this Part applies for the purposes of the applied GDPR as it applies for the purposes of the GDPR.
- (3) In this Chapter, “*the applied Chapter 2*” means Chapter 2 of this Part as applied by this Chapter.
- (4) Schedule 6 contains provision modifying—
- (a) the GDPR as it applies by virtue of subsection (1) (see Part 1);
- (b) Chapter 2 of this Part as it applies by virtue of subsection (2) (see Part 2).
- (5) A question as to the meaning or effect of a provision of the applied GDPR, or the applied Chapter 2 , is to be determined consistently with the interpretation of the equivalent provision of the GDPR, or Chapter 2 of this Part, as it applies otherwise than by virtue of this Chapter, except so far as Schedule 6 requires a different interpretation.
#### Power to make provision in consequence of regulations related to the GDPR
##### 23
- (1) The Secretary of State may by regulations make provision in connection with the processing of personal data to which this Chapter applies which is equivalent to that made by GDPR regulations, subject to such modifications as the Secretary of State considers appropriate.
- (2) In this section, “*GDPR regulations*” means regulations made under section 2(2) of the European Communities Act 1972 which make provision relating to the GDPR.
- (3) Regulations under subsection (1) may apply a provision of GDPR regulations, with or without modification.
- (4) Regulations under subsection (1) may amend or repeal a provision of—
- (a) the applied GDPR;
- (b) this Chapter;
- (c) Parts 5 to 7, in so far as they apply in relation to the applied GDPR.
- (5) Regulations under this section are subject to the affirmative resolution procedure.
### Exemptions etc
#### Manual unstructured data held by FOI public authorities
##### 24
- (1) The provisions of the applied GDPR and this Act listed in subsection (2) do not apply to personal data to which this Chapter applies by virtue of section 21(2) (manual unstructured personal data held by FOI public authorities).
#### Processing to which this Part applies
##### 29
- (1) This Part applies to—
- (a) the processing by a competent authority of personal data wholly or partly by automated means, and
- (b) the processing by a competent authority otherwise than by automated means of personal data which forms part of a filing system or is intended to form part of a filing system.
- (2) Any reference in this Part to the processing of personal data is to processing to which this Part applies.
- (3) For the meaning of “competent authority”, see section 30.
### Definitions
#### Meaning of “competent authority”
##### 30
- (1) In this Part, “*competent authority*” means—
- (a) a person specified or described in Schedule 7, and
- (b) any other person if and to the extent that the person has statutory functions for any of the law enforcement purposes.
- (2) But an intelligence service is not a competent authority within the meaning of this Part.
- (3) The Secretary of State may by regulations amend Schedule 7—
- (a) so as to add or remove a person or description of person;
- (b) so as to reflect any change in the name of a person specified in the Schedule.
- (4) Regulations under subsection (3) which make provision of the kind described in subsection (3)(a) may also make consequential amendments of section 73(4)(b).
- (5) Regulations under subsection (3) which make provision of the kind described in subsection (3)(a), or which make provision of that kind and of the kind described in subsection (3)(b), are subject to the affirmative resolution procedure.
- (6) Regulations under subsection (3) which make provision only of the kind described in subsection (3)(b) are subject to the negative resolution procedure.
- (7) In this section—
- “*intelligence service*” means—the Security Service;the Secret Intelligence Service;the Government Communications Headquarters;
- “*statutory function*” means a function under or by virtue of an enactment.
#### “The law enforcement purposes”
##### 31
For the purposes of this Part, “the law enforcement purposes” are the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.
#### Meaning of “controller” and “processor”
##### 32
- (1) In this Part, “*controller*” means the competent authority which, alone or jointly with others—
- (a) determines the purposes and means of the processing of personal data, or
- (b) is the controller by virtue of subsection (2).
- (2) Where personal data is processed only—
- (a) for purposes for which it is required by an enactment to be processed, and
- (b) by means by which it is required by an enactment to be processed,
the competent authority on which the obligation to process the data is imposed by the enactment (or, if different, one of the enactments) is the controller.
- (3) In this Part, “*processor*” means any person who processes personal data on behalf of the controller (other than a person who is an employee of the controller).
#### Other definitions
##### 33
- (1) This section defines certain other expressions used in this Part.
- (2) “*Employee*”, in relation to any person, includes an individual who holds a position (whether paid or unpaid) under the direction and control of that person.
- (3) “*Personal data breach*” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.
- (4) “*Profiling*” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to an individual, in particular to analyse or predict aspects concerning that individual's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
- (5) “*Recipient*”, in relation to any personal data, means any person to whom the data is disclosed, whether a third party or not, but it does not include a public authority to whom disclosure is or may be made in the framework of a particular inquiry in accordance with the law.
- (6) “*Restriction of processing*” means the marking of stored personal data with the aim of limiting its processing for the future.
- (7) “*Third country*” means a country or territory outside the United Kingdom.
- (8) Sections 3 and 205 include definitions of other expressions used in this Part.
### CHAPTER 2 — Principles
#### Overview and general duty of controller
##### 34
- (1) This Chapter sets out the six data protection principles as follows—
- (a) section 35(1) sets out the first data protection principle (requirement that processing be lawful and fair);
- (b) section 36(1) sets out the second data protection principle (requirement that purposes of processing be specified, explicit and legitimate);
- (c) section 37 sets out the third data protection principle (requirement that personal data be adequate, relevant and not excessive);
- (d) section 38(1) sets out the fourth data protection principle (requirement that personal data be accurate and kept up to date);
- (e) section 39(1) sets out the fifth data protection principle (requirement that personal data be kept for no longer than is necessary);
- (f) section 40 sets out the sixth data protection principle (requirement that personal data be processed in a secure manner).
- (2) In addition—
- (a) each of sections 35, 36, 38 and 39 makes provision to supplement the principle to which it relates, and
- (b) sections 41 and 42 make provision about the safeguards that apply in relation to certain types of processing.
- (3) The controller in relation to personal data is responsible for, and must be able to demonstrate, compliance with this Chapter.
#### The first data protection principle
##### 35
- (1) The first data protection principle is that the processing of personal data for any of the law enforcement purposes must be lawful and fair.
- (2) The processing of personal data for any of the law enforcement purposes is lawful only if and to the extent that it is based on law and either—
- (a) the data subject has given consent to the processing for that purpose, or
- (b) the processing is necessary for the performance of a task carried out for that purpose by a competent authority.
- (3) In addition, where the processing for any of the law enforcement purposes is sensitive processing, the processing is permitted only in the two cases set out in subsections (4) and (5).
- (4) The first case is where—
- (a) the data subject has given consent to the processing for the law enforcement purpose as mentioned in subsection (2)(a), and
- (b) at the time when the processing is carried out, the controller has an appropriate policy document in place (see section 42).
- (5) The second case is where—
- (a) the processing is strictly necessary for the law enforcement purpose,
- (b) the processing meets at least one of the conditions in Schedule 8, and
- (c) at the time when the processing is carried out, the controller has an appropriate policy document in place (see section 42).
- (6) The Secretary of State may by regulations amend Schedule 8—
- (a) by adding conditions;
- (b) by omitting conditions added by regulations under paragraph (a).
- (7) Regulations under subsection (6) are subject to the affirmative resolution procedure.
- (8) In this section, “*sensitive processing*” means—
- (a) the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership;
- (b) the processing of genetic data, or of biometric data, for the purpose of uniquely identifying an individual;
- (c) the processing of data concerning health;
- (d) the processing of data concerning an individual's sex life or sexual orientation.
#### The second data protection principle
##### 36
- (1) The second data protection principle is that—
- (a) the law enforcement purpose for which personal data is collected on any occasion must be specified, explicit and legitimate, and
- (b) personal data so collected must not be processed in a manner that is incompatible with the purpose for which it was collected.
- (2) Paragraph (b) of the second data protection principle is subject to subsections (3) and (4).
- (3) Personal data collected for a law enforcement purpose may be processed for any other law enforcement purpose (whether by the controller that collected the data or by another controller) provided that—
- (a) the controller is authorised by law to process the data for the other purpose, and
- (b) the processing is necessary and proportionate to that other purpose.
- (4) Personal data collected for any of the law enforcement purposes may not be processed for a purpose that is not a law enforcement purpose unless the processing is authorised by law.
#### The third data protection principle
##### 37
The third data protection principle is that personal data processed for any of the law enforcement purposes must be adequate, relevant and not excessive in relation to the purpose for which it is processed.
#### The fourth data protection principle
##### 38
- (1) The fourth data protection principle is that—
- (a) personal data processed for any of the law enforcement purposes must be accurate and, where necessary, kept up to date, and
- (b) every reasonable step must be taken to ensure that personal data that is inaccurate, having regard to the law enforcement purpose for which it is processed, is erased or rectified without delay.
- (2) In processing personal data for any of the law enforcement purposes, personal data based on facts must, so far as possible, be distinguished from personal data based on personal assessments.
- (3) In processing personal data for any of the law enforcement purposes, a clear distinction must, where relevant and as far as possible, be made between personal data relating to different categories of data subject, such as—
- (a) persons suspected of having committed or being about to commit a criminal offence;
- (b) persons convicted of a criminal offence;
- (c) persons who are or may be victims of a criminal offence;
- (d) witnesses or other persons with information about offences.
- (4) All reasonable steps must be taken to ensure that personal data which is inaccurate, incomplete or no longer up to date is not transmitted or made available for any of the law enforcement purposes.
- (5) For that purpose—
- (a) the quality of personal data must be verified before it is transmitted or made available,
- (b) in all transmissions of personal data, the necessary information enabling the recipient to assess the degree of accuracy, completeness and reliability of the data and the extent to which it is up to date must be included, and
- (c) if, after personal data has been transmitted, it emerges that the data was incorrect or that the transmission was unlawful, the recipient must be notified without delay.
#### The fifth data protection principle
##### 39
- (1) The fifth data protection principle is that personal data processed for any of the law enforcement purposes must be kept for no longer than is necessary for the purpose for which it is processed.
- (2) Appropriate time limits must be established for the periodic review of the need for the continued storage of personal data for any of the law enforcement purposes.
#### The sixth data protection principle
##### 40
The sixth data protection principle is that personal data processed for any of the law enforcement purposes must be so processed in a manner that ensures appropriate security of the personal data, using appropriate technical or organisational measures (and, in this principle, “*appropriate security*” includes protection against unauthorised or unlawful processing and against accidental loss, destruction or damage).
#### Safeguards: archiving
##### 41
- (1) This section applies in relation to the processing of personal data for a law enforcement purpose where the processing is necessary—
- (a) for archiving purposes in the public interest,
- (b) for scientific or historical research purposes, or
- (c) for statistical purposes.
- (2) The processing is not permitted if—
- (a) it is carried out for the purposes of, or in connection with, measures or decisions with respect to a particular data subject, or
- (b) it is likely to cause substantial damage or substantial distress to a data subject.
#### Safeguards: sensitive processing
##### 42
- (1) This section applies for the purposes of section 35(4) and (5) (which require a controller to have an appropriate policy document in place when carrying out sensitive processing in reliance on the consent of the data subject or, as the case may be, in reliance on a condition specified in Schedule 8).
- (2) The controller has an appropriate policy document in place in relation to the sensitive processing if the controller has produced a document which—
- (a) explains the controller's procedures for securing compliance with the data protection principles (see section 34(1)) in connection with sensitive processing in reliance on the consent of the data subject or (as the case may be) in reliance on the condition in question, and
- (b) explains the controller's policies as regards the retention and erasure of personal data processed in reliance on the consent of the data subject or (as the case may be) in reliance on the condition in question, giving an indication of how long such personal data is likely to be retained.
- (3) Where personal data is processed on the basis that an appropriate policy document is in place, the controller must during the relevant period—
- (a) retain the appropriate policy document,
- (b) review and (if appropriate) update it from time to time, and
- (c) make it available to the Commissioner, on request, without charge.
- (4) The record maintained by the controller under section 61(1) and, where the sensitive processing is carried out by a processor on behalf of the controller, the record maintained by the processor under section 61(3) must include the following information—
- (a) whether the sensitive processing is carried out in reliance on the consent of the data subject or, if not, which condition in Schedule 8 is relied on,
- (b) how the processing satisfies section 35 (lawfulness of processing), and
- (c) whether the personal data is retained and erased in accordance with the policies described in subsection (2)(b) and, if it is not, the reasons for not following those policies.
- (5) In this section, “*relevant period*”, in relation to sensitive processing in reliance on the consent of the data subject or in reliance on a condition specified in Schedule 8, means a period which—
- (a) begins when the controller starts to carry out the sensitive processing in reliance on the data subject's consent or (as the case may be) in reliance on that condition, and
- (b) ends at the end of the period of 6 months beginning when the controller ceases to carry out the processing.
### CHAPTER 3 — Rights of the data subject
### Overview and scope
#### Overview and scope
##### 43
- (1) This Chapter—
- (a) imposes general duties on the controller to make information available (see section 44);
- (b) confers a right of access by the data subject (see section 45);
- (c) confers rights on the data subject with respect to the rectification of personal data and the erasure of personal data or the restriction of its processing (see sections 46 to 48);
- (d) regulates automated decision-making (see sections 49 and 50);
- (e) makes supplementary provision (see sections 51 to 54).
- (2) This Chapter applies only in relation to the processing of personal data for a law enforcement purpose.
- (3) But sections 44 to 48 do not apply in relation to the processing of relevant personal data in the course of a criminal investigation or criminal proceedings, including proceedings for the purpose of executing a criminal penalty.
- (4) In subsection (3), “*relevant personal data*” means personal data contained in a judicial decision or in other documents relating to the investigation or proceedings which are created by or on behalf of a court or other judicial authority.
- (5) In this Chapter, “*the controller*”, in relation to a data subject, means the controller in relation to personal data relating to the data subject.
### Information: controller's general duties
#### Information: controller’s general duties
##### 44
- (1) The controller must make available to data subjects the following information (whether by making the information generally available to the public or in any other way)—
- (a) the identity and the contact details of the controller;
- (b) where applicable, the contact details of the data protection officer (see sections 69 to 71);
- (c) the purposes for which the controller processes personal data;
- (d) the existence of the rights of data subjects to request from the controller—
- (i) access to personal data (see section 45),
- (ii) rectification of personal data (see section 46), and
- (iii) erasure of personal data or the restriction of its processing (see section 47);
- (e) the existence of the right to lodge a complaint with the Commissioner and the contact details of the Commissioner.
- (2) The controller must also, in specific cases for the purpose of enabling the exercise of a data subject's rights under this Part, give the data subject the following—
- (a) information about the legal basis for the processing;
- (b) information about the period for which the personal data will be stored or, where that is not possible, about the criteria used to determine that period;
- (c) where applicable, information about the categories of recipients of the personal data (including recipients in third countries or international organisations);
- (d) such further information as is necessary to enable the exercise of the data subject's rights under this Part.
- (3) An example of where further information may be necessary as mentioned in subsection (2)(d) is where the personal data being processed was collected without the knowledge of the data subject.
- (4) The controller may restrict, wholly or partly, the provision of information to the data subject under subsection (2) to the extent that and for so long as the restriction is, having regard to the fundamental rights and legitimate interests of the data subject, a necessary and proportionate measure to—
- (a) avoid obstructing an official or legal inquiry, investigation or procedure;
- (b) avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;
- (c) protect public security;
- (d) protect national security;
- (e) protect the rights and freedoms of others.
- (5) Where the provision of information to a data subject under subsection (2) is restricted, wholly or partly, the controller must inform the data subject in writing without undue delay—
- (a) that the provision of information has been restricted,
- (b) of the reasons for the restriction,
- (c) of the data subject's right to make a request to the Commissioner under section 51,
- (d) of the data subject's right to lodge a complaint with the Commissioner, and
- (e) of the data subject's right to apply to a court under section 167.
- (6) Subsection (5)(a) and (b) do not apply to the extent that complying with them would undermine the purpose of the restriction.
- (7) The controller must—
- (a) record the reasons for a decision to restrict (whether wholly or partly) the provision of information to a data subject under subsection (2), and
- (b) if requested to do so by the Commissioner, make the record available to the Commissioner.
### Data subject's right of access
#### Right of access by the data subject
##### 45
- (1) A data subject is entitled to obtain from the controller—
- (a) confirmation as to whether or not personal data concerning him or her is being processed, and
- (b) where that is the case, access to the personal data and the information set out in subsection (2).
- (2) That information is—
- (a) the purposes of and legal basis for the processing;
- (b) the categories of personal data concerned;
- (c) the recipients or categories of recipients to whom the personal data has been disclosed (including recipients or categories of recipients in third countries or international organisations);
- (d) the period for which it is envisaged that the personal data will be stored or, where that is not possible, the criteria used to determine that period;
- (e) the existence of the data subject's rights to request from the controller—
- (i) rectification of personal data (see section 46), and
- (ii) erasure of personal data or the restriction of its processing (see section 47);
- (f) the existence of the data subject's right to lodge a complaint with the Commissioner and the contact details of the Commissioner;
- (g) communication of the personal data undergoing processing and of any available information as to its origin.
- (3) Where a data subject makes a request under subsection (1), the information to which the data subject is entitled must be provided in writing —
- (a) without undue delay, and
- (b) in any event, before the end of the applicable time period (as to which see section 54).
- (4) The controller may restrict, wholly or partly, the rights conferred by subsection (1) to the extent that and for so long as the restriction is, having regard to the fundamental rights and legitimate interests of the data subject, a necessary and proportionate measure to—
- (a) avoid obstructing an official or legal inquiry, investigation or procedure;
- (b) avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;
- (c) protect public security;
- (d) protect national security;
- (e) protect the rights and freedoms of others.
- (5) Where the rights of a data subject under subsection (1) are restricted, wholly or partly, the controller must inform the data subject in writing without undue delay—
- (a) that the rights of the data subject have been restricted,
- (b) of the reasons for the restriction,
- (c) of the data subject's right to make a request to the Commissioner under section 51,
- (d) of the data subject's right to lodge a complaint with the Commissioner, and
- (e) of the data subject's right to apply to a court under section 167.
- (6) Subsection (5)(a) and (b) do not apply to the extent that the provision of the information would undermine the purpose of the restriction.
- (7) The controller must—
- (a) record the reasons for a decision to restrict (whether wholly or partly) the rights of a data subject under subsection (1), and
- (b) if requested to do so by the Commissioner, make the record available to the Commissioner.
### Data subject's rights to rectification or erasure etc
#### Right to rectification
##### 46
- (1) The controller must, if so requested by a data subject, rectify without undue delay inaccurate personal data relating to the data subject.
- (2) Where personal data is inaccurate because it is incomplete, the controller must, if so requested by a data subject, complete it.
- (3) The duty under subsection (2) may, in appropriate cases, be fulfilled by the provision of a supplementary statement.
- (4) Where the controller would be required to rectify personal data under this section but the personal data must be maintained for the purposes of evidence, the controller must (instead of rectifying the personal data) restrict its processing.
#### Right to erasure or restriction of processing
##### 47
- (1) The controller must erase personal data without undue delay where—
- (a) the processing of the personal data would infringe section 35, 36(1) to (3), 37, 38(1), 39(1), 40, 41 or 42, or
- (b) the controller has a legal obligation to erase the data.
- (2) Where the controller would be required to erase personal data under subsection (1) but the personal data must be maintained for the purposes of evidence, the controller must (instead of erasing the personal data) restrict its processing.
- (3) Where a data subject contests the accuracy of personal data (whether in making a request under this section or section 46 or in any other way), but it is not possible to ascertain whether it is accurate or not, the controller must restrict its processing.
- (4) A data subject may request the controller to erase personal data or to restrict its processing (but the duties of the controller under this section apply whether or not such a request is made).
#### Rights under section 46 or 47: supplementary
##### 48
- (1) Where a data subject requests the rectification or erasure of personal data or the restriction of its processing, the controller must inform the data subject in writing—
- (a) whether the request has been granted, and
- (b) if it has been refused—
- (i) of the reasons for the refusal,
- (ii) of the data subject's right to make a request to the Commissioner under section 51,
- (iii) of the data subject's right to lodge a complaint with the Commissioner, and
- (iv) of the data subject's right to apply to a court under section 167.
- (2) The controller must comply with the duty under subsection (1)—
- (a) without undue delay, and
- (b) in any event, before the end of the applicable time period (see section 54).
- (3) The controller may restrict, wholly or partly, the provision of information to the data subject under subsection (1)(b)(i) to the extent that and for so long as the restriction is, having regard to the fundamental rights and legitimate interests of the data subject, a necessary and proportionate measure to—
- (a) avoid obstructing an official or legal inquiry, investigation or procedure;
- (b) avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;
- (c) protect public security;
- (d) protect national security;
- (e) protect the rights and freedoms of others.
- (4) Where the rights of a data subject under subsection (1) are restricted, wholly or partly, the controller must inform the data subject in writing without undue delay—
- (a) that the rights of the data subject have been restricted,
- (b) of the reasons for the restriction,
- (c) of the data subject's right to lodge a complaint with the Commissioner, and
- (d) of the data subject's right to apply to a court under section 167.
- (5) Subsection (4)(a) and (b) do not apply to the extent that the provision of the information would undermine the purpose of the restriction.
- (6) The controller must—
- (a) record the reasons for a decision to restrict (whether wholly or partly) the provision of information to a data subject under subsection (1)(b)(i), and
- (b) if requested to do so by the Commissioner, make the record available to the Commissioner.
- (7) Where the controller rectifies personal data, it must notify the competent authority (if any) from which the inaccurate personal data originated.
- (8) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (9) Where the controller rectifies, erases or restricts the processing of personal data which has been disclosed by the controller—
- (a) the controller must notify the recipients, and
- (b) the recipients must similarly rectify, erase or restrict the processing of the personal data (so far as they retain responsibility for it).
- (10) Where processing is restricted in accordance with section 47(3), the controller must inform the data subject before lifting the restriction.
### Automated individual decision-making
#### Right not to be subject to automated decision-making
##### 49
- (1) A controller may not take a significant decision based solely on automated processing unless that decision is required or authorised by law.
- (2) A decision is a “significant decision” for the purpose of this section if, in relation to a data subject, it—
- (a) produces an adverse legal effect concerning the data subject, or
- (b) significantly affects the data subject.
#### Automated decision-making authorised by law: safeguards
##### 50
- (1) A decision is a “*qualifying significant decision*” for the purposes of this section if—
- (a) it is a significant decision in relation to a data subject, and
- (b) it is required or authorised by law.
- (2) Where a controller takes a qualifying significant decision in relation to a data subject based solely on automated processing—
- (a) the controller must, as soon as reasonably practicable, notify the data subject in writing that a decision has been taken based solely on automated processing, and
- (b) the data subject may, before the end of the period of 1 month beginning with receipt of the notification, request the controller to—
- (i) reconsider the decision, or
- (ii) take a new decision that is not based solely on automated processing.
- (3) If a request is made to a controller under subsection (2), the controller must, before the end of the period of 1 month beginning with receipt of the request—
- (a) consider the request, including any information provided by the data subject that is relevant to it,
- (b) comply with the request, and
- (c) by notice in writing inform the data subject of—
- (i) the steps taken to comply with the request, and
- (ii) the outcome of complying with the request.
- (4) The Secretary of State may by regulations make such further provision as the Secretary of State considers appropriate to provide suitable measures to safeguard a data subject's rights, freedoms and legitimate interests in connection with the taking of qualifying significant decisions based solely on automated processing.
- (5) Regulations under subsection (4)—
- (a) may amend this section, and
- (b) are subject to the affirmative resolution procedure.
- (6) In this section “*significant decision*” has the meaning given by section 49(2).
### Supplementary
#### Exercise of rights through the Commissioner
##### 51
- (1) This section applies where a controller—
- (a) restricts under section 44(4) the information provided to the data subject under section 44(2) (duty of the controller to give the data subject additional information),
- (b) restricts under section 45(4) the data subject's rights under section 45(1) (right of access), or
- (c) refuses a request by the data subject for rectification under section 46 or for erasure or restriction of processing under section 47.
- (2) The data subject may—
- (a) where subsection (1)(a) or (b) applies, request the Commissioner to check that the restriction imposed by the controller was lawful;
- (b) where subsection (1)(c) applies, request the Commissioner to check that the refusal of the data subject's request was lawful.
- (3) The Commissioner must take such steps as appear to the Commissioner to be appropriate to respond to a request under subsection (2) (which may include the exercise of any of the powers conferred by sections 142 and 146).
- (4) After taking those steps, the Commissioner must inform the data subject—
- (a) where subsection (1)(a) or (b) applies, whether the Commissioner is satisfied that the restriction imposed by the controller was lawful;
- (b) where subsection (1)(c) applies, whether the Commissioner is satisfied that the controller's refusal of the data subject's request was lawful.
- (5) The Commissioner must also inform the data subject of the data subject's right to apply to a court under section 167.
- (6) Where the Commissioner is not satisfied as mentioned in subsection (4)(a) or (b), the Commissioner may also inform the data subject of any further steps that the Commissioner is considering taking under Part 6 .
#### Form of provision of information etc
##### 52
- (1) The controller must take reasonable steps to ensure that any information that is required by this Chapter to be provided to the data subject is provided in a concise, intelligible and easily accessible form, using clear and plain language.
- (2) Subject to subsection (3), the information may be provided in any form, including electronic form.
- (3) Where information is provided in response to a request by the data subject under section 45, 46, 47 or 50, the controller must provide the information in the same form as the request where it is practicable to do so.
- (4) Where the controller has reasonable doubts about the identity of an individual making a request under section 45, 46 or 47, the controller may—
- (a) request the provision of additional information to enable the controller to confirm the identity, and
- (b) delay dealing with the request until the identity is confirmed.
- (5) Subject to section 53, any information that is required by this Chapter to be provided to the data subject must be provided free of charge.
- (6) The controller must facilitate the exercise of the rights of the data subject under sections 45 to 50.
#### Manifestly unfounded or excessive requests by the data subject
##### 53
- (1) Where a request from a data subject under section 45, 46, 47 or 50 is manifestly unfounded or excessive, the controller may—
- (a) charge a reasonable fee for dealing with the request, or
- (b) refuse to act on the request.
- (2) An example of a request that may be excessive is one that merely repeats the substance of previous requests.
- (3) In any proceedings where there is an issue as to whether a request under section 45, 46, 47 or 50 is manifestly unfounded or excessive, it is for the controller to show that it is.
- (4) The Secretary of State may by regulations specify limits on the fees that a controller may charge in accordance with subsection (1)(a).
- (5) Regulations under subsection (4) are subject to the negative resolution procedure.
#### Meaning of “applicable time period”
##### 54
- (1) This section defines “*the applicable time period*” for the purposes of sections 45(3)(b) and 48(2)(b).
- (2) “*The applicable time period*” means the period of 1 month, or such longer period as may be specified in regulations, beginning with the relevant time.
- (3) “*The relevant time*” means the latest of the following—
- (a) when the controller receives the request in question;
- (b) when the controller receives the information (if any) requested in connection with a request under section 52(4);
- (c) when the fee (if any) charged in connection with the request under section 53 is paid.
- (4) The power to make regulations under subsection (2) is exercisable by the Secretary of State.
- (5) Regulations under subsection (2) may not specify a period which is longer than 3 months.
- (6) Regulations under subsection (2) are subject to the negative resolution procedure.
### CHAPTER 4 — Controller and processor
### Overview and scope
#### Overview and scope
##### 55
- (1) This Chapter—
- (a) sets out the general obligations of controllers and processors (see sections 56 to 65);
- (b) sets out specific obligations of controllers and processors with respect to security (see section 66);
- (c) sets out specific obligations of controllers and processors with respect to personal data breaches (see sections 67 and 68);
- (d) makes provision for the designation, position and tasks of data protection officers (see sections 69 to 71).
- (2) This Chapter applies only in relation to the processing of personal data for a law enforcement purpose.
- (3) Where a controller is required by any provision of this Chapter to implement appropriate technical and organisational measures, the controller must (in deciding what measures are appropriate) take into account—
- (a) the latest developments in technology,
- (b) the cost of implementation,
- (c) the nature, scope, context and purposes of processing, and
- (d) the risks for the rights and freedoms of individuals arising from the processing.
### General obligations
#### General obligations of the controller
##### 56
- (1) Each controller must implement appropriate technical and organisational measures to ensure, and to be able to demonstrate, that the processing of personal data complies with the requirements of this Part.
- (2) Where proportionate in relation to the processing, the measures implemented to comply with the duty under subsection (1) must include appropriate data protection policies.
- (3) The technical and organisational measures implemented under subsection (1) must be reviewed and updated where necessary.
#### Data protection by design and default
##### 57
- (1) Each controller must implement appropriate technical and organisational measures which are designed—
- (a) to implement the data protection principles in an effective manner, and
- (b) to integrate into the processing itself the safeguards necessary for that purpose.
- (2) The duty under subsection (1) applies both at the time of the determination of the means of processing the data and at the time of the processing itself.
- (3) Each controller must implement appropriate technical and organisational measures for ensuring that, by default, only personal data which is necessary for each specific purpose of the processing is processed.
- (4) The duty under subsection (3) applies to—
- (a) the amount of personal data collected,
- (b) the extent of its processing,
- (c) the period of its storage, and
- (d) its accessibility.
- (5) In particular, the measures implemented to comply with the duty under subsection (3) must ensure that, by default, personal data is not made accessible to an indefinite number of people without an individual's intervention.
#### Joint controllers
##### 58
- (1) Where two or more competent authorities jointly determine the purposes and means of processing personal data, they are joint controllers for the purposes of this Part.
- (2) Joint controllers must, in a transparent manner, determine their respective responsibilities for compliance with this Part by means of an arrangement between them, except to the extent that those responsibilities are determined under or by virtue of an enactment.
- (3) The arrangement must designate the controller which is to be the contact point for data subjects.
#### Processors
##### 59
- (1) This section applies to the use by a controller of a processor to carry out processing of personal data on behalf of the controller.
- (2) The controller may use only a processor who provides guarantees to implement appropriate technical and organisational measures that are sufficient to secure that the processing will—
- (a) meet the requirements of this Part, and
- (b) ensure the protection of the rights of the data subject.
- (3) The processor used by the controller may not engage another processor (“a sub-processor”) without the prior written authorisation of the controller, which may be specific or general.
- (4) Where the controller gives a general written authorisation to a processor, the processor must inform the controller if the processor proposes to add to the number of sub-processors engaged by it or to replace any of them (so that the controller has the opportunity to object to the proposal).
- (5) The processing by the processor must be governed by a contract in writing between the controller and the processor setting out the following—
- (a) the subject-matter and duration of the processing;
- (b) the nature and purpose of the processing;
- (c) the type of personal data and categories of data subjects involved;
- (d) the obligations and rights of the controller and processor.
- (6) The contract must, in particular, provide that the processor must—
- (a) act only on instructions from the controller,
- (b) ensure that the persons authorised to process personal data are subject to an appropriate duty of confidentiality,
- (c) assist the controller by any appropriate means to ensure compliance with the rights of the data subject under this Part,
- (d) at the end of the provision of services by the processor to the controller—
- (i) either delete or return to the controller (at the choice of the controller) the personal data to which the services relate, and
- (ii) delete copies of the personal data unless subject to a legal obligation to store the copies,
- (e) make available to the controller all information necessary to demonstrate compliance with this section, and
- (f) comply with the requirements of this section for engaging sub-processors.
- (7) The terms included in the contract in accordance with subsection (6)(a) must provide that the processor may transfer personal data to a third country or international organisation only if instructed by the controller to make the particular transfer.
- (8) If a processor determines, in breach of this Part, the purposes and means of processing, the processor is to be treated for the purposes of this Part as a controller in respect of that processing.
#### Processing under the authority of the controller or processor
##### 60
A processor, and any person acting under the authority of a controller or processor, who has access to personal data may not process the data except—
- (a) on instructions from the controller, or
- (b) to comply with a legal obligation.
#### Records of processing activities
##### 61
- (1) Each controller must maintain a record of all categories of processing activities for which the controller is responsible.
- (2) The controller's record must contain the following information—
- (a) the name and contact details of the controller;
- (b) where applicable, the name and contact details of the joint controller;
- (c) where applicable, the name and contact details of the data protection officer;
- (d) the purposes of the processing;
- (e) the categories of recipients to whom personal data has been or will be disclosed (including recipients in third countries or international organisations);
- (f) a description of the categories of—
- (i) data subject, and
- (ii) personal data;
- (g) where applicable, details of the use of profiling;
- (h) where applicable, the categories of transfers of personal data to a third country or an international organisation;
- (i) an indication of the legal basis for the processing operations, including transfers, for which the personal data is intended;
- (j) where possible, the envisaged time limits for erasure of the different categories of personal data;
- (k) where possible, a general description of the technical and organisational security measures referred to in section 66.
- (3) Each processor must maintain a record of all categories of processing activities carried out on behalf of a controller.
- (4) The processor's record must contain the following information—
- (a) the name and contact details of the processor and of any other processors engaged by the processor in accordance with section 59(3);
- (b) the name and contact details of the controller on behalf of which the processor is acting;
- (c) where applicable, the name and contact details of the data protection officer;
- (d) the categories of processing carried out on behalf of the controller;
- (e) where applicable, details of transfers of personal data to a third country or an international organisation where explicitly instructed to do so by the controller, including the identification of that third country or international organisation;
- (f) where possible, a general description of the technical and organisational security measures referred to in section 66.
- (5) The controller and the processor must make the records kept under this section available to the Commissioner on request.
#### Logging
##### 62
- (1) A controller (or, where personal data is processed on behalf of the controller by a processor, the processor) must keep logs for at least the following processing operations in automated processing systems—
- (a) collection;
- (b) alteration;
- (c) consultation;
- (d) disclosure (including transfers);
- (e) combination;
- (f) erasure.
- (2) The logs of consultation must make it possible to establish—
- (a) the justification for, and date and time of, the consultation, and
- (b) so far as possible, the identity of the person who consulted the data.
- (3) The logs of disclosure must make it possible to establish—
- (a) the justification for, and date and time of, the disclosure, and
- (b) so far as possible—
- (i) the identity of the person who disclosed the data, and
- (ii) the identity of the recipients of the data.
- (4) The logs kept under subsection (1) may be used only for one or more of the following purposes—
- (a) to verify the lawfulness of processing;
- (b) to assist with self-monitoring by the controller or (as the case may be) the processor, including the conduct of internal disciplinary proceedings;
- (c) to ensure the integrity and security of personal data;
- (d) the purposes of criminal proceedings.
- (5) The controller or (as the case may be) the processor must make the logs available to the Commissioner on request.
#### Co-operation with the Commissioner
##### 63
Each controller and each processor must co-operate, on request, with the Commissioner in the performance of the Commissioner's tasks.
#### Data protection impact assessment
##### 64
- (1) Where a type of processing is likely to result in a high risk to the rights and freedoms of individuals, the controller must, prior to the processing, carry out a data protection impact assessment.
- (2) A data protection impact assessment is an assessment of the impact of the envisaged processing operations on the protection of personal data.
- (3) A data protection impact assessment must include the following—
- (a) a general description of the envisaged processing operations;
- (b) an assessment of the risks to the rights and freedoms of data subjects;
- (c) the measures envisaged to address those risks;
- (d) safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this Part, taking into account the rights and legitimate interests of the data subjects and other persons concerned.
- (4) In deciding whether a type of processing is likely to result in a high risk to the rights and freedoms of individuals, the controller must take into account the nature, scope, context and purposes of the processing.
#### Prior consultation with the Commissioner
##### 65
- (1) This section applies where a controller intends to create a filing system and process personal data forming part of it.
- (2) The controller must consult the Commissioner prior to the processing if a data protection impact assessment prepared under section 64 indicates that the processing of the data would result in a high risk to the rights and freedoms of individuals (in the absence of measures to mitigate the risk).
- (3) Where the controller is required to consult the Commissioner under subsection (2), the controller must give the Commissioner—
- (a) the data protection impact assessment prepared under section 64, and
- (b) any other information requested by the Commissioner to enable the Commissioner to make an assessment of the compliance of the processing with the requirements of this Part.
- (4) Where the Commissioner is of the opinion that the intended processing referred to in subsection (1) would infringe any provision of this Part, the Commissioner must provide written advice to the controller and, where the controller is using a processor, to the processor.
- (5) The written advice must be provided before the end of the period of 6 weeks beginning with receipt of the request for consultation by the controller or the processor.
- (6) The Commissioner may extend the period of 6 weeks by a further period of 1 month, taking into account the complexity of the intended processing.
- (7) If the Commissioner extends the period of 6 weeks, the Commissioner must—
- (a) inform the controller and, where applicable, the processor of any such extension before the end of the period of 1 month beginning with receipt of the request for consultation, and
- (b) provide reasons for the delay.
### Obligations relating to security
#### Security of processing
##### 66
- (1) Each controller and each processor must implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks arising from the processing of personal data.
- (2) In the case of automated processing, each controller and each processor must, following an evaluation of the risks, implement measures designed to—
- (a) prevent unauthorised processing or unauthorised interference with the systems used in connection with it,
- (b) ensure that it is possible to establish the precise details of any processing that takes place,
- (c) ensure that any systems used in connection with the processing function properly and may, in the case of interruption, be restored, and
- (d) ensure that stored personal data cannot be corrupted if a system used in connection with the processing malfunctions.
### Obligations relating to personal data breaches
#### Notification of a personal data breach to the Commissioner
##### 67
- (1) If a controller becomes aware of a personal data breach in relation to personal data for which the controller is responsible, the controller must notify the breach to the Commissioner—
- (a) without undue delay, and
- (b) where feasible, not later than 72 hours after becoming aware of it.
- (2) Subsection (1) does not apply if the personal data breach is unlikely to result in a risk to the rights and freedoms of individuals.
- (3) Where the notification to the Commissioner is not made within 72 hours, the notification must be accompanied by reasons for the delay.
- (4) Subject to subsection (5), the notification must include—
- (a) a description of the nature of the personal data breach including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
- (b) the name and contact details of the data protection officer or other contact point from whom more information can be obtained;
- (c) a description of the likely consequences of the personal data breach;
- (d) a description of the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
- (5) Where and to the extent that it is not possible to provide all the information mentioned in subsection (4) at the same time, the information may be provided in phases without undue further delay.
- (6) The controller must record the following information in relation to a personal data breach—
- (a) the facts relating to the breach,
- (b) its effects, and
- (c) the remedial action taken.
- (7) The information mentioned in subsection (6) must be recorded in such a way as to enable the Commissioner to verify compliance with this section.
- (8) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (9) If a processor becomes aware of a personal data breach (in relation to personal data processed by the processor), the processor must notify the controller without undue delay.
#### Communication of a personal data breach to the data subject
##### 68
- (1) Where a personal data breach is likely to result in a high risk to the rights and freedoms of individuals, the controller must inform the data subject of the breach without undue delay.
- (2) The information given to the data subject must include the following—
- (a) a description of the nature of the breach;
- (b) the name and contact details of the data protection officer or other contact point from whom more information can be obtained;
- (c) a description of the likely consequences of the personal data breach;
- (d) a description of the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
- (3) The duty under subsection (1) does not apply where—
- (a) the controller has implemented appropriate technological and organisational protection measures which were applied to the personal data affected by the breach,
- (b) the controller has taken subsequent measures which ensure that the high risk to the rights and freedoms of data subjects referred to in subsection (1) is no longer likely to materialise, or
- (c) it would involve a disproportionate effort.
- (4) An example of a case which may fall within subsection (3)(a) is where measures that render personal data unintelligible to any person not authorised to access the data have been applied, such as encryption.
- (5) In a case falling within subsection (3)(c) (but not within subsection (3)(a) or (b)), the information mentioned in subsection (2) must be made available to the data subject in another equally effective way, for example, by means of a public communication.
- (6) Where the controller has not informed the data subject of the breach the Commissioner, on being notified under section 67 and after considering the likelihood of the breach resulting in a high risk, may—
- (a) require the controller to notify the data subject of the breach, or
- (b) decide that the controller is not required to do so because any of paragraphs (a) to (c) of subsection (3) applies.
- (7) The controller may restrict, wholly or partly, the provision of information to the data subject under subsection (1) to the extent that and for so long as the restriction is, having regard to the fundamental rights and legitimate interests of the data subject, a necessary and proportionate measure to—
- (a) avoid obstructing an official or legal inquiry, investigation or procedure;
- (b) avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;
- (c) protect public security;
- (d) protect national security;
- (e) protect the rights and freedoms of others.
- (8) Subsection (6) does not apply where the controller's decision not to inform the data subject of the breach was made in reliance on subsection (7).
- (9) The duties in section 52(1) and (2) apply in relation to information that the controller is required to provide to the data subject under this section as they apply in relation to information that the controller is required to provide to the data subject under Chapter 3 .
### Data protection officers
#### Designation of a data protection officer
##### 69
- (1) The controller must designate a data protection officer, unless the controller is a court, or other judicial authority, acting in its judicial capacity.
- (2) When designating a data protection officer, the controller must have regard to the professional qualities of the proposed officer, in particular—
- (a) the proposed officer's expert knowledge of data protection law and practice, and
- (b) the ability of the proposed officer to perform the tasks mentioned in section 71.
- (3) The same person may be designated as a data protection officer by several controllers, taking account of their organisational structure and size.
- (4) The controller must publish the contact details of the data protection officer and communicate these to the Commissioner.
#### Position of data protection officer
##### 70
- (1) The controller must ensure that the data protection officer is involved, properly and in a timely manner, in all issues which relate to the protection of personal data.
- (2) The controller must provide the data protection officer with the necessary resources and access to personal data and processing operations to enable the data protection officer to—
- (a) perform the tasks mentioned in section 71, and
- (b) maintain his or her expert knowledge of data protection law and practice.
- (3) The controller—
- (a) must ensure that the data protection officer does not receive any instructions regarding the performance of the tasks mentioned in section 71;
- (b) must ensure that the data protection officer does not perform a task or fulfil a duty other than those mentioned in this Part where such task or duty would result in a conflict of interests;
- (c) must not dismiss or penalise the data protection officer for performing the tasks mentioned in section 71.
- (4) A data subject may contact the data protection officer with regard to all issues relating to—
- (a) the processing of that data subject's personal data, or
- (b) the exercise of that data subject's rights under this Part.
- (5) The data protection officer, in the performance of this role, must report to the highest management level of the controller.
#### Tasks of data protection officer
##### 71
- (1) The controller must entrust the data protection officer with at least the following tasks—
- (a) informing and advising the controller, any processor engaged by the controller, and any employee of the controller who carries out processing of personal data, of that person's obligations under this Part,
- (b) providing advice on the carrying out of a data protection impact assessment under section 64 and monitoring compliance with that section,
- (c) co-operating with the Commissioner,
- (d) acting as the contact point for the Commissioner on issues relating to processing, including in relation to the consultation mentioned in section 65, and consulting with the Commissioner, where appropriate, in relation to any other matter,
- (e) monitoring compliance with policies of the controller in relation to the protection of personal data, and
- (f) monitoring compliance by the controller with this Part.
- (2) In relation to the policies mentioned in subsection (1)(e), the data protection officer's tasks include—
- (a) assigning responsibilities under those policies,
- (b) raising awareness of those policies,
- (c) training staff involved in processing operations, and
- (d) conducting audits required under those policies.
- (3) In performing the tasks set out in subsections (1) and (2), the data protection officer must have regard to the risks associated with processing operations, taking into account the nature, scope, context and purposes of processing.
### CHAPTER 5 — Transfers of personal data to third countries etc
### Overview and interpretation
#### Overview and interpretation
##### 72
- (1) This Chapter deals with the transfer of personal data to third countries or international organisations, as follows—
- (a) sections 73 to 76 set out the general conditions that apply;
- (b) section 77 sets out the special conditions that apply where the intended recipient of personal data is not a relevant authority in a third country or an international organisation;
- (c) section 78 makes special provision about subsequent transfers of personal data.
- (2) In this Chapter, “*relevant authority*”, in relation to a third country, means any person based in a third country that has (in that country) functions comparable to those of a competent authority.
### General principles for transfers
#### General principles for transfers of personal data
##### 73
- (1) A controller may not transfer personal data to a third country or to an international organisation unless—
- (a) the three conditions set out in subsections (2) to (4) are met, and
- (b) in a case where the personal data was originally transmitted or otherwise made available to the controller or another competent authority by a member State ..., that member State, or any person based in that member State which is a competent authority for the purposes of the Law Enforcement Directive, has authorised the transfer in accordance with the law of the member State.
- (2) Condition 1 is that the transfer is necessary for any of the law enforcement purposes.
- (3) Condition 2 is that the transfer—
- (a) is based on adequacy regulations (see section 74A),
- (b) if not based on adequacy regulations, is based on there being appropriate safeguards (see section 75), or
- (c) if not based on adequacy regulations or on there being appropriate safeguards, is based on special circumstances (see section 76).
- (4) Condition 3 is that—
- (a) the intended recipient is a relevant authority in a third country or an international organisation that is a relevant international organisation, or
- (b) in a case where the controller is a competent authority specified in any of paragraphs 5 to 17, 21, 24 to 28, 34 to 51, 54 and 56 of Schedule 7—
- (i) the intended recipient is a person in a third country other than a relevant authority, and
- (ii) the additional conditions in section 77 are met.
- (5) Authorisation is not required as mentioned in subsection (1)(b) if—
- (a) the transfer is necessary for the prevention of an immediate and serious threat either to the public security of ... a third country or to the essential interests of a member State, and
- (b) the authorisation cannot be obtained in good time.
- (6) Where a transfer is made without the authorisation mentioned in subsection (1)(b), the authority in the member State which would have been responsible for deciding whether to authorise the transfer must be informed without delay.
- (7) In this section, “*relevant international organisation*” means an international organisation that carries out functions for any of the law enforcement purposes.
#### Transfers on the basis of an adequacy decision
##### 74
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### Transfers on the basis of appropriate safeguards
##### 75
- (1) A transfer of personal data to a third country or an international organisation is based on there being appropriate safeguards where—
- (a) a legal instrument containing appropriate safeguards for the protection of personal data binds the intended recipient of the data, or
- (b) the controller, having assessed all the circumstances surrounding transfers of that type of personal data to the third country or international organisation, concludes that appropriate safeguards exist to protect the data.
- (2) The controller must inform the Commissioner about the categories of data transfers that take place in reliance on subsection (1)(b).
- (3) Where a transfer of data takes place in reliance on subsection (1)—
- (a) the transfer must be documented,
- (b) the documentation must be provided to the Commissioner on request, and
- (c) the documentation must include, in particular—
- (i) the date and time of the transfer,
- (ii) the name of and any other pertinent information about the recipient,
- (iii) the justification for the transfer, and
- (iv) a description of the personal data transferred.
#### Transfers on the basis of special circumstances
##### 76
- (1) A transfer of personal data to a third country or international organisation is based on special circumstances where the transfer is necessary—
- (a) to protect the vital interests of the data subject or another person,
- (b) to safeguard the legitimate interests of the data subject,
- (c) for the prevention of an immediate and serious threat to the public security of ... a third country,
- (d) in individual cases for any of the law enforcement purposes, or
- (e) in individual cases for a legal purpose.
- (2) But subsection (1)(d) and (e) do not apply if the controller determines that fundamental rights and freedoms of the data subject override the public interest in the transfer.
- (3) Where a transfer of data takes place in reliance on subsection (1)—
- (a) the transfer must be documented,
- (b) the documentation must be provided to the Commissioner on request, and
- (c) the documentation must include, in particular—
- (i) the date and time of the transfer,
- (ii) the name of and any other pertinent information about the recipient,
- (iii) the justification for the transfer, and
- (iv) a description of the personal data transferred.
- (4) For the purposes of this section, a transfer is necessary for a legal purpose if—
- (a) it is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings) relating to any of the law enforcement purposes,
- (b) it is necessary for the purpose of obtaining legal advice in relation to any of the law enforcement purposes, or
- (c) it is otherwise necessary for the purposes of establishing, exercising or defending legal rights in relation to any of the law enforcement purposes.
### Transfers to particular recipients
#### Transfers of personal data to persons other than relevant authorities
##### 77
- (1) The additional conditions referred to in section 73(4)(b)(ii) are the following four conditions.
- (2) Condition 1 is that the transfer is strictly necessary in a specific case for the performance of a task of the transferring controller as provided by law for any of the law enforcement purposes.
- (3) Condition 2 is that the transferring controller has determined that there are no fundamental rights and freedoms of the data subject concerned that override the public interest necessitating the transfer.
- (4) Condition 3 is that the transferring controller considers that the transfer of the personal data to a relevant authority in the third country would be ineffective or inappropriate (for example, where the transfer could not be made in sufficient time to enable its purpose to be fulfilled).
- (5) Condition 4 is that the transferring controller informs the intended recipient of the specific purpose or purposes for which the personal data may, so far as necessary, be processed.
- (6) Where personal data is transferred to a person in a third country other than a relevant authority, the transferring controller must inform a relevant authority in that third country without undue delay of the transfer, unless this would be ineffective or inappropriate.
- (7) The transferring controller must—
- (a) document any transfer to a recipient in a third country other than a relevant authority, and
- (b) inform the Commissioner about the transfer.
- (8) This section does not affect the operation of any international agreement in force between the United Kingdom and third countries in the field of judicial co-operation in criminal matters and police co-operation.
### Subsequent transfers
#### Subsequent transfers
##### 78
- (1) Where personal data is transferred in accordance with section 73, the transferring controller must make it a condition of the transfer that the data is not to be further transferred to a third country or international organisation without the authorisation of the transferring controller or another competent authority.
- (2) A competent authority may give an authorisation under subsection (1) only where the further transfer is necessary for a law enforcement purpose.
- (3) In deciding whether to give the authorisation, the competent authority must take into account (among any other relevant factors)—
- (a) the seriousness of the circumstances leading to the request for authorisation,
- (b) the purpose for which the personal data was originally transferred, and
- (c) the standards for the protection of personal data that apply in the third country or international organisation to which the personal data would be transferred.
- (4) In a case where the personal data was originally transmitted or otherwise made available to the transferring controller or another competent authority by a member State ..., an authorisation may not be given under subsection (1) unless that member State, or any person based in that member State which is a competent authority for the purposes of the Law Enforcement Directive, has authorised the transfer in accordance with the law of the member State.
- (5) Authorisation is not required as mentioned in subsection (4) if—
- (a) the transfer is necessary for the prevention of an immediate and serious threat either to the public security of ... a third country or to the essential interests of a member State, and
- (b) the authorisation cannot be obtained in good time.
- (6) Where a transfer is made without the authorisation mentioned in subsection (4), the authority in the member State which would have been responsible for deciding whether to authorise the transfer must be informed without delay.
### CHAPTER 6 — Supplementary
#### National security: certificate
##### 79
- (1) A Minister of the Crown may issue a certificate certifying, for the purposes of section 44(4), 45(4), 48(3) or 68(7), that a restriction is a necessary and proportionate measure to protect national security.
- (2) The certificate may—
- (a) relate to a specific restriction (described in the certificate) which a controller has imposed or is proposing to impose under section 44(4), 45(4), 48(3) or 68(7), or
- (b) identify any restriction to which it relates by means of a general description.
- (3) Subject to subsection (6), a certificate issued under subsection (1) is conclusive evidence that the specific restriction or (as the case may be) any restriction falling within the general description is, or at any time was, a necessary and proportionate measure to protect national security.
- (4) A certificate issued under subsection (1) may be expressed to have prospective effect.
- (5) Any person directly affected by the issuing of a certificate under subsection (1) may appeal to the Tribunal against the certificate.
- (6) If, on an appeal under subsection (5), the Tribunal finds that, applying the principles applied by a court on an application for judicial review, the Minister did not have reasonable grounds for issuing the certificate, the Tribunal may —
- (a) allow the appeal, and
- (b) quash the certificate.
- (7) Where in any proceedings under or by virtue of this Act, it is claimed by a controller that a restriction falls within a general description in a certificate issued under subsection (1), any other party to the proceedings may appeal to the Tribunal on the ground that the restriction does not fall within that description.
- (8) But, subject to any determination under subsection (9), the restriction is to be conclusively presumed to fall within the general description.
- (9) On an appeal under subsection (7), the Tribunal may determine that the certificate does not so apply.
- (10) A document purporting to be a certificate under subsection (1) is to be—
- (a) received in evidence, and
- (b) deemed to be such a certificate unless the contrary is proved.
- (11) A document which purports to be certified by or on behalf of a Minister of the Crown as a true copy of a certificate issued by that Minister under subsection (1) is—
- (a) in any legal proceedings, evidence of that certificate, and
- (b) in any legal proceedings in Scotland, sufficient evidence of that certificate.
- (12) The power conferred by subsection (1) on a Minister of the Crown is exercisable only by—
- (a) a Minister who is a member of the Cabinet, or
- (b) the Attorney General or the Advocate General for Scotland.
- (13) No power conferred by any provision of Part 6 may be exercised in relation to the imposition of—
- (a) a specific restriction in a certificate under subsection (1), or
- (b) a restriction falling within a general description in such a certificate.
#### Special processing restrictions
##### 80
- (1) Subsections (3) and (4) apply where, for a law enforcement purpose, a controller transmits or otherwise makes available personal data to a non-UK recipient.
- (2) In this section—
- ...
- “*non-UK recipient*” means—a recipient in a third country, oran international organisation.
- (3) The controller must consider whether, if the personal data had instead been transmitted or otherwise made available within the United Kingdom to another competent authority, processing of the data by the other competent authority would have been subject to any restrictions by virtue of any enactment or rule of law.
- (4) Where that would be the case, the controller must inform the non-UK recipient that the data is transmitted or otherwise made available subject to compliance by that person with the same restrictions (which must be set out in the information given to that person).
- (5) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (6) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (7) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### Reporting of infringements
##### 81
- (1) Each controller must implement effective mechanisms to encourage the reporting of an infringement of this Part.
- (2) The mechanisms implemented under subsection (1) must provide that an infringement may be reported to any of the following persons—
- (a) the controller;
- (b) the Commissioner.
- (3) The mechanisms implemented under subsection (1) must include—
- (a) raising awareness of the protections provided by Part 4A of the Employment Rights Act 1996 and Part 5A of the Employment Rights (Northern Ireland) Order 1996 (S.I. 1996/1919 (N.I. 16)), and
- (b) such other protections for a person who reports an infringement of this Part as the controller considers appropriate.
- (4) A person who reports an infringement of this Part does not breach—
- (a) an obligation of confidence owed by the person, or
- (b) any other restriction on the disclosure of information (however imposed).
- (5) Subsection (4) does not apply if or to the extent that the report includes a disclosure which is prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.
- (6) Until the repeal of Part 1 of the Regulation of Investigatory Powers Act 2000 by paragraphs 45 and 54 of Schedule 10 to the Investigatory Powers Act 2016 is fully in force, subsection (5) has effect as if it included a reference to that Part.
## PART 4 — Intelligence services processing
### CHAPTER 1 — Scope and definitions
### Scope
#### Processing to which this Part applies
##### 82
- (1) This Part applies to—
- (a) the processing by an intelligence service of personal data wholly or partly by automated means, and
- (b) the processing by an intelligence service otherwise than by automated means of personal data which forms part of a filing system or is intended to form part of a filing system.
- (2) In this Part, “*intelligence service*” means—
- (a) the Security Service;
- (b) the Secret Intelligence Service;
- (c) the Government Communications Headquarters.
- (3) A reference in this Part to the processing of personal data is to processing to which this Part applies.
### Definitions
#### Meaning of “controller” and “processor”
##### 83
- (1) In this Part, “*controller*” means the intelligence service which, alone or jointly with others—
- (a) determines the purposes and means of the processing of personal data, or
- (b) is the controller by virtue of subsection (2).
- (2) Where personal data is processed only—
- (a) for purposes for which it is required by an enactment to be processed, and
- (b) by means by which it is required by an enactment to be processed,
the intelligence service on which the obligation to process the data is imposed by the enactment (or, if different, one of the enactments) is the controller.
- (3) In this Part, “*processor*” means any person who processes personal data on behalf of the controller (other than a person who is an employee of the controller).
#### Other definitions
##### 84
- (1) This section defines other expressions used in this Part.
- (2) “*Consent*”, in relation to the processing of personal data relating to an individual, means a freely given, specific, informed and unambiguous indication of the individual's wishes by which the individual, by a statement or by a clear affirmative action, signifies agreement to the processing of the personal data.
- (3) “*Employee*”, in relation to any person, includes an individual who holds a position (whether paid or unpaid) under the direction and control of that person.
- (4) “*Personal data breach*” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.
- (5) “*Recipient*”, in relation to any personal data, means any person to whom the data is disclosed, whether a third party or not, but it does not include a person to whom disclosure is or may be made in the framework of a particular inquiry in accordance with the law.
- (6) “*Restriction of processing*” means the marking of stored personal data with the aim of limiting its processing for the future.
- (7) Sections 3 and 205 include definitions of other expressions used in this Part.
### CHAPTER 2 — Principles
### Overview
#### Overview
##### 85
- (1) This Chapter sets out the six data protection principles as follows—
- (a) section 86 sets out the first data protection principle (requirement that processing be lawful, fair and transparent);
- (b) section 87 sets out the second data protection principle (requirement that the purposes of processing be specified, explicit and legitimate);
- (c) section 88 sets out the third data protection principle (requirement that personal data be adequate, relevant and not excessive);
- (d) section 89 sets out the fourth data protection principle (requirement that personal data be accurate and kept up to date);
- (e) section 90 sets out the fifth data protection principle (requirement that personal data be kept for no longer than is necessary);
- (f) section 91 sets out the sixth data protection principle (requirement that personal data be processed in a secure manner).
- (2) Each of sections 86, 87 and 91 makes provision to supplement the principle to which it relates.
### The data protection principles
#### The first data protection principle
##### 86
- (1) The first data protection principle is that the processing of personal data must be—
- (a) lawful, and
- (b) fair and transparent.
- (2) The processing of personal data is lawful only if and to the extent that—
- (a) at least one of the conditions in Schedule 9 is met, and
- (b) in the case of sensitive processing, at least one of the conditions in Schedule 10 is also met.
- (3) The Secretary of State may by regulations amend Schedule 10—
- (a) by adding conditions;
- (b) by omitting conditions added by regulations under paragraph (a).
- (4) Regulations under subsection (3) are subject to the affirmative resolution procedure.
- (5) In determining whether the processing of personal data is fair and transparent, regard is to be had to the method by which it is obtained.
- (6) For the purposes of subsection (5), data is to be treated as obtained fairly and transparently if it consists of information obtained from a person who—
- (a) is authorised by an enactment to supply it, or
- (b) is required to supply it by an enactment or by an international obligation of the United Kingdom.
- (7) In this section, “*sensitive processing*” means—
- (a) the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership;
- (b) the processing of genetic data for the purpose of uniquely identifying an individual;
- (c) the processing of biometric data for the purpose of uniquely identifying an individual;
- (d) the processing of data concerning health;
- (e) the processing of data concerning an individual's sex life or sexual orientation;
- (f) the processing of personal data as to—
- (i) the commission or alleged commission of an offence by an individual, or
- (ii) proceedings for an offence committed or alleged to have been committed by an individual, the disposal of such proceedings or the sentence of a court in such proceedings.
#### The second data protection principle
##### 87
- (1) The second data protection principle is that—
- (a) the purpose for which personal data is collected on any occasion must be specified, explicit and legitimate, and
- (b) personal data so collected must not be processed in a manner that is incompatible with the purpose for which it is collected.
- (2) Paragraph (b) of the second data protection principle is subject to subsections (3) and (4).
- (3) Personal data collected by a controller for one purpose may be processed for any other purpose of the controller that collected the data or any purpose of another controller provided that—
- (a) the controller is authorised by law to process the data for that purpose, and
- (b) the processing is necessary and proportionate to that other purpose.
- (4) Processing of personal data is to be regarded as compatible with the purpose for which it is collected if the processing—
- (a) consists of—
- (i) processing for archiving purposes in the public interest,
- (ii) processing for the purposes of scientific or historical research, or
- (iii) processing for statistical purposes, and
- (b) is subject to appropriate safeguards for the rights and freedoms of the data subject.
#### The third data protection principle
##### 88
The third data protection principle is that personal data must be adequate, relevant and not excessive in relation to the purpose for which it is processed.
#### The fourth data protection principle
##### 89
The fourth data protection principle is that personal data undergoing processing must be accurate and, where necessary, kept up to date.
#### The fifth data protection principle
##### 90
The fifth data protection principle is that personal data must be kept for no longer than is necessary for the purpose for which it is processed.
#### The sixth data protection principle
##### 91
- (1) The sixth data protection principle is that personal data must be processed in a manner that includes taking appropriate security measures as regards risks that arise from processing personal data.
- (2) The risks referred to in subsection (1) include (but are not limited to) accidental or unauthorised access to, or destruction, loss, use, modification or disclosure of, personal data.
### CHAPTER 3 — Rights of the data subject
### Overview
#### Overview
##### 92
- (1) This Chapter sets out the rights of the data subject as follows—
- (a) section 93 deals with the information to be made available to the data subject;
- (b) sections 94 and 95 deal with the right of access by the data subject;
- (c) sections 96 and 97 deal with rights in relation to automated processing;
- (d) section 98 deals with the right to information about decision-making;
- (e) section 99 deals with the right to object to processing;
- (f) section 100 deals with rights to rectification and erasure of personal data.
- (2) In this Chapter, “*the controller*”, in relation to a data subject, means the controller in relation to personal data relating to the data subject.
### Rights
#### Right to information
##### 93
- (1) The controller must give a data subject the following information—
- (a) the identity and the contact details of the controller;
- (b) the legal basis on which, and the purposes for which, the controller processes personal data;
- (c) the categories of personal data relating to the data subject that are being processed;
- (d) the recipients or the categories of recipients of the personal data (if applicable);
- (e) the right to lodge a complaint with the Commissioner and the contact details of the Commissioner;
- (f) how to exercise rights under this Chapter;
- (g) any other information needed to secure that the personal data is processed fairly and transparently.
- (2) The controller may comply with subsection (1) by making information generally available, where the controller considers it appropriate to do so.
- (3) The controller is not required under subsection (1) to give a data subject information that the data subject already has.
- (4) Where personal data relating to a data subject is collected by or on behalf of the controller from a person other than the data subject, the requirement in subsection (1) has effect, in relation to the personal data so collected, with the following exceptions—
- (a) the requirement does not apply in relation to processing that is authorised by an enactment;
- (b) the requirement does not apply in relation to the data subject if giving the information to the data subject would be impossible or involve disproportionate effort.
#### Right of access
##### 94
- (1) An individual is entitled to obtain from a controller—
- (a) confirmation as to whether or not personal data concerning the individual is being processed, and
- (b) where that is the case—
- (i) communication, in intelligible form, of the personal data of which that individual is the data subject, and
- (ii) the information set out in subsection (2).
- (2) That information is—
- (a) the purposes of and legal basis for the processing;
- (b) the categories of personal data concerned;
- (c) the recipients or categories of recipients to whom the personal data has been disclosed;
- (d) the period for which the personal data is to be preserved;
- (e) the existence of a data subject's rights to rectification and erasure of personal data (see section 100);
- (f) the right to lodge a complaint with the Commissioner and the contact details of the Commissioner;
- (g) any information about the origin of the personal data concerned.
- (3) A controller is not obliged to provide information under this section unless the controller has received such reasonable fee as the controller may require, subject to subsection (4).
- (4) The Secretary of State may by regulations—
- (a) specify cases in which a controller may not charge a fee;
- (b) specify the maximum amount of a fee.
- (5) Where a controller—
- (a) reasonably requires further information—
- (i) in order that the controller be satisfied as to the identity of the individual making a request under subsection (1), or
- (ii) to locate the information which that individual seeks, and
- (b) has informed that individual of that requirement,
the controller is not obliged to comply with the request unless the controller is supplied with that further information.
- (6) Where a controller cannot comply with the request without disclosing information relating to another individual who can be identified from that information, the controller is not obliged to comply with the request unless—
- (a) the other individual has consented to the disclosure of the information to the individual making the request, or
- (b) it is reasonable in all the circumstances to comply with the request without the consent of the other individual.
- (7) In subsection (6), the reference to information relating to another individual includes a reference to information identifying that individual as the source of the information sought by the request.
- (8) Subsection (6) is not to be construed as excusing a controller from communicating so much of the information sought by the request as can be communicated without disclosing the identity of the other individual concerned, whether by the omission of names or other identifying particulars or otherwise.
- (9) In determining for the purposes of subsection (6)(b) whether it is reasonable in all the circumstances to comply with the request without the consent of the other individual concerned, regard must be had, in particular, to—
- (a) any duty of confidentiality owed to the other individual,
- (b) any steps taken by the controller with a view to seeking the consent of the other individual,
- (c) whether the other individual is capable of giving consent, and
- (d) any express refusal of consent by the other individual.
- (10) Subject to subsection (6), a controller must comply with a request under subsection (1)—
- (a) promptly, and
- (b) in any event before the end of the applicable time period.
- (11) If a court is satisfied on the application of an individual who has made a request under subsection (1) that the controller in question has failed to comply with the request in contravention of this section, the court may order the controller to comply with the request.
- (12) A court may make an order under subsection (11) in relation to a joint controller whose responsibilities are determined in an arrangement under section 104 only if the controller is responsible for compliance with the obligation to which the order relates.
- (13) The jurisdiction conferred on a court by this section is exercisable by the High Court or, in Scotland, by the Court of Session.
- (14) In this section—
- “*the applicable time period*” means—the period of 1 month, orsuch longer period, not exceeding 3 months, as may be specified in regulations made by the Secretary of State,beginning with the relevant time;
- “*the relevant time*”, in relation to a request under subsection (1), means the latest of the following—when the controller receives the request,when the fee (if any) is paid, andwhen the controller receives the information (if any) required under subsection (5) in connection with the request.
- (15) Regulations under this section are subject to the negative resolution procedure.
#### Right of access: supplementary
##### 95
- (1) The controller must comply with the obligation imposed by section 94(1)(b)(i) by supplying the data subject with a copy of the information in writing unless—
- (a) the supply of such a copy is not possible or would involve disproportionate effort, or
- (b) the data subject agrees otherwise;
and where any of the information referred to in section 94(1)(b)(i) is expressed in terms which are not intelligible without explanation the copy must be accompanied by an explanation of those terms.
- (2) Where a controller has previously complied with a request made under section 94 by an individual, the controller is not obliged to comply with a subsequent identical or similar request under that section by that individual unless a reasonable interval has elapsed between compliance with the previous request and the making of the current request.
- (3) In determining for the purposes of subsection (2) whether requests under section 94 are made at reasonable intervals, regard must be had to—
- (a) the nature of the data,
- (b) the purpose for which the data is processed, and
- (c) the frequency with which the data is altered.
- (4) The information to be supplied pursuant to a request under section 94 must be supplied by reference to the data in question at the time when the request is received, except that it may take account of any amendment or deletion made between that time and the time when the information is supplied, being an amendment or deletion that would have been made regardless of the receipt of the request.
- (5) For the purposes of section 94(6) to (8), an individual can be identified from information to be disclosed to a data subject by a controller if the individual can be identified from—
- (a) that information, or
- (b) that and any other information that the controller reasonably believes the data subject making the request is likely to possess or obtain.
#### Right not to be subject to automated decision-making
##### 96
- (1) The controller may not take a decision significantly affecting a data subject that is based solely on automated processing of personal data relating to the data subject.
- (2) Subsection (1) does not prevent such a decision being made on that basis if—
- (a) the decision is required or authorised by law,
- (b) the data subject has given consent to the decision being made on that basis, or
- (c) the decision is a decision taken in the course of steps taken—
- (i) for the purpose of considering whether to enter into a contract with the data subject,
- (ii) with a view to entering into such a contract, or
- (iii) in the course of performing such a contract.
- (3) For the purposes of this section, a decision that has legal effects as regards an individual is to be regarded as significantly affecting the individual.
#### Right to intervene in automated decision-making
##### 97
- (1) This section applies where—
- (a) the controller takes a decision significantly affecting a data subject that is based solely on automated processing of personal data relating to the data subject, and
- (b) the decision is required or authorised by law.
- (2) This section does not apply to such a decision if—
- (a) the data subject has given consent to the decision being made on that basis, or
- (b) the decision is a decision taken in the course of steps taken—
- (i) for the purpose of considering whether to enter into a contract with the data subject,
- (ii) with a view to entering into such a contract, or
- (iii) in the course of performing such a contract.
- (3) The controller must as soon as reasonably practicable notify the data subject that such a decision has been made.
- (4) The data subject may, before the end of the period of 1 month beginning with receipt of the notification, request the controller—
- (a) to reconsider the decision, or
- (b) to take a new decision that is not based solely on automated processing.
- (5) If a request is made to the controller under subsection (4), the controller must, before the end of the period of 1 month beginning with receipt of the request—
- (a) consider the request, including any information provided by the data subject that is relevant to it, and
- (b) by notice in writing inform the data subject of the outcome of that consideration.
- (6) For the purposes of this section, a decision that has legal effects as regards an individual is to be regarded as significantly affecting the individual.
#### Right to information about decision-making
##### 98
- (1) Where—
- (a) the controller processes personal data relating to a data subject, and
- (b) results produced by the processing are applied to the data subject,
the data subject is entitled to obtain from the controller, on request, knowledge of the reasoning underlying the processing.
- (2) Where the data subject makes a request under subsection (1), the controller must comply with the request without undue delay.
#### Right to object to processing
##### 99
- (1) A data subject is entitled at any time, by notice given to the controller, to require the controller—
- (a) not to process personal data relating to the data subject, or
- (b) not to process such data for a specified purpose or in a specified manner,
on the ground that, for specified reasons relating to the situation of the data subject, the processing in question is an unwarranted interference with the interests or rights of the data subject.
- (2) Where the controller—
- (a) reasonably requires further information—
- (i) in order that the controller be satisfied as to the identity of the individual giving notice under subsection (1), or
- (ii) to locate the data to which the notice relates, and
- (b) has informed that individual of that requirement,
the controller is not obliged to comply with the notice unless the controller is supplied with that further information.
- (3) The controller must, before the end of 21 days beginning with the relevant time, give a notice to the data subject—
- (a) stating that the controller has complied or intends to comply with the notice under subsection (1), or
- (b) stating the controller's reasons for not complying with the notice to any extent and the extent (if any) to which the controller has complied or intends to comply with the notice under subsection (1).
- (4) If the controller does not comply with a notice under subsection (1) to any extent, the data subject may apply to a court for an order that the controller take steps for complying with the notice.
- (5) If the court is satisfied that the controller should comply with the notice (or should comply to any extent), the court may order the controller to take such steps for complying with the notice (or for complying with it to that extent) as the court thinks fit.
- (6) A court may make an order under subsection (5) in relation to a joint controller whose responsibilities are determined in an arrangement under section 104 only if the controller is responsible for compliance with the obligation to which the order relates.
- (7) The jurisdiction conferred on a court by this section is exercisable by the High Court or, in Scotland, by the Court of Session.
- (8) In this section, “*the relevant time*”, in relation to a notice under subsection (1), means—
- (a) when the controller receives the notice, or
- (b) if later, when the controller receives the information (if any) required under subsection (2) in connection with the notice.
#### Rights to rectification and erasure
##### 100
- (1) If a court is satisfied on the application of a data subject that personal data relating to the data subject is inaccurate, the court may order the controller to rectify that data without undue delay.
- (2) If a court is satisfied on the application of a data subject that the processing of personal data relating to the data subject would infringe any of sections 86 to 91, the court may order the controller to erase that data without undue delay.
- (3) If personal data relating to the data subject must be maintained for the purposes of evidence, the court may (instead of ordering the controller to rectify or erase the personal data) order the controller to restrict its processing without undue delay.
- (4) If—
- (a) the data subject contests the accuracy of personal data, and
- (b) the court is satisfied that the controller is not able to ascertain whether the data is accurate or not,
the court may (instead of ordering the controller to rectify or erase the personal data) order the controller to restrict its processing without undue delay.
- (5) A court may make an order under this section in relation to a joint controller whose responsibilities are determined in an arrangement under section 104 only if the controller is responsible for carrying out the rectification, erasure or restriction of processing that the court proposes to order.
- (6) The jurisdiction conferred on a court by this section is exercisable by the High Court or, in Scotland, by the Court of Session.
### CHAPTER 4 — Controller and processor
### Overview
#### Overview
##### 101
This Chapter sets out—
- (a) the general obligations of controllers and processors (see sections 102 to 106);
- (b) specific obligations of controllers and processors with respect to security (see section 107);
- (c) specific obligations of controllers and processors with respect to personal data breaches (see section 108).
### General obligations
#### General obligations of the controller
##### 102
Each controller must implement appropriate measures—
- (a) to ensure, and
- (b) to be able to demonstrate, in particular to the Commissioner,
that the processing of personal data complies with the requirements of this Part.
#### Data protection by design
##### 103
- (1) Where a controller proposes that a particular type of processing of personal data be carried out by or on behalf of the controller, the controller must, prior to the processing, consider the impact of the proposed processing on the rights and freedoms of data subjects.
- (2) A controller must implement appropriate technical and organisational measures which are designed to ensure that—
- (a) the data protection principles are implemented, and
- (b) risks to the rights and freedoms of data subjects are minimised.
#### Joint controllers
##### 104
- (1) Where two or more intelligence services jointly determine the purposes and means of processing personal data, they are joint controllers for the purposes of this Part.
- (2) Joint controllers must, in a transparent manner, determine their respective responsibilities for compliance with this Part by means of an arrangement between them, except to the extent that those responsibilities are determined under or by virtue of an enactment.
- (3) The arrangement must designate the controller which is to be the contact point for data subjects.
#### Processors
##### 105
- (1) This section applies to the use by a controller of a processor to carry out processing of personal data on behalf of the controller.
- (2) The controller may use only a processor who undertakes—
- (a) to implement appropriate measures that are sufficient to secure that the processing complies with this Part;
- (b) to provide to the controller such information as is necessary for demonstrating that the processing complies with this Part.
- (3) If a processor determines, in breach of this Part, the purposes and means of processing, the processor is to be treated for the purposes of this Part as a controller in respect of that processing.
#### Processing under the authority of the controller or processor
##### 106
A processor, and any person acting under the authority of a controller or processor, who has access to personal data may not process the data except—
- (a) on instructions from the controller, or
- (b) to comply with a legal obligation.
### Obligations relating to security
#### Security of processing
##### 107
- (1) Each controller and each processor must implement security measures appropriate to the risks arising from the processing of personal data.
- (2) In the case of automated processing, each controller and each processor must, following an evaluation of the risks, implement measures designed to—
- (a) prevent unauthorised processing or unauthorised interference with the systems used in connection with it,
- (b) ensure that it is possible to establish the precise details of any processing that takes place,
- (c) ensure that any systems used in connection with the processing function properly and may, in the case of interruption, be restored, and
- (d) ensure that stored personal data cannot be corrupted if a system used in connection with the processing malfunctions.
### Obligations relating to personal data breaches
#### Communication of a personal data breach
##### 108
- (1) If a controller becomes aware of a serious personal data breach in relation to personal data for which the controller is responsible, the controller must notify the Commissioner of the breach without undue delay.
- (2) Where the notification to the Commissioner is not made within 72 hours, the notification must be accompanied by reasons for the delay.
- (3) Subject to subsection (4), the notification must include—
- (a) a description of the nature of the personal data breach including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
- (b) the name and contact details of the contact point from whom more information can be obtained;
- (c) a description of the likely consequences of the personal data breach;
- (d) a description of the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
- (4) Where and to the extent that it is not possible to provide all the information mentioned in subsection (3) at the same time, the information may be provided in phases without undue further delay.
- (5) If a processor becomes aware of a personal data breach (in relation to data processed by the processor), the processor must notify the controller without undue delay.
- (6) Subsection (1) does not apply in relation to a personal data breach if the breach also constitutes a relevant error within the meaning given by section 231(9) of the Investigatory Powers Act 2016.
- (7) For the purposes of this section, a personal data breach is serious if the breach seriously interferes with the rights and freedoms of a data subject.
### CHAPTER 5 — Transfers of personal data outside the United Kingdom
#### Transfers of personal data outside the United Kingdom
##### 109
- (1) A controller may not transfer personal data to—
- (a) a country or territory outside the United Kingdom, or
- (b) an international organisation,
unless the transfer falls within subsection (2).
- (2) A transfer of personal data falls within this subsection if the transfer is a necessary and proportionate measure carried out—
- (a) for the purposes of the controller's statutory functions, or
- (b) for other purposes provided for, in relation to the controller, in section 2(2)(a) of the Security Service Act 1989 or section 2(2)(a) or 4(2)(a) of the Intelligence Services Act 1994.
### CHAPTER 6 — Exemptions
#### National security
##### 110
- (1) A provision mentioned in subsection (2) does not apply to personal data to which this Part applies if exemption from the provision is required for the purpose of safeguarding national security.
- (2) The provisions are—
- (a) Chapter 2 (the data protection principles), except section 86(1)(a) and (2) and Schedules 9 and 10;
- (b) Chapter 3 (rights of data subjects);
- (c) in Chapter 4 , section 108 (communication of a personal data breach to the Commissioner);
- (d) in Part 5—
- (i) section 119 (inspection in accordance with international obligations);
- (ii) in Schedule 13 (other general functions of the Commissioner), paragraphs 1(a) and (g) and 2;
- (e) in Part 6—
- (i) sections 142 to 154 and Schedule 15 (Commissioner's notices and powers of entry and inspection);
- (ii) sections 170 to 173 (offences relating to personal data);
- (iii) sections 174 to 176 (provision relating to the special purposes).
#### National security: certificate
##### 111
- (1) Subject to subsection (3), a certificate signed by a Minister of the Crown certifying that exemption from all or any of the provisions mentioned in section 110(2) is, or at any time was, required for the purpose of safeguarding national security in respect of any personal data is conclusive evidence of that fact.
- (2) A certificate under subsection (1)—
- (a) may identify the personal data to which it applies by means of a general description, and
- (b) may be expressed to have prospective effect.
- (3) Any person directly affected by the issuing of a certificate under subsection (1) may appeal to the Tribunal against the certificate.
- (4) If on an appeal under subsection (3), the Tribunal finds that, applying the principles applied by a court on an application for judicial review, the Minister did not have reasonable grounds for issuing the certificate, the Tribunal may—
- (a) allow the appeal, and
- (b) quash the certificate.
- (5) Where, in any proceedings under or by virtue of this Act, it is claimed by a controller that a certificate under subsection (1) which identifies the personal data to which it applies by means of a general description applies to any personal data, another party to the proceedings may appeal to the Tribunal on the ground that the certificate does not apply to the personal data in question.
- (6) But, subject to any determination under subsection (7), the certificate is to be conclusively presumed so to apply.
- (7) On an appeal under subsection (5), the Tribunal may determine that the certificate does not so apply.
- (8) A document purporting to be a certificate under subsection (1) is to be—
- (a) received in evidence, and
- (b) deemed to be such a certificate unless the contrary is proved.
- (9) A document which purports to be certified by or on behalf of a Minister of the Crown as a true copy of a certificate issued by that Minister under subsection (1) is—
- (a) in any legal proceedings, evidence of that certificate, and
- (b) in any legal proceedings in Scotland, sufficient evidence of that certificate.
- (10) The power conferred by subsection (1) on a Minister of the Crown is exercisable only by—
- (a) a Minister who is a member of the Cabinet, or
- (b) the Attorney General or the Advocate General for Scotland.
#### Other exemptions
##### 112
Schedule 11 provides for further exemptions.
#### Power to make further exemptions
##### 113
- (1) The Secretary of State may by regulations amend Schedule 11—
- (a) by adding exemptions from any provision of this Part;
- (b) by omitting exemptions added by regulations under paragraph (a).
- (2) Regulations under this section are subject to the affirmative resolution procedure.
## PART 5 — The Information Commissioner
### The Commissioner
#### The Information Commissioner
##### 114
- (1) There is to continue to be an Information Commissioner.
- (2) Schedule 12 makes provision about the Commissioner.
### General functions
#### General functions under the GDPR and safeguards
##### 115
- (1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (2) General functions are conferred on the Commissioner by—
- (a) Article 57 of the UK GDPR (tasks), and
- (b) Article 58 of the UK GDPR (powers),
(and see also the Commissioner's duty under section 2 and section 28(5)).
- (3) The Commissioner's functions in relation to the processing of personal data to which the UK GDPR applies include—
- (a) a duty to advise Parliament, the government and other institutions and bodies on legislative and administrative measures relating to the protection of individuals' rights and freedoms with regard to the processing of personal data, and
- (b) a power to issue, on the Commissioner's own initiative or on request, opinions to Parliament, the government or other institutions and bodies as well as to the public on any issue related to the protection of personal data.
- (4) The Commissioner's functions under Article 58 of the UK GDPR are subject to the safeguards in subsections (5) to (9).
- (5) The Commissioner's power under Article 58(1)(a) of the UK GDPR (power to require a controller or processor to provide information that the Commissioner requires for the performance of the Commissioner's tasks under the UK GDPR) is exercisable only by giving an information notice under section 142.
- (6) The Commissioner's power under Article 58(1)(b) of the UK GDPR (power to carry out data protection audits) is exercisable only in accordance with section 146.
- (7) The Commissioner's powers under Article 58(1)(e) and (f) of the UK GDPR (power to obtain information from controllers and processors and access to their premises) are exercisable only—
- (a) in accordance with Schedule 15 (see section 154), or
- (b) to the extent that they are exercised in conjunction with the power under Article 58(1)(b) of the UK GDPR, in accordance with section 146.
- (8) The following powers are exercisable only by giving an enforcement notice under section 149—
- (a) the Commissioner's powers under Article 58(2)(c) to (g) and (j) of the UK GDPR (certain corrective powers);
- (b) the Commissioner's powers under Article 58(2)(h) to order a certification body to withdraw, or not to issue, a certification under Articles 42 and 43 of the UK GDPR.
- (9) The Commissioner's powers under Articles 58(2)(i) and 83 of the UK GDPR (administrative fines) are exercisable only by giving a penalty notice under section 155.
- (10) This section is without prejudice to other functions conferred on the Commissioner, whether by the UK GDPR, this Act or otherwise.
#### Other general functions
##### 116
- (A1) The Commissioner is responsible for monitoring the application of Part 3 of this Act, in order to protect the fundamental rights and freedoms of individuals in relation to processing by a competent authority for any of the law enforcement purposes (as defined in Part 3) and to facilitate the free flow of personal data.
- (1) The Commissioner—
- (a) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (b) is to continue to be the designated authority in the United Kingdom for the purposes of Article 13 of the Data Protection Convention.
- (2) Schedule 13 confers general functions on the Commissioner in connection with processing to which the UK GDPR does not apply (and see also the Commissioner's duty under section 2).
- (3) This section and Schedule 13 are without prejudice to other functions conferred on the Commissioner, whether by this Act or otherwise.
#### Competence in relation to courts etc
##### 117
Nothing in this Act or the UK GDPR permits or requires the Commissioner to exercise functions in relation to the processing of personal data by—
- (a) an individual acting in a judicial capacity, or
- (b) a court or tribunal acting in its judicial capacity ...
....
### International role
#### Co-operation and mutual assistance
##### 118
- (1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (4) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (5) Part 2 of Schedule 14 makes provision as to the functions to be carried out by the Commissioner for the purposes of Article 13 of the Data Protection Convention (co-operation between parties).
#### Inspection of personal data in accordance with international obligations
##### 119
- (1) The Commissioner may inspect personal data where the inspection is necessary in order to discharge an international obligation of the United Kingdom, subject to the restriction in subsection (2).
- (2) The power under subsection (1) is exercisable only if the personal data—
- (a) is processed wholly or partly by automated means, or
- (b) is processed otherwise than by automated means and forms part of a filing system or is intended to form part of a filing system.
- (3) The power under subsection (1) includes power to inspect, operate and test equipment which is used for the processing of personal data.
- (4) Before exercising the power under subsection (1), the Commissioner must by written notice inform the controller and any processor that the Commissioner intends to do so.
- (5) Subsection (4) does not apply if the Commissioner considers that the case is urgent.
- (6) It is an offence—
- (a) intentionally to obstruct a person exercising the power under subsection (1), or
- (b) to fail without reasonable excuse to give a person exercising that power any assistance the person may reasonably require.
- (7) Paragraphs (c) and (d) of section 3(14) do not apply to references in this section to personal data, the processing of personal data, a controller or a processor.
#### Further international role
##### 120
- (1) The Commissioner must, in relation to third countries and international organisations, take appropriate steps to—
- (a) develop international co-operation mechanisms to facilitate the effective enforcement of legislation for the protection of personal data;
- (b) provide international mutual assistance in the enforcement of legislation for the protection of personal data, subject to appropriate safeguards for the protection of personal data and other fundamental rights and freedoms;
- (c) engage relevant stakeholders in discussion and activities aimed at furthering international co-operation in the enforcement of legislation for the protection of personal data;
- (d) promote the exchange and documentation of legislation and practice for the protection of personal data, including legislation and practice relating to jurisdictional conflicts with third countries.
- (2) Subsection (1) applies only in connection with the processing of personal data to which the UK GDPR does not apply; for the equivalent duty in connection with the processing of personal data to which the UK GDPR applies, see Article 50 of the UK GDPR (international co-operation for the protection of personal data).
- (2A) The Commissioner may contribute to the activities of international organisations with data protection functions.
- (3) The Commissioner must carry out data protection functions which the Secretary of State directs the Commissioner to carry out for the purpose of enabling Her Majesty's Government in the United Kingdom to give effect to an international obligation of the United Kingdom.
- (4) The Commissioner may provide an authority carrying out data protection functions under the law of a British overseas territory with assistance in carrying out those functions.
- (5) The Secretary of State may direct that assistance under subsection (4) is to be provided on terms, including terms as to payment, specified or approved by the Secretary of State.
- (6) In this section—
- “*data protection functions*” means functions relating to the protection of individuals with respect to the processing of personal data;
- “*mutual assistance in the enforcement of legislation for the protection of personal data*” includes assistance in the form of notification, complaint referral, investigative assistance and information exchange;
- “*third country*” means a country or territory outside the United Kingdom.
- (7) Section 3(14)(c) does not apply to references to personal data and the processing of personal data in this section.
### Codes of practice
#### Data-sharing code
##### 121
- (1) The Commissioner must prepare a code of practice which contains—
- (a) practical guidance in relation to the sharing of personal data in accordance with the requirements of the data protection legislation, and
- (b) such other guidance as the Commissioner considers appropriate to promote good practice in the sharing of personal data.
- (2) Where a code under this section is in force, the Commissioner may prepare amendments of the code or a replacement code.
- (3) Before preparing a code or amendments under this section, the Commissioner must consult the Secretary of State and such of the following as the Commissioner considers appropriate—
- (a) trade associations;
- (b) data subjects;
- (c) persons who appear to the Commissioner to represent the interests of data subjects.
- (4) A code under this section may include transitional provision or savings.
- (5) In this section—
- “*good practice in the sharing of personal data*” means such practice in the sharing of personal data as appears to the Commissioner to be desirable having regard to the interests of data subjects and others, including compliance with the requirements of the data protection legislation;
- “*the sharing of personal data*” means the disclosure of personal data by transmission, dissemination or otherwise making it available;
- “*trade association*” includes a body representing controllers or processors.
#### Direct marketing code
##### 122
- (1) The Commissioner must prepare a code of practice which contains—
- (a) practical guidance in relation to the carrying out of direct marketing in accordance with the requirements of the data protection legislation and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426), and
- (b) such other guidance as the Commissioner considers appropriate to promote good practice in direct marketing.
- (2) Where a code under this section is in force, the Commissioner may prepare amendments of the code or a replacement code.
- (3) Before preparing a code or amendments under this section, the Commissioner must consult the Secretary of State and such of the following as the Commissioner considers appropriate—
- (a) trade associations;
- (b) data subjects;
- (c) persons who appear to the Commissioner to represent the interests of data subjects.
- (4) A code under this section may include transitional provision or savings.
- (5) In this section—
- “*direct marketing*” means the communication (by whatever means) of advertising or marketing material which is directed to particular individuals;
- “*good practice in direct marketing*” means such practice in direct marketing as appears to the Commissioner to be desirable having regard to the interests of data subjects and others, including compliance with the requirements mentioned in subsection (1)(a);
- “*trade association*” includes a body representing controllers or processors.
#### Age-appropriate design code
##### 123
- (1) The Commissioner must prepare a code of practice which contains such guidance as the Commissioner considers appropriate on standards of age-appropriate design of relevant information society services which are likely to be accessed by children.
- (2) Where a code under this section is in force, the Commissioner may prepare amendments of the code or a replacement code.
- (3) Before preparing a code or amendments under this section, the Commissioner must consult the Secretary of State and such other persons as the Commissioner considers appropriate, including—
- (a) children,
- (b) parents,
- (c) persons who appear to the Commissioner to represent the interests of children,
- (d) child development experts, and
- (e) trade associations.
- (4) In preparing a code or amendments under this section, the Commissioner must have regard—
- (a) to the fact that children have different needs at different ages, and
- (b) to the United Kingdom's obligations under the United Nations Convention on the Rights of the Child.
- (5) A code under this section may include transitional provision or savings.
- (6) Any transitional provision included in the first code under this section must cease to have effect before the end of the period of 12 months beginning when the code comes into force.
- (7) In this section—
- “*age-appropriate design*” means the design of services so that they are appropriate for use by, and meet the development needs of, children;
- “*information society services*” has the same meaning as in the UK GDPR, but does not include preventive or counselling services;
- “*relevant information society services*” means information society services which involve the processing of personal data to which the UK GDPR applies;
- “*standards of age-appropriate design of relevant information society services*” means such standards of age-appropriate design of such services as appear to the Commissioner to be desirable having regard to the best interests of children;
- “*trade association*” includes a body representing controllers or processors;
- “*the United Nations Convention on the Rights of the Child*” means the Convention on the Rights of the Child adopted by the General Assembly of the United Nations on 20 November 1989 (including any Protocols to that Convention which are in force in relation to the United Kingdom), subject to any reservations, objections or interpretative declarations by the United Kingdom for the time being in force.
#### Data protection and journalism code
##### 124
- (1) The Commissioner must prepare a code of practice which contains—
- (a) practical guidance in relation to the processing of personal data for the purposes of journalism in accordance with the requirements of the data protection legislation, and
- (b) such other guidance as the Commissioner considers appropriate to promote good practice in the processing of personal data for the purposes of journalism.
- (2) Where a code under this section is in force, the Commissioner may prepare amendments of the code or a replacement code.
- (3) Before preparing a code or amendments under this section, the Commissioner must consult such of the following as the Commissioner considers appropriate—
- (a) trade associations;
- (b) data subjects;
- (c) persons who appear to the Commissioner to represent the interests of data subjects.
- (4) A code under this section may include transitional provision or savings.
- (5) In this section—
- “*good practice in the processing of personal data for the purposes of journalism*” means such practice in the processing of personal data for those purposes as appears to the Commissioner to be desirable having regard to—the interests of data subjects and others, including compliance with the requirements of the data protection legislation, andthe special importance of the public interest in the freedom of expression and information;
- “*trade association*” includes a body representing controllers or processors.
#### Approval of codes prepared under sections 121 to 124
##### 125
- (1) When a code is prepared under section 121, 122, 123 or 124—
- (a) the Commissioner must submit the final version to the Secretary of State, and
- (b) the Secretary of State must lay the code before Parliament.
- (2) In relation to the first code under section 123—
- (a) the Commissioner must prepare the code as soon as reasonably practicable and must submit it to the Secretary of State before the end of the period of 18 months beginning when this Act is passed, and
- (b) the Secretary of State must lay it before Parliament as soon as reasonably practicable.
- (3) If, within the 40-day period, either House of Parliament resolves not to approve a code prepared under section 121, 122, 123 or 124, the Commissioner must not issue the code.
- (4) If no such resolution is made within that period—
- (a) the Commissioner must issue the code, and
- (b) the code comes into force at the end of the period of 21 days beginning with the day on which it is issued.
- (5) If, as a result of subsection (3), there is no code in force under section 121, 122, 123 or 124, the Commissioner must prepare another version of the code.
- (6) Nothing in subsection (3) prevents another version of the code being laid before Parliament.
- (7) In this section, “*the 40-day period*” means—
- (a) if the code is laid before both Houses of Parliament on the same day, the period of 40 days beginning with that day, or
- (b) if the code is laid before the Houses of Parliament on different days, the period of 40 days beginning with the later of those days.
- (8) In calculating the 40-day period, no account is to be taken of any period during which Parliament is dissolved or prorogued or during which both Houses of Parliament are adjourned for more than 4 days.
- (9) This section, other than subsections (2) and (5), applies in relation to amendments prepared under section 121, 122, 123 or 124 as it applies in relation to codes prepared under those sections.
#### Publication and review of codes issued under section 125(4)
##### 126
- (1) The Commissioner must publish a code issued under section 125(4).
- (2) Where an amendment of a code is issued under section 125(4), the Commissioner must publish—
- (a) the amendment, or
- (b) the code as amended by it.
- (3) The Commissioner must keep under review each code issued under section 125(4) for the time being in force.
- (4) Where the Commissioner becomes aware that the terms of such a code could result in a breach of an international obligation of the United Kingdom, the Commissioner must exercise the power under section 121(2), 122(2), 123(2) or 124(2) with a view to remedying the situation.
#### Effect of codes issued under section 125(4)
##### 127
- (1) A failure by a person to act in accordance with a provision of a code issued under section 125(4) does not of itself make that person liable to legal proceedings in a court or tribunal.
- (2) A code issued under section 125(4), including an amendment or replacement code, is admissible in evidence in legal proceedings.
- (3) In any proceedings before a court or tribunal, the court or tribunal must take into account a provision of a code issued under section 125(4) in determining a question arising in the proceedings if—
- (a) the question relates to a time when the provision was in force, and
- (b) the provision appears to the court or tribunal to be relevant to the question.
- (4) Where the Commissioner is carrying out a function described in subsection (5), the Commissioner must take into account a provision of a code issued under section 125(4) in determining a question arising in connection with the carrying out of the function if—
- (a) the question relates to a time when the provision was in force, and
- (b) the provision appears to the Commissioner to be relevant to the question.
- (5) Those functions are functions under—
- (a) the data protection legislation, or
- (b) the Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426).
#### Other codes of practice
##### 128
- (1) The Secretary of State may by regulations require the Commissioner—
- (a) to prepare appropriate codes of practice giving guidance as to good practice in the processing of personal data, and
- (b) to make them available to such persons as the Commissioner considers appropriate.
- (2) Before preparing such codes, the Commissioner must consult such of the following as the Commissioner considers appropriate—
- (a) trade associations;
- (b) data subjects;
- (c) persons who appear to the Commissioner to represent the interests of data subjects.
- (3) Regulations under this section—
- (a) must describe the personal data or processing to which the code of practice is to relate, and
- (b) may describe the persons or classes of person to whom it is to relate.
- (4) Regulations under this section are subject to the negative resolution procedure.
- (5) In this section—
- “*good practice in the processing of personal data*” means such practice in the processing of personal data as appears to the Commissioner to be desirable having regard to the interests of data subjects and others, including compliance with the requirements of the data protection legislation;
- “*trade association*” includes a body representing controllers or processors.
### Consensual audits
#### Consensual audits
##### 129
- (1) The Commissioner's functions under Article 58(1) of the UK GDPR and paragraph 1 of Schedule 13 include power, with the consent of a controller or processor, to carry out an assessment of whether the controller or processor is complying with good practice in the processing of personal data.
- (2) The Commissioner must inform the controller or processor of the results of such an assessment.
- (3) In this section, “*good practice in the processing of personal data*” has the same meaning as in section 128.
### Records of national security certificates
#### Records of national security certificates
##### 130
- (1) A Minister of the Crown who issues a certificate under section 27, 79 or 111 must send a copy of the certificate to the Commissioner.
- (2) If the Commissioner receives a copy of a certificate under subsection (1), the Commissioner must publish a record of the certificate.
- (3) The record must contain—
- (a) the name of the Minister who issued the certificate,
- (b) the date on which the certificate was issued, and
- (c) subject to subsection (4), the text of the certificate.
- (4) The Commissioner must not publish the text, or a part of the text, of the certificate if—
- (a) the Minister determines that publishing the text or that part of the text—
- (i) would be against the interests of national security,
- (ii) would be contrary to the public interest, or
- (iii) might jeopardise the safety of any person, and
- (b) the Minister has notified the Commissioner of that determination.
- (5) The Commissioner must keep the record of the certificate available to the public while the certificate is in force.
- (6) If a Minister of the Crown revokes a certificate issued under section 27, 79 or 111, the Minister must notify the Commissioner.
### Information provided to the Commissioner
#### Disclosure of information to the Commissioner
##### 131
- (1) No enactment or rule of law prohibiting or restricting the disclosure of information precludes a person from providing the Commissioner with information necessary for the discharge of the Commissioner's functions.
- (2) But this section does not authorise the making of a disclosure which is prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.
- (3) Until the repeal of Part 1 of the Regulation of Investigatory Powers Act 2000 by paragraphs 45 and 54 of Schedule 10 to the Investigatory Powers Act 2016 is fully in force, subsection (2) has effect as if it included a reference to that Part.
#### Confidentiality of information
##### 132
- (1) A person who is or has been the Commissioner, or a member of the Commissioner's staff or an agent of the Commissioner, must not disclose information which—
- (a) has been obtained by, or provided to, the Commissioner in the course of, or for the purposes of, the discharging of the Commissioner's functions,
- (b) relates to an identified or identifiable individual or business, and
- (c) is not available to the public from other sources at the time of the disclosure and has not previously been available to the public from other sources,
unless the disclosure is made with lawful authority.
- (2) For the purposes of subsection (1), a disclosure is made with lawful authority only if and to the extent that—
- (a) the disclosure was made with the consent of the individual or of the person for the time being carrying on the business,
- (b) the information was obtained or provided as described in subsection (1)(a) for the purpose of its being made available to the public (in whatever manner),
- (c) the disclosure was made for the purposes of, and is necessary for, the discharge of one or more of the Commissioner's functions,
- (d) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (e) the disclosure was made for the purposes of criminal or civil proceedings, however arising, or
- (f) having regard to the rights, freedoms and legitimate interests of any person, the disclosure was necessary in the public interest.
- (3) It is an offence for a person knowingly or recklessly to disclose information in contravention of subsection (1).
#### Guidance about privileged communications
##### 133
- (1) The Commissioner must produce and publish guidance about—
- (a) how the Commissioner proposes to secure that privileged communications which the Commissioner obtains or has access to in the course of carrying out the Commissioner's functions are used or disclosed only so far as necessary for carrying out those functions, and
- (b) how the Commissioner proposes to comply with restrictions and prohibitions on obtaining or having access to privileged communications which are imposed by an enactment.
- (2) The Commissioner—
- (a) may alter or replace the guidance, and
- (b) must publish any altered or replacement guidance.
- (3) The Commissioner must consult the Secretary of State before publishing guidance under this section (including altered or replacement guidance).
- (4) The Commissioner must arrange for guidance under this section (including altered or replacement guidance) to be laid before Parliament.
- (5) In this section, “*privileged communications*” means—
- (a) communications made—
- (i) between a professional legal adviser and the adviser's client, and
- (ii) in connection with the giving of legal advice to the client with respect to legal obligations, liabilities or rights, and
- (b) communications made—
- (i) between a professional legal adviser and the adviser's client or between such an adviser or client and another person,
- (ii) in connection with or in contemplation of legal proceedings, and
- (iii) for the purposes of such proceedings.
- (6) In subsection (5)—
- (a) references to the client of a professional legal adviser include references to a person acting on behalf of the client, and
- (b) references to a communication include—
- (i) a copy or other record of the communication, and
- (ii) anything enclosed with or referred to in the communication if made as described in subsection (5)(a)(ii) or in subsection (5)(b)(ii) and (iii).
### Fees
#### Fees for services
##### 134
The Commissioner may require a person other than a data subject or a data protection officer to pay a reasonable fee for a service provided to the person, or at the person's request, which the Commissioner is required or authorised to provide under the data protection legislation.
#### Manifestly unfounded or excessive requests by data subjects etc
##### 135
- (1) Where a request to the Commissioner from a data subject or a data protection officer is manifestly unfounded or excessive, the Commissioner may—
- (a) charge a reasonable fee for dealing with the request, or
- (b) refuse to act on the request.
- (2) An example of a request that may be excessive is one that merely repeats the substance of previous requests.
- (3) In any proceedings where there is an issue as to whether a request described in subsection (1) is manifestly unfounded or excessive, it is for the Commissioner to show that it is.
- (4) Subsections (1) and (3) apply only in cases in which the Commissioner does not already have such powers and obligations under Article 57(4) of the UK GDPR.
#### Guidance about fees
##### 136
- (1) The Commissioner must produce and publish guidance about the fees the Commissioner proposes to charge in accordance with—
- (a) section 134 or 135, or
- (b) Article 57(4) of the UK GDPR.
- (2) Before publishing the guidance, the Commissioner must consult the Secretary of State.
### Charges
#### Charges payable to the Commissioner by controllers
##### 137
- (1) The Secretary of State may by regulations require controllers to pay charges of an amount specified in the regulations to the Commissioner.
- (2) Regulations under subsection (1) may require a controller to pay a charge regardless of whether the Commissioner has provided, or proposes to provide, a service to the controller.
- (3) Regulations under subsection (1) may—
- (a) make provision about the time or times at which, or period or periods within which, a charge must be paid;
- (b) make provision for cases in which a discounted charge is payable;
- (c) make provision for cases in which no charge is payable;
- (d) make provision for cases in which a charge which has been paid is to be refunded.
- (4) In making regulations under subsection (1), the Secretary of State must have regard to the desirability of securing that the charges payable to the Commissioner under such regulations are sufficient to offset—
- (a) expenses incurred by the Commissioner in discharging the Commissioner's functions—
- (i) under the data protection legislation,
- (ii) under the Data Protection Act 1998,
- (iii) under or by virtue of sections 108 and 109 of the Digital Economy Act 2017, and
- (iv) under or by virtue of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426),
- (b) any expenses of the Secretary of State in respect of the Commissioner so far as attributable to those functions,
- (c) to the extent that the Secretary of State considers appropriate, any deficit previously incurred (whether before or after the passing of this Act) in respect of the expenses mentioned in paragraph (a), and
- (d) to the extent that the Secretary of State considers appropriate, expenses incurred by the Secretary of State in respect of the inclusion of any officers or staff of the Commissioner in any scheme under section 1 of the Superannuation Act 1972 or section 1 of the Public Service Pensions Act 2013.
- (5) The Secretary of State may from time to time require the Commissioner to provide information about the expenses referred to in subsection (4)(a).
- (6) The Secretary of State may by regulations make provision—
- (a) requiring a controller to provide information to the Commissioner, or
- (b) enabling the Commissioner to require a controller to provide information to the Commissioner,
for either or both of the purposes mentioned in subsection (7).
- (7) Those purposes are—
- (a) determining whether a charge is payable by the controller under regulations under subsection (1);
- (b) determining the amount of a charge payable by the controller.
- (8) The provision that may be made under subsection (6)(a) includes provision requiring a controller to notify the Commissioner of a change in the controller's circumstances of a kind specified in the regulations.
#### Regulations under section 137: supplementary
##### 138
- (1) Before making regulations under section 137(1) or (6), the Secretary of State must consult such representatives of persons likely to be affected by the regulations as the Secretary of State thinks appropriate (and see also section 182).
- (2) The Commissioner—
- (a) must keep under review the working of regulations under section 137(1) or (6), and
- (b) may from time to time submit proposals to the Secretary of State for amendments to be made to the regulations.
- (3) The Secretary of State must review the working of regulations under section 137(1) or (6)—
- (a) at the end of the period of 5 years beginning with the making of the first set of regulations under section 108 of the Digital Economy Act 2017, and
- (b) at the end of each subsequent 5 year period.
- (4) Regulations under section 137(1) are subject to the negative resolution procedure if—
- (a) they only make provision increasing a charge for which provision is made by previous regulations under section 137(1) or section 108(1) of the Digital Economy Act 2017, and
- (b) they do so to take account of an increase in the retail prices index since the previous regulations were made.
- (5) Subject to subsection (4), regulations under section 137(1) or (6) are subject to the affirmative resolution procedure.
- (6) In subsection (4), “*the retail prices index*” means—
- (a) the general index of retail prices (for all items) published by the Statistics Board, or
- (b) where that index is not published for a month, any substitute index or figures published by the Board.
- (7) Regulations under section 137(1) or (6) may not apply to—
- (a) Her Majesty in her private capacity,
- (b) Her Majesty in right of the Duchy of Lancaster, or
- (c) the Duke of Cornwall.
### Reports etc
#### Reporting to Parliament
##### 139
- (1) The Commissioner must—
- (a) produce a general report on the carrying out of the Commissioner's functions annually,
- (b) arrange for it to be laid before Parliament, and
- (c) publish it.
- (2) The report must include the annual report required under Article 59 of the UK GDPR.
- (3) The Commissioner may produce other reports relating to the carrying out of the Commissioner's functions and arrange for them to be laid before Parliament.
#### Publication by the Commissioner
##### 140
A duty under this Act for the Commissioner to publish a document is a duty for the Commissioner to publish it, or to arrange for it to be published, in such form and manner as the Commissioner considers appropriate.
#### Notices from the Commissioner
##### 141
- (1) This section applies in relation to a notice authorised or required by this Act to be given to a person by the Commissioner.
- (2) The notice may be given to an individual—
- (a) by delivering it to the individual,
- (b) by sending it to the individual by post addressed to the individual at his or her usual or last-known place of residence or business, or
- (c) by leaving it for the individual at that place.
- (3) The notice may be given to a body corporate or unincorporate—
- (a) by sending it by post to the proper officer of the body at its principal office, or
- (b) by addressing it to the proper officer of the body and leaving it at that office.
- (4) The notice may be given to a partnership in Scotland—
- (a) by sending it by post to the principal office of the partnership, or
- (b) by addressing it to that partnership and leaving it at that office.
- (5) The notice may be given to the person by other means, including by electronic means, with the person's consent.
- (6) In this section—
- “*principal office*”, in relation to a registered company, means its registered office;
- “*proper officer*”, in relation to any body, means the secretary or other executive officer charged with the conduct of its general affairs;
- “*registered company*” means a company registered under the enactments relating to companies for the time being in force in the United Kingdom.
- (7) This section is without prejudice to any other lawful method of giving a notice.
## PART 6 — Enforcement
### Information notices
#### Information notices
##### 142
- (1) The Commissioner may, by written notice (an “information notice”)—
- (a) require a controller or processor to provide the Commissioner with information that the Commissioner reasonably requires for the purposes of carrying out the Commissioner's functions under the data protection legislation, or
- (b) require any person to provide the Commissioner with information that the Commissioner reasonably requires for the purposes of—
- (i) investigating a suspected failure of a type described in section 149(2) or a suspected offence under this Act, or
- (ii) determining whether the processing of personal data is carried out by an individual in the course of a purely personal or household activity.
- (2) An information notice must state—
- (a) whether it is given under subsection (1)(a), (b)(i) or (b)(ii), and
- (b) why the Commissioner requires the information.
- (3) An information notice—
- (a) may specify or describe particular information or a category of information;
- (b) may specify the form in which the information must be provided;
- (c) may specify the time at which, or the period within which, the information must be provided;
- (d) may specify the place where the information must be provided;
(but see the restrictions in subsections (5) to (7)).
- (4) An information notice must provide information about—
- (a) the consequences of failure to comply with it, and
- (b) the rights under sections 162 and 164 (appeals etc).
- (5) An information notice may not require a person to provide information before the end of the period within which an appeal can be brought against the notice.
- (6) If an appeal is brought against an information notice, the information need not be provided pending the determination or withdrawal of the appeal.
- (7) If an information notice—
- (a) states that, in the Commissioner's opinion, the information is required urgently, and
- (b) gives the Commissioner's reasons for reaching that opinion,
subsections (5) and (6) do not apply but the notice must not require the information to be provided before the end of the period of 24 hours beginning when the notice is given.
- (8) The Commissioner may cancel an information notice by written notice to the person to whom it was given.
- (9) In subsection (1), in relation to a person who is a controller or processor for the purposes of the UK GDPR, the reference to a controller or processor includes a representative of a controller or processor designated under Article 27 of the UK GDPR (representatives of controllers or processors not established in the United Kingdom).
- (10) Section 3(14)(c) does not apply to the reference to the processing of personal data in subsection (1)(b).
#### Information notices: restrictions
##### 143
- (1) The Commissioner may not give an information notice with respect to the processing of personal data for the special purposes unless—
- (a) a determination under section 174 with respect to the data or the processing has taken effect, or
- (b) the Commissioner—
- (i) has reasonable grounds for suspecting that such a determination could be made, and
- (ii) the information is required for the purposes of making such a determination.
- (2) An information notice does not require a person to give the Commissioner information to the extent that requiring the person to do so would involve an infringement of the privileges of either House of Parliament.
- (3) An information notice does not require a person to give the Commissioner information in respect of a communication which is made—
- (a) between a professional legal adviser and the adviser's client, and
- (b) in connection with the giving of legal advice to the client with respect to obligations, liabilities or rights under the data protection legislation.
- (4) An information notice does not require a person to give the Commissioner information in respect of a communication which is made—
- (a) between a professional legal adviser and the adviser's client or between such an adviser or client and another person,
- (b) in connection with or in contemplation of proceedings under or arising out of the data protection legislation, and
- (c) for the purposes of such proceedings.
- (5) In subsections (3) and (4), references to the client of a professional legal adviser include references to a person acting on behalf of the client.
- (6) An information notice does not require a person to provide the Commissioner with information if doing so would, by revealing evidence of the commission of an offence expose the person to proceedings for that offence.
- (7) The reference to an offence in subsection (6) does not include an offence under—
- (a) this Act;
- (b) section 5 of the Perjury Act 1911 (false statements made otherwise than on oath);
- (c) section 44(2) of the Criminal Law (Consolidation) (Scotland) Act 1995 (false statements made otherwise than on oath);
- (d) Article 10 of the Perjury (Northern Ireland) Order 1979 (S.I. 1979/1714 (N.I. 19)) (false statutory declarations and other false unsworn statements).
- (8) An oral or written statement provided by a person in response to an information notice may not be used in evidence against that person on a prosecution for an offence under this Act (other than an offence under section 144) unless in the proceedings—
- (a) in giving evidence the person provides information inconsistent with the statement, and
- (b) evidence relating to the statement is adduced, or a question relating to it is asked, by that person or on that person's behalf.
- (9) In subsection (6), in relation to an information notice given to a representative of a controller or processor designated under Article 27 of the UK GDPR, the reference to the person providing the information being exposed to proceedings for an offence includes a reference to the controller or processor being exposed to such proceedings.
#### False statements made in response to information notices
##### 144
It is an offence for a person, in response to an information notice—
- (a) to make a statement which the person knows to be false in a material respect, or
- (b) recklessly to make a statement which is false in a material respect.
#### Information orders
##### 145
- (1) This section applies if, on an application by the Commissioner, a court is satisfied that a person has failed to comply with a requirement of an information notice.
- (2) The court may make an order requiring the person to provide to the Commissioner some or all of the following—
- (a) information referred to in the information notice;
- (b) other information which the court is satisfied the Commissioner requires, having regard to the statement included in the notice in accordance with section 142(2)(b).
- (3) The order—
- (a) may specify the form in which the information must be provided,
- (b) must specify the time at which, or the period within which, the information must be provided, and
- (c) may specify the place where the information must be provided.
### Assessment notices
#### Assessment notices
##### 146
- (1) The Commissioner may by written notice (an “assessment notice”) require a controller or processor to permit the Commissioner to carry out an assessment of whether the controller or processor has complied or is complying with the data protection legislation.
- (2) An assessment notice may require the controller or processor to do any of the following—
- (a) permit the Commissioner to enter specified premises;
- (b) direct the Commissioner to documents on the premises that are of a specified description;
- (c) assist the Commissioner to view information of a specified description that is capable of being viewed using equipment on the premises;
- (d) comply with a request from the Commissioner for a copy (in such form as may be requested) of—
- (i) the documents to which the Commissioner is directed;
- (ii) the information which the Commissioner is assisted to view;
- (e) direct the Commissioner to equipment or other material on the premises which is of a specified description;
- (f) permit the Commissioner to inspect or examine the documents, information, equipment or material to which the Commissioner is directed or which the Commissioner is assisted to view;
- (g) provide the Commissioner with an explanation of such documents, information, equipment or material;
- (h) permit the Commissioner to observe the processing of personal data that takes place on the premises;
- (i) make available for interview by the Commissioner a specified number of people of a specified description who process personal data on behalf of the controller, not exceeding the number who are willing to be interviewed.
- (3) In subsection (2), references to the Commissioner include references to the Commissioner's officers and staff.
- (4) An assessment notice must, in relation to each requirement imposed by the notice, specify the time or times at which, or period or periods within which, the requirement must be complied with (but see the restrictions in subsections (6) to (9)).
- (5) An assessment notice must provide information about—
- (a) the consequences of failure to comply with it, and
- (b) the rights under sections 162 and 164 (appeals etc).
- (6) An assessment notice may not require a person to do anything before the end of the period within which an appeal can be brought against the notice.
- (7) If an appeal is brought against an assessment notice, the controller or processor need not comply with a requirement in the notice pending the determination or withdrawal of the appeal.
- (8) If an assessment notice—
- (a) states that, in the Commissioner's opinion, it is necessary for the controller or processor to comply with a requirement in the notice urgently,
- (b) gives the Commissioner's reasons for reaching that opinion, and
- (c) does not meet the conditions in subsection (9)(a) to (d),
subsections (6) and (7) do not apply but the notice must not require the controller or processor to comply with the requirement before the end of the period of 7 days beginning when the notice is given.
- (9) If an assessment notice—
- (a) states that, in the Commissioner's opinion, there are reasonable grounds for suspecting that a controller or processor has failed or is failing as described in section 149(2) or that an offence under this Act has been or is being committed,
- (b) indicates the nature of the suspected failure or offence,
- (c) does not specify domestic premises,
- (d) states that, in the Commissioner's opinion, it is necessary for the controller or processor to comply with a requirement in the notice in less than 7 days, and
- (e) gives the Commissioner's reasons for reaching that opinion,
subsections (6) and (7) do not apply.
- (10) The Commissioner may cancel an assessment notice by written notice to the controller or processor to whom it was given.
- (11) Where the Commissioner gives an assessment notice to a processor, the Commissioner must, so far as reasonably practicable, give a copy of the notice to each controller for whom the processor processes personal data.
- (12) In this section—
- “*domestic premises*” means premises, or a part of premises, used as a dwelling;
- “*specified*” means specified in an assessment notice.
#### Assessment notices: restrictions
##### 147
- (1) An assessment notice does not require a person to do something to the extent that requiring the person to do it would involve an infringement of the privileges of either House of Parliament.
- (2) An assessment notice does not have effect so far as compliance would result in the disclosure of a communication which is made—
- (a) between a professional legal adviser and the adviser's client, and
- (b) in connection with the giving of legal advice to the client with respect to obligations, liabilities or rights under the data protection legislation.
- (3) An assessment notice does not have effect so far as compliance would result in the disclosure of a communication which is made—
- (a) between a professional legal adviser and the adviser's client or between such an adviser or client and another person,
- (b) in connection with or in contemplation of proceedings under or arising out of the data protection legislation, and
- (c) for the purposes of such proceedings.
- (4) In subsections (2) and (3)—
- (a) references to the client of a professional legal adviser include references to a person acting on behalf of such a client, and
- (b) references to a communication include—
- (i) a copy or other record of the communication, and
- (ii) anything enclosed with or referred to in the communication if made as described in subsection (2)(b) or in subsection (3)(b) and (c).
- (5) The Commissioner may not give a controller or processor an assessment notice with respect to the processing of personal data for the special purposes.
- (6) The Commissioner may not give an assessment notice to—
- (a) a body specified in section 23(3) of the Freedom of Information Act 2000 (bodies dealing with security matters), or
- (b) the Office for Standards in Education, Children's Services and Skills in so far as it is a controller or processor in respect of information processed for the purposes of functions exercisable by Her Majesty's Chief Inspector of Education, Children's Services and Skills by virtue of section 5(1)(a) of the Care Standards Act 2000.
### Information notices and assessment notices: destruction of documents etc
#### Destroying or falsifying information and documents etc
##### 148
- (1) This section applies where a person—
- (a) has been given an information notice requiring the person to provide the Commissioner with information, or
- (b) has been given an assessment notice requiring the person to direct the Commissioner to a document, equipment or other material or to assist the Commissioner to view information.
- (2) It is an offence for the person—
- (a) to destroy or otherwise dispose of, conceal, block or (where relevant) falsify all or part of the information, document, equipment or material, or
- (b) to cause or permit the destruction, disposal, concealment, blocking or (where relevant) falsification of all or part of the information, document, equipment or material,
with the intention of preventing the Commissioner from viewing, or being provided with or directed to, all or part of the information, document, equipment or material.
- (3) It is a defence for a person charged with an offence under subsection (2) to prove that the destruction, disposal, concealment, blocking or falsification would have occurred in the absence of the person being given the notice.
### Enforcement notices
#### Enforcement notices
##### 149
- (1) Where the Commissioner is satisfied that a person has failed, or is failing, as described in subsection (2), (3), (4) or (5), the Commissioner may give the person a written notice (an “enforcement notice”) which requires the person—
- (a) to take steps specified in the notice, or
- (b) to refrain from taking steps specified in the notice,
or both (and see also sections 150 and 151).
- (2) The first type of failure is where a controller or processor has failed, or is failing, to comply with any of the following—
- (a) a provision of Chapter II of the UK GDPR or Chapter 2 of Part 3 or Chapter 2 of Part 4 of this Act (principles of processing);
- (b) a provision of Articles 12 to 22 of the UK GDPR or Part 3 or 4 of this Act conferring rights on a data subject;
- (c) a provision of Articles 25 to 39 of the UK GDPR or section 64 or 65 of this Act (obligations of controllers and processors);
- (d) a requirement to communicate a personal data breach to the Commissioner or a data subject under section 67, 68 or 108 of this Act;
- (e) the principles for transfers of personal data to third countries, non-Convention countries and international organisations in Articles 44 to 49 of the UK GDPR or in sections 73 to 78 or 109 of this Act.
- (3) The second type of failure is where a monitoring body has failed, or is failing, to comply with an obligation under Article 41 of the UK GDPR (monitoring of approved codes of conduct).
- (4) The third type of failure is where a person who is a certification provider—
- (a) does not meet the requirements for accreditation,
- (b) has failed, or is failing, to comply with an obligation under Article 42 or 43 of the UK GDPR (certification of controllers and processors), or
- (c) has failed, or is failing, to comply with any other provision of the UK GDPR (whether in the person's capacity as a certification provider or otherwise).
- (5) The fourth type of failure is where a controller has failed, or is failing, to comply with regulations under section 137.
- (6) An enforcement notice given in reliance on subsection (2), (3) or (5) may only impose requirements which the Commissioner considers appropriate for the purpose of remedying the failure.
- (7) An enforcement notice given in reliance on subsection (4) may only impose requirements which the Commissioner considers appropriate having regard to the failure (whether or not for the purpose of remedying the failure).
- (8) The Secretary of State may by regulations confer power on the Commissioner to give an enforcement notice in respect of other failures to comply with the data protection legislation.
- (9) Regulations under this section—
- (a) may make provision about the giving of an enforcement notice in respect of the failure, including by amending this section and sections 150 to 152,
- (b) may make provision about the giving of an information notice, an assessment notice or a penalty notice, or about powers of entry and inspection, in connection with the failure, including by amending sections 142, 143, 146, 147 and 155 to 157 and Schedules 15 and 16, and
- (c) are subject to the affirmative resolution procedure.
#### Enforcement notices: supplementary
##### 150
- (1) An enforcement notice must—
- (a) state what the person has failed or is failing to do, and
- (b) give the Commissioner's reasons for reaching that opinion.
- (2) In deciding whether to give an enforcement notice in reliance on section 149(2), the Commissioner must consider whether the failure has caused or is likely to cause any person damage or distress.
- (3) In relation to an enforcement notice given in reliance on section 149(2), the Commissioner's power under section 149(1)(b) to require a person to refrain from taking specified steps includes power—
- (a) to impose a ban relating to all processing of personal data, or
- (b) to impose a ban relating only to a specified description of processing of personal data, including by specifying one or more of the following—
- (i) a description of personal data;
- (ii) the purpose or manner of the processing;
- (iii) the time when the processing takes place.
- (4) An enforcement notice may specify the time or times at which, or period or periods within which, a requirement imposed by the notice must be complied with (but see the restrictions in subsections (6) to (8)).
- (5) An enforcement notice must provide information about—
- (a) the consequences of failure to comply with it, and
- (b) the rights under sections 162 and 164 (appeals etc).
- (6) An enforcement notice must not specify a time for compliance with a requirement in the notice which falls before the end of the period within which an appeal can be brought against the notice.
- (7) If an appeal is brought against an enforcement notice, a requirement in the notice need not be complied with pending the determination or withdrawal of the appeal.
- (8) If an enforcement notice—
- (a) states that, in the Commissioner's opinion, it is necessary for a requirement to be complied with urgently, and
- (b) gives the Commissioner's reasons for reaching that opinion,
subsections (6) and (7) do not apply but the notice must not require the requirement to be complied with before the end of the period of 24 hours beginning when the notice is given.
- (9) In this section, “*specified*” means specified in an enforcement notice.
#### Enforcement notices: rectification and erasure of personal data etc
##### 151
- (1) Subsections (2) and (3) apply where an enforcement notice is given in respect of a failure by a controller or processor—
- (a) to comply with a data protection principle relating to accuracy, or
- (b) to comply with a data subject's request to exercise rights under Article 16, 17 or 18 of the UK GDPR (right to rectification, erasure or restriction on processing) or section 46, 47 or 100 of this Act.
- (2) If the enforcement notice requires the controller or processor to rectify or erase inaccurate personal data, it may also require the controller or processor to rectify or erase any other data which—
- (a) is held by the controller or processor, and
- (b) contains an expression of opinion which appears to the Commissioner to be based on the inaccurate personal data.
- (3) Where a controller or processor has accurately recorded personal data provided by the data subject or a third party but the data is inaccurate, the enforcement notice may require the controller or processor—
- (a) to take steps specified in the notice to ensure the accuracy of the data,
- (b) if relevant, to secure that the data indicates the data subject's view that the data is inaccurate, and
- (c) to supplement the data with a statement of the true facts relating to the matters dealt with by the data that is approved by the Commissioner,
(as well as imposing requirements under subsection (2)).
- (4) When deciding what steps it is reasonable to specify under subsection (3)(a), the Commissioner must have regard to the purpose for which the data was obtained and further processed.
- (5) Subsections (6) and (7) apply where—
- (a) an enforcement notice requires a controller or processor to rectify or erase personal data, or
- (b) the Commissioner is satisfied that the processing of personal data which has been rectified or erased by the controller or processor involved a failure described in subsection (1).
- (6) An enforcement notice may, if reasonably practicable, require the controller or processor to notify third parties to whom the data has been disclosed of the rectification or erasure.
- (7) In determining whether it is reasonably practicable to require such notification, the Commissioner must have regard, in particular, to the number of people who would have to be notified.
- (8) In this section, “*data protection principle relating to accuracy*” means the principle in—
- (a) Article 5(1)(d) of the UK GDPR,
- (b) section 38(1) of this Act, or
- (c) section 89 of this Act.
#### Enforcement notices: restrictions
##### 152
- (1) The Commissioner may not give a controller or processor an enforcement notice in reliance on section 149(2) with respect to the processing of personal data for the special purposes unless—
- (a) a determination under section 174 with respect to the data or the processing has taken effect, and
- (b) a court has granted leave for the notice to be given.
- (2) A court must not grant leave for the purposes of subsection (1)(b) unless it is satisfied that—
- (a) the Commissioner has reason to suspect a failure described in section 149(2) which is of substantial public importance, and
- (b) the controller or processor has been given notice of the application for leave in accordance with rules of court or the case is urgent.
- (3) An enforcement notice does not require a person to do something to the extent that requiring the person to do it would involve an infringement of the privileges of either House of Parliament.
- (4) In the case of a joint controller in respect of the processing of personal data to which Part 3 or 4 applies whose responsibilities for compliance with that Part are determined in an arrangement under section 58 or 104, the Commissioner may only give the controller an enforcement notice in reliance on section 149(2) if the controller is responsible for compliance with the provision, requirement or principle in question.
#### Enforcement notices: cancellation and variation
##### 153
- (1) The Commissioner may cancel or vary an enforcement notice by giving written notice to the person to whom it was given.
- (2) A person to whom an enforcement notice is given may apply in writing to the Commissioner for the cancellation or variation of the notice.
- (3) An application under subsection (2) may be made only—
- (a) after the end of the period within which an appeal can be brought against the notice, and
- (b) on the ground that, by reason of a change of circumstances, one or more of the provisions of that notice need not be complied with in order to remedy the failure identified in the notice.
### Powers of entry and inspection
#### Powers of entry and inspection
##### 154
Schedule 15 makes provision about powers of entry and inspection.
### Penalties
#### Penalty notices
##### 155
- (1) If the Commissioner is satisfied that a person—
- (a) has failed or is failing as described in section 149(2), (3), (4) or (5), or
- (b) has failed to comply with an information notice, an assessment notice or an enforcement notice,
the Commissioner may, by written notice (a “penalty notice”), require the person to pay to the Commissioner an amount in sterling specified in the notice.
- (2) Subject to subsection (4), when deciding whether to give a penalty notice to a person and determining the amount of the penalty, the Commissioner must have regard to the following, so far as relevant—
- (a) to the extent that the notice concerns a matter to which the UK GDPR applies, the matters listed in Article 83(1) and (2) of the UK GDPR;
- (b) to the extent that the notice concerns another matter, the matters listed in subsection (3).
- (3) Those matters are—
- (a) the nature, gravity and duration of the failure;
- (b) the intentional or negligent character of the failure;
- (c) any action taken by the controller or processor to mitigate the damage or distress suffered by data subjects;
- (d) the degree of responsibility of the controller or processor, taking into account technical and organisational measures implemented by the controller or processor in accordance with section 57, 66, 103 or 107;
- (e) any relevant previous failures by the controller or processor;
- (f) the degree of co-operation with the Commissioner, in order to remedy the failure and mitigate the possible adverse effects of the failure;
- (g) the categories of personal data affected by the failure;
- (h) the manner in which the infringement became known to the Commissioner, including whether, and if so to what extent, the controller or processor notified the Commissioner of the failure;
- (i) the extent to which the controller or processor has complied with previous enforcement notices or penalty notices;
- (j) adherence to approved codes of conduct or certification mechanisms;
- (k) any other aggravating or mitigating factor applicable to the case, including financial benefits gained, or losses avoided, as a result of the failure (whether directly or indirectly);
- (l) whether the penalty would be effective, proportionate and dissuasive.
- (4) Subsections (2) and (3) do not apply in the case of a decision or determination relating to a failure described in section 149(5).
- (5) Schedule 16 makes further provision about penalty notices, including provision requiring the Commissioner to give a notice of intent to impose a penalty and provision about payment, variation, cancellation and enforcement.
- (6) The Secretary of State may by regulations—
- (a) confer power on the Commissioner to give a penalty notice in respect of other failures to comply with the data protection legislation, and
- (b) provide for the maximum penalty that may be imposed in relation to such failures to be either the standard maximum amount or the higher maximum amount.
- (7) Regulations under this section—
- (a) may make provision about the giving of penalty notices in respect of the failure,
- (b) may amend this section and sections 156 to 158, and
- (c) are subject to the affirmative resolution procedure.
- (8) In this section, “*higher maximum amount*” and “*standard maximum amount*” have the same meaning as in section 157.
#### Penalty notices: restrictions
##### 156
- (1) The Commissioner may not give a controller or processor a penalty notice in reliance on section 149(2) with respect to the processing of personal data for the special purposes unless—
- (a) a determination under section 174 with respect to the data or the processing has taken effect, and
- (b) a court has granted leave for the notice to be given.
- (2) A court must not grant leave for the purposes of subsection (1)(b) unless it is satisfied that—
- (a) the Commissioner has reason to suspect a failure described in section 149(2) which is of substantial public importance, and
- (b) the controller or processor has been given notice of the application for leave in accordance with rules of court or the case is urgent.
- (3) The Commissioner may not give a controller or processor a penalty notice with respect to the processing of personal data where the purposes and manner of the processing are determined by or on behalf of either House of Parliament.
- (4) The Commissioner may not give a penalty notice to—
- (a) the Crown Estate Commissioners, or
- (b) a person who is a controller by virtue of section 209(4) (controller for the Royal Household etc).
- (5) In the case of a joint controller in respect of the processing of personal data to which Part 3 or 4 applies whose responsibilities for compliance with that Part are determined in an arrangement under section 58 or 104, the Commissioner may only give the controller a penalty notice in reliance on section 149(2) if the controller is responsible for compliance with the provision, requirement or principle in question.
#### Maximum amount of penalty
##### 157
- (1) In relation to an infringement of a provision of the UK GDPR, the maximum amount of the penalty that may be imposed by a penalty notice is—
- (a) the amount specified in Article 83 of the UK GDPR, or
- (b) if an amount is not specified there, the standard maximum amount.
- (2) In relation to an infringement of a provision of Part 3 of this Act, the maximum amount of the penalty that may be imposed by a penalty notice is—
- (a) in relation to a failure to comply with section 35, 36, 37, 38(1), 39(1), 40, 44, 45, 46, 47, 48, 49, 52, 53, 73, ... 75, 76, 77 or 78, the higher maximum amount, and
- (b) otherwise, the standard maximum amount.
- (3) In relation to an infringement of a provision of Part 4 of this Act, the maximum amount of the penalty that may be imposed by a penalty notice is—
- (a) in relation to a failure to comply with section 86, 87, 88, 89, 90, 91, 93, 94, 100 or 109, the higher maximum amount, and
- (b) otherwise, the standard maximum amount.
- (4) In relation to a failure to comply with an information notice, an assessment notice or an enforcement notice, the maximum amount of the penalty that may be imposed by a penalty notice is the higher maximum amount.
- (5) The “higher maximum amount” is—
- (a) in the case of an undertaking, £17,500,000 or 4% of the undertaking's total annual worldwide turnover in the preceding financial year, whichever is higher, or
- (b) in any other case, £17,500,000.
- (6) The “standard maximum amount” is—
- (a) in the case of an undertaking, £8,700,000 or 2% of the undertaking's total annual worldwide turnover in the preceding financial year, whichever is higher, or
- (b) in any other case, £8,700,000.
- (7) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### Fixed penalties for non-compliance with charges regulations
##### 158
- (1) The Commissioner must produce and publish a document specifying the amount of the penalty for a failure to comply with regulations made under section 137.
- (2) The Commissioner may specify different amounts for different types of failure.
- (3) The maximum amount that may be specified is 150% of the highest charge payable by a controller in respect of a financial year in accordance with the regulations, disregarding any discount available under the regulations.
- (4) The Commissioner—
- (a) may alter or replace the document, and
- (b) must publish any altered or replacement document.
- (5) Before publishing a document under this section (including any altered or replacement document), the Commissioner must consult—
- (a) the Secretary of State, and
- (b) such other persons as the Commissioner considers appropriate.
- (6) The Commissioner must arrange for a document published under this section (including any altered or replacement document) to be laid before Parliament.
#### Amount of penalties: supplementary
##### 159
- (1) For the purposes of Article 83 of the UK GDPR and section 157, the Secretary of State may by regulations—
- (a) provide that a person of a description specified in the regulations is or is not an undertaking, and
- (b) make provision about how an undertaking's turnover is to be determined.
- (2) For the purposes of Article 83 of the UK GDPR, section 157 and section 158, the Secretary of State may by regulations provide that a period is or is not a financial year.
- (3) Regulations under this section are subject to the affirmative resolution procedure.
### Guidance
#### Guidance about regulatory action
##### 160
- (1) The Commissioner must produce and publish guidance about how the Commissioner proposes to exercise the Commissioner's functions in connection with—
- (a) information notices,
- (b) assessment notices,
- (c) enforcement notices, and
- (d) penalty notices.
- (2) The Commissioner may produce and publish guidance about how the Commissioner proposes to exercise the Commissioner's other functions under this Part.
- (3) In relation to information notices, the guidance must include—
- (a) provision specifying factors to be considered in determining the time at which, or the period within which, information is to be required to be provided;
- (b) provision about the circumstances in which the Commissioner would consider it appropriate to give an information notice to a person in reliance on section 142(7) (urgent cases);
- (c) provision about how the Commissioner will determine how to proceed if a person does not comply with an information notice.
- (4) In relation to assessment notices, the guidance must include—
- (a) provision specifying factors to be considered in determining whether to give an assessment notice to a person;
- (b) provision about the circumstances in which the Commissioner would consider it appropriate to give an assessment notice in reliance on section 146(8) or (9) (urgent cases);
- (c) provision specifying descriptions of documents or information that—
- (i) are not to be examined or inspected in accordance with an assessment notice, or
- (ii) are to be so examined or inspected only by a person of a description specified in the guidance;
- (d) provision about the nature of inspections and examinations carried out in accordance with an assessment notice;
- (e) provision about the nature of interviews carried out in accordance with an assessment notice;
- (f) provision about the preparation, issuing and publication by the Commissioner of assessment reports in respect of controllers and processors that have been given assessment notices;
- (g) provision about how the Commissioner will determine how to proceed if a person does not comply with an assessment notice.
- (5) The guidance produced in accordance with subsection (4)(c) must include provisions that relate to—
- (a) documents and information concerning an individual's physical or mental health;
- (b) documents and information concerning the provision of social care for an individual.
- (6) In relation to enforcement notices, the guidance must include—
- (a) provision specifying factors to be considered in determining whether to give an enforcement notice to a person;
- (b) provision about the circumstances in which the Commissioner would consider it appropriate to give an enforcement notice to a person in reliance on section 150(8) (urgent cases);
- (c) provision about how the Commissioner will determine how to proceed if a person does not comply with an enforcement notice.
- (7) In relation to penalty notices, the guidance must include—
- (a) provision about the circumstances in which the Commissioner would consider it appropriate to issue a penalty notice;
- (b) provision about the circumstances in which the Commissioner would consider it appropriate to allow a person to make oral representations about the Commissioner's intention to give the person a penalty notice;
- (c) provision explaining how the Commissioner will determine the amount of penalties;
- (d) provision about how the Commissioner will determine how to proceed if a person does not comply with a penalty notice.
- (8) The Commissioner—
- (a) may alter or replace guidance produced under this section, and
- (b) must publish any altered or replacement guidance.
- (9) Before producing guidance under this section (including any altered or replacement guidance), the Commissioner must consult—
- (a) the Secretary of State, and
- (b) such other persons as the Commissioner considers appropriate.
- (10) Section 161 applies in relation to the first guidance under subsection (1).
- (11) The Commissioner must arrange for other guidance under this section (including any altered or replacement guidance) to be laid before Parliament.
- (12) In this section, “*social care*” has the same meaning as in Part 1 of the Health and Social Care Act 2008 (see section 9(3) of that Act).
#### Approval of first guidance about regulatory action
##### 161
- (1) When the first guidance is produced under section 160(1)—
- (a) the Commissioner must submit the final version to the Secretary of State, and
- (b) the Secretary of State must lay the guidance before Parliament.
- (2) If, within the 40-day period, either House of Parliament resolves not to approve the guidance—
- (a) the Commissioner must not issue the guidance, and
- (b) the Commissioner must produce another version of the guidance (and this section applies to that version).
- (3) If, within the 40-day period, no such resolution is made—
- (a) the Commissioner must issue the guidance, and
- (b) the guidance comes into force at the end of the period of 21 days beginning with the day on which it is issued.
- (4) Nothing in subsection (2)(a) prevents another version of the guidance being laid before Parliament.
- (5) In this section, “*the 40-day period*” means—
- (a) if the guidance is laid before both Houses of Parliament on the same day, the period of 40 days beginning with that day, or
- (b) if the guidance is laid before the Houses of Parliament on different days, the period of 40 days beginning with the later of those days.
- (6) In calculating the 40-day period, no account is to be taken of any period during which Parliament is dissolved or prorogued or during which both Houses of Parliament are adjourned for more than 4 days.
### Appeals etc
#### Rights of appeal
##### 162
- (1) A person who is given any of the following notices may appeal to the Tribunal—
- (a) an information notice;
- (b) an assessment notice;
- (c) an enforcement notice;
- (d) a penalty notice;
- (e) a penalty variation notice.
- (2) A person who is given an enforcement notice may appeal to the Tribunal against the refusal of an application under section 153 for the cancellation or variation of the notice.
- (3) A person who is given a penalty notice or a penalty variation notice may appeal to the Tribunal against the amount of the penalty specified in the notice, whether or not the person appeals against the notice.
- (4) Where a determination is made under section 174 in respect of the processing of personal data, the controller or processor may appeal to the Tribunal against the determination.
#### Determination of appeals
##### 163
- (1) Subsections (2) to (4) apply where a person appeals to the Tribunal under section 162(1) or (3).
- (2) The Tribunal may review any determination of fact on which the notice or decision against which the appeal is brought was based.
- (3) If the Tribunal considers—
- (a) that the notice or decision against which the appeal is brought is not in accordance with the law, or
- (b) to the extent that the notice or decision involved an exercise of discretion by the Commissioner, that the Commissioner ought to have exercised the discretion differently,
the Tribunal must allow the appeal or substitute another notice or decision which the Commissioner could have given or made.
- (4) Otherwise, the Tribunal must dismiss the appeal.
- (5) On an appeal under section 162(2), if the Tribunal considers that the enforcement notice ought to be cancelled or varied by reason of a change in circumstances, the Tribunal must cancel or vary the notice.
- (6) On an appeal under section 162(4), the Tribunal may cancel the Commissioner's determination.
#### Applications in respect of urgent notices
##### 164
- (1) This section applies where an information notice, an assessment notice or an enforcement notice given to a person contains an urgency statement.
- (2) The person may apply to the court for either or both of the following—
- (a) the disapplication of the urgency statement in relation to some or all of the requirements of the notice;
- (b) a change to the time at which, or the period within which, a requirement of the notice must be complied with.
- (3) On an application under subsection (2), the court may do any of the following—
- (a) direct that the notice is to have effect as if it did not contain the urgency statement;
- (b) direct that the inclusion of the urgency statement is not to have effect in relation to a requirement of the notice;
- (c) vary the notice by changing the time at which, or the period within which, a requirement of the notice must be complied with;
- (d) vary the notice by making other changes required to give effect to a direction under paragraph (a) or (b) or in consequence of a variation under paragraph (c).
- (4) The decision of the court on an application under this section is final.
- (5) In this section, “*urgency statement*” means—
- (a) in relation to an information notice, a statement under section 142(7)(a),
- (b) in relation to an assessment notice, a statement under section 146(8)(a) or (9)(d), and
- (c) in relation to an enforcement notice, a statement under section 150(8)(a).
### Complaints
#### Complaints by data subjects
##### 165
- (1) Articles 57(1)(f) and (2) and 77 of the UK GDPR (data subject's right to lodge a complaint) confer rights on data subjects to complain to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of the UK GDPR.
- (2) A data subject may make a complaint to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of Part 3 or 4 of this Act.
- (3) The Commissioner must facilitate the making of complaints under subsection (2) by taking steps such as providing a complaint form which can be completed electronically and by other means.
- (4) If the Commissioner receives a complaint under subsection (2), the Commissioner must—
- (a) take appropriate steps to respond to the complaint,
- (b) inform the complainant of the outcome of the complaint,
- (c) inform the complainant of the rights under section 166, and
- (d) if asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint.
- (5) The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes—
- (a) investigating the subject matter of the complaint, to the extent appropriate, and
- (b) informing the complainant about progress on the complaint, including about whether further investigation or co-ordination with a foreign designated authority is necessary.
- (6) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (7) In this section—
- “*foreign designated authority*” means an authority designated for the purposes of Article 13 of the Data Protection Convention by a party, other than the United Kingdom, which is bound by that Convention;
- ...
#### Orders to progress complaints
##### 166
- (1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the UK GDPR, the Commissioner—
- (a) fails to take appropriate steps to respond to the complaint,
- (b) fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or
- (c) if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.
- (2) The Tribunal may, on an application by the data subject, make an order requiring the Commissioner—
- (a) to take appropriate steps to respond to the complaint, or
- (b) to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.
- (3) An order under subsection (2)(a) may require the Commissioner—
- (a) to take steps specified in the order;
- (b) to conclude an investigation, or take a specified step, within a period specified in the order.
- (4) Section 165(5) applies for the purposes of subsections (1)(a) and (2)(a) as it applies for the purposes of section 165(4)(a).
### Remedies in the court
#### Compliance orders
##### 167
- (1) This section applies if, on an application by a data subject, a court is satisfied that there has been an infringement of the data subject's rights under the data protection legislation in contravention of that legislation.
- (2) A court may make an order for the purposes of securing compliance with the data protection legislation which requires the controller in respect of the processing, or a processor acting on behalf of that controller—
- (a) to take steps specified in the order, or
- (b) to refrain from taking steps specified in the order.
- (3) The order may, in relation to each step, specify the time at which, or the period within which, it must be taken.
- (4) In subsection (1)—
- (a) the reference to an application by a data subject includes an application made in exercise of the right under Article 79(1) of the UK GDPR (right to an effective remedy against a controller or processor);
- (b) the reference to the data protection legislation does not include Part 4 of this Act or regulations made under that Part.
- (5) In relation to a joint controller in respect of the processing of personal data to which Part 3 applies whose responsibilities are determined in an arrangement under section 58, a court may only make an order under this section if the controller is responsible for compliance with the provision of the data protection legislation that is contravened.
#### Compensation for contravention of the GDPR
##### 168
- (1) In Article 82 of the UK GDPR (right to compensation for material or non-material damage), “*non-material damage*” includes distress.
- (2) Subsection (3) applies where—
- (a) in accordance with rules of court, proceedings under Article 82 of the UK GDPR are brought by a representative body on behalf of a person, and
- (b) a court orders the payment of compensation.
- (3) The court may make an order providing for the compensation to be paid on behalf of the person to—
- (a) the representative body, or
- (b) such other person as the court thinks fit.
#### Compensation for contravention of other data protection legislation
##### 169
- (1) A person who suffers damage by reason of a contravention of a requirement of the data protection legislation, other than the UK GDPR, is entitled to compensation for that damage from the controller or the processor, subject to subsections (2) and (3).
- (2) Under subsection (1)—
- (a) a controller involved in processing of personal data is liable for any damage caused by the processing, and
- (b) a processor involved in processing of personal data is liable for damage caused by the processing only if the processor—
- (i) has not complied with an obligation under the data protection legislation specifically directed at processors, or
- (ii) has acted outside, or contrary to, the controller's lawful instructions.
- (3) A controller or processor is not liable as described in subsection (2) if the controller or processor proves that the controller or processor is not in any way responsible for the event giving rise to the damage.
- (4) A joint controller in respect of the processing of personal data to which Part 3 or 4 applies whose responsibilities are determined in an arrangement under section 58 or 104 is only liable as described in subsection (2) if the controller is responsible for compliance with the provision of the data protection legislation that is contravened.
- (5) In this section, “*damage*” includes financial loss and damage not involving financial loss, such as distress.
### Offences relating to personal data
#### Unlawful obtaining etc of personal data
##### 170
- (1) It is an offence for a person knowingly or recklessly—
- (a) to obtain or disclose personal data without the consent of the controller,
- (b) to procure the disclosure of personal data to another person without the consent of the controller, or
- (c) after obtaining personal data, to retain it without the consent of the person who was the controller in relation to the personal data when it was obtained.
- (2) It is a defence for a person charged with an offence under subsection (1) to prove that the obtaining, disclosing, procuring or retaining—
- (a) was necessary for the purposes of preventing or detecting crime,
- (b) was required or authorised by an enactment, by a rule of law or by the order of a court or tribunal, or
- (c) in the particular circumstances, was justified as being in the public interest.
- (3) It is also a defence for a person charged with an offence under subsection (1) to prove that—
- (a) the person acted in the reasonable belief that the person had a legal right to do the obtaining, disclosing, procuring or retaining,
- (b) the person acted in the reasonable belief that the person would have had the consent of the controller if the controller had known about the obtaining, disclosing, procuring or retaining and the circumstances of it, or
- (c) the person acted—
- (i) for the special purposes,
- (ii) with a view to the publication by a person of any journalistic, academic, artistic or literary material, and
- (iii) in the reasonable belief that in the particular circumstances the obtaining, disclosing, procuring or retaining was justified as being in the public interest.
- (4) It is an offence for a person to sell personal data if the person obtained the data in circumstances in which an offence under subsection (1) was committed.
- (5) It is an offence for a person to offer to sell personal data if the person—
- (a) has obtained the data in circumstances in which an offence under subsection (1) was committed, or
- (b) subsequently obtains the data in such circumstances.
- (6) For the purposes of subsection (5), an advertisement indicating that personal data is or may be for sale is an offer to sell the data.
- (7) In this section—
- (a) references to the consent of a controller do not include the consent of a person who is a controller by virtue of Article 28(10) of the UK GDPR or section 59(8) or 105(3) of this Act (processor to be treated as controller in certain circumstances);
- (b) where there is more than one controller, such references are references to the consent of one or more of them.
#### Re-identification of de-identified personal data
##### 171
- (1) It is an offence for a person knowingly or recklessly to re-identify information that is de-identified personal data without the consent of the controller responsible for de-identifying the personal data.
- (2) For the purposes of this section and section 172—
- (a) personal data is “de-identified” if it has been processed in such a manner that it can no longer be attributed, without more, to a specific data subject;
- (b) a person “re-identifies” information if the person takes steps which result in the information no longer being de-identified within the meaning of paragraph (a).
- (3) It is a defence for a person charged with an offence under subsection (1) to prove that the re-identification—
- (a) was necessary for the purposes of preventing or detecting crime,
- (b) was required or authorised by an enactment, by a rule of law or by the order of a court or tribunal, or
- (c) in the particular circumstances, was justified as being in the public interest.
- (4) It is also a defence for a person charged with an offence under subsection (1) to prove that—
- (a) the person acted in the reasonable belief that the person—
- (i) is the data subject to whom the information relates,
- (ii) had the consent of that data subject, or
- (iii) would have had such consent if the data subject had known about the re-identification and the circumstances of it,
- (b) the person acted in the reasonable belief that the person—
- (i) is the controller responsible for de-identifying the personal data,
- (ii) had the consent of that controller, or
- (iii) would have had such consent if that controller had known about the re-identification and the circumstances of it,
- (c) the person acted—
- (i) for the special purposes,
- (ii) with a view to the publication by a person of any journalistic, academic, artistic or literary material, and
- (iii) in the reasonable belief that in the particular circumstances the re-identification was justified as being in the public interest, or
- (d) the effectiveness testing conditions were met (see section 172).
- (5) It is an offence for a person knowingly or recklessly to process personal data that is information that has been re-identified where the person does so—
- (a) without the consent of the controller responsible for de-identifying the personal data, and
- (b) in circumstances in which the re-identification was an offence under subsection (1).
- (6) It is a defence for a person charged with an offence under subsection (5) to prove that the processing—
- (a) was necessary for the purposes of preventing or detecting crime,
- (b) was required or authorised by an enactment, by a rule of law or by the order of a court or tribunal, or
- (c) in the particular circumstances, was justified as being in the public interest.
- (7) It is also a defence for a person charged with an offence under subsection (5) to prove that—
- (a) the person acted in the reasonable belief that the processing was lawful,
- (b) the person acted in the reasonable belief that the person—
- (i) had the consent of the controller responsible for de-identifying the personal data, or
- (ii) would have had such consent if that controller had known about the processing and the circumstances of it, or
- (c) the person acted—
- (i) for the special purposes,
- (ii) with a view to the publication by a person of any journalistic, academic, artistic or literary material, and
- (iii) in the reasonable belief that in the particular circumstances the processing was justified as being in the public interest.
- (8) In this section—
- (a) references to the consent of a controller do not include the consent of a person who is a controller by virtue of Article 28(10) of the UK GDPR or section 59(8) or 105(3) of this Act (processor to be treated as controller in certain circumstances);
- (b) where there is more than one controller, such references are references to the consent of one or more of them.
#### Re-identification: effectiveness testing conditions
##### 172
- (1) For the purposes of section 171, in relation to a person who re-identifies information that is de-identified personal data, “*the effectiveness testing conditions*” means the conditions in subsections (2) and (3).
- (2) The first condition is that the person acted—
- (a) with a view to testing the effectiveness of the de-identification of personal data,
- (b) without intending to cause, or threaten to cause, damage or distress to a person, and
- (c) in the reasonable belief that, in the particular circumstances, re-identifying the information was justified as being in the public interest.
- (3) The second condition is that the person notified the Commissioner or the controller responsible for de-identifying the personal data about the re-identification—
- (a) without undue delay, and
- (b) where feasible, not later than 72 hours after becoming aware of it.
- (4) Where there is more than one controller responsible for de-identifying personal data, the requirement in subsection (3) is satisfied if one or more of them is notified.
#### Alteration etc of personal data to prevent disclosure to data subject
##### 173
- (1) Subsection (3) applies where—
- (a) a request has been made in exercise of a data subject access right, and
- (b) the person making the request would have been entitled to receive information in response to that request.
- (2) In this section, “*data subject access right*” means a right under—
- (a) Article 15 of the UK GDPR (right of access by the data subject);
- (b) Article 20 of the UK GDPR (right to data portability);
- (c) section 45 of this Act (law enforcement processing: right of access by the data subject);
- (d) section 94 of this Act (intelligence services processing: right of access by the data subject).
- (3) It is an offence for a person listed in subsection (4) to alter, deface, block, erase, destroy or conceal information with the intention of preventing disclosure of all or part of the information that the person making the request would have been entitled to receive.
- (4) Those persons are—
- (a) the controller, and
- (b) a person who is employed by the controller, an officer of the controller or subject to the direction of the controller.
- (5) It is a defence for a person charged with an offence under subsection (3) to prove that—
- (a) the alteration, defacing, blocking, erasure, destruction or concealment of the information would have occurred in the absence of a request made in exercise of a data subject access right, or
- (b) the person acted in the reasonable belief that the person making the request was not entitled to receive the information in response to the request.
### The special purposes
#### The special purposes
##### 174
- (1) In this Part, “*the special purposes*” means one or more of the following—
- (a) the purposes of journalism;
- (b) academic purposes;
- (c) artistic purposes;
- (d) literary purposes.
- (2) In this Part, “*special purposes proceedings*” means legal proceedings against a controller or processor which relate, wholly or partly, to personal data processed for the special purposes and which are—
- (a) proceedings under section 167 (including proceedings on an application under Article 79 of the UK GDPR), or
- (b) proceedings under Article 82 of the UK GDPR or section 169.
- (3) The Commissioner may make a written determination, in relation to the processing of personal data, that—
- (a) the personal data is not being processed only for the special purposes;
- (b) the personal data is not being processed with a view to the publication by a person of journalistic, academic, artistic or literary material which has not previously been published by the controller.
- (4) The Commissioner must give written notice of the determination to the controller and the processor.
- (5) The notice must provide information about the rights of appeal under section 162.
- (6) The determination does not take effect until one of the following conditions is satisfied—
- (a) the period for the controller or the processor to appeal against the determination has ended without an appeal having been brought, or
- (b) an appeal has been brought against the determination and—
- (i) the appeal and any further appeal in relation to the determination has been decided or has otherwise ended, and
- (ii) the time for appealing against the result of the appeal or further appeal has ended without another appeal having been brought.
#### Provision of assistance in special purposes proceedings
##### 175
- (1) An individual who is a party, or prospective party, to special purposes proceedings may apply to the Commissioner for assistance in those proceedings.
- (2) As soon as reasonably practicable after receiving an application under subsection (1), the Commissioner must decide whether, and to what extent, to grant it.
- (3) The Commissioner must not grant the application unless, in the Commissioner's opinion, the case involves a matter of substantial public importance.
- (4) If the Commissioner decides not to provide assistance, the Commissioner must, as soon as reasonably practicable, notify the applicant of the decision, giving reasons for the decision.
- (5) If the Commissioner decides to provide assistance, the Commissioner must—
- (a) as soon as reasonably practicable, notify the applicant of the decision, stating the extent of the assistance to be provided, and
- (b) secure that the person against whom the proceedings are, or are to be, brought is informed that the Commissioner is providing assistance.
- (6) The assistance that may be provided by the Commissioner includes—
- (a) paying costs in connection with the proceedings, and
- (b) indemnifying the applicant in respect of liability to pay costs, expenses or damages in connection with the proceedings.
- (7) In England and Wales or Northern Ireland, the recovery of expenses incurred by the Commissioner in providing an applicant with assistance under this section (as taxed or assessed in accordance with rules of court) is to constitute a first charge for the benefit of the Commissioner—
- (a) on any costs which, by virtue of any judgment or order of the court, are payable to the applicant by any other person in respect of the matter in connection with which the assistance is provided, and
- (b) on any sum payable to the applicant under a compromise or settlement arrived at in connection with that matter to avoid, or bring to an end, any proceedings.
- (8) In Scotland, the recovery of such expenses (as taxed or assessed in accordance with rules of court) is to be paid to the Commissioner, in priority to other debts—
- (a) out of any expenses which, by virtue of any judgment or order of the court, are payable to the applicant by any other person in respect of the matter in connection with which the assistance is provided, and
- (b) out of any sum payable to the applicant under a compromise or settlement arrived at in connection with that matter to avoid, or bring to an end, any proceedings.
#### Staying special purposes proceedings
##### 176
- (1) In any special purposes proceedings before a court, if the controller or processor claims, or it appears to the court, that any personal data to which the proceedings relate—
- (a) is being processed only for the special purposes,
- (b) is being processed with a view to the publication by any person of journalistic, academic, artistic or literary material, and
- (c) has not previously been published by the controller,
the court must stay or, in Scotland, sist the proceedings.
- (2) In considering, for the purposes of subsection (1)(c), whether material has previously been published, publication in the immediately preceding 24 hours is to be ignored.
- (3) Under subsection (1), the court must stay or sist the proceedings until either of the following conditions is met—
- (a) a determination of the Commissioner under section 174 with respect to the personal data or the processing takes effect;
- (b) where the proceedings were stayed or sisted on the making of a claim, the claim is withdrawn.
#### Guidance about how to seek redress against media organisations
##### 177
- (1) The Commissioner must produce and publish guidance about the steps that may be taken where an individual considers that a media organisation is failing or has failed to comply with the data protection legislation.
- (2) In this section, “*media organisation*” means a body or other organisation whose activities consist of or include journalism.
- (3) The guidance must include provision about relevant complaints procedures, including—
- (a) who runs them,
- (b) what can be complained about, and
- (c) how to make a complaint.
- (4) For the purposes of subsection (3), relevant complaints procedures include procedures for making complaints to the Commissioner, the Office of Communications, the British Broadcasting Corporation and other persons who produce or enforce codes of practice for media organisations.
- (5) The guidance must also include provision about—
- (a) the powers available to the Commissioner in relation to a failure to comply with the data protection legislation,
- (b) when a claim in respect of such a failure may be made before a court and how to make such a claim,
- (c) alternative dispute resolution procedures,
- (d) the rights of bodies and other organisations to make complaints and claims on behalf of data subjects, and
- (e) the Commissioner's power to provide assistance in special purpose proceedings.
- (6) The Commissioner—
- (a) may alter or replace the guidance, and
- (b) must publish any altered or replacement guidance.
- (7) The Commissioner must produce and publish the first guidance under this section before the end of the period of 1 year beginning when this Act is passed.
#### Review of processing of personal data for the purposes of journalism
##### 178
- (1) The Commissioner must—
- (a) review the extent to which, during each review period, the processing of personal data for the purposes of journalism complied with—
- (i) the data protection legislation, and
- (ii) good practice in the processing of personal data for the purposes of journalism,
- (b) prepare a report of the review, and
- (c) submit the report to the Secretary of State.
- (2) In this section—
- “*good practice in the processing of personal data for the purposes of journalism*” has the same meaning as in section 124;
- “*review period*” means—the period of 4 years beginning with the day on which Chapter 2 of Part 2 of this Act comes into force, andeach subsequent period of 5 years beginning with the day after the day on which the previous review period ended.
- (3) The Commissioner must start a review under this section, in respect of a review period, within the period of 6 months beginning when the review period ends.
- (4) The Commissioner must submit the report of a review under this section to the Secretary of State—
- (a) in the case of the first review, before the end of the period of 18 months beginning when the Commissioner started the review, and
- (b) in the case of each subsequent review, before the end of the period of 12 months beginning when the Commissioner started the review.
- (5) The report must include consideration of the extent of compliance (as described in subsection (1)(a)) in each part of the United Kingdom.
- (6) The Secretary of State must—
- (a) lay the report before Parliament, and
- (b) send a copy of the report to—
- (i) the Scottish Ministers,
- (ii) the Welsh Ministers, and
- (iii) the Executive Office in Northern Ireland.
- (7) Schedule 17 makes further provision for the purposes of a review under this section.
#### Effectiveness of the media’s dispute resolution procedures
##### 179
- (1) The Secretary of State must, before the end of each review period, lay before Parliament a report produced by the Secretary of State or an appropriate person on—
- (a) the use of relevant alternative dispute resolution procedures, during that period, in cases involving a failure, or alleged failure, by a relevant media organisation to comply with the data protection legislation, and
- (b) the effectiveness of those procedures in such cases.
- (2) In this section—
- “*appropriate person*” means a person who the Secretary of State considers has appropriate experience and skills to produce a report described in subsection (1);
- “*relevant alternative dispute resolution procedures*” means alternative dispute resolution procedures provided by persons who produce or enforce codes of practice for relevant media organisations;
- “*relevant media organisation*” means a body or other organisation whose activities consist of or include journalism, other than a broadcaster;
- “*review period*” means—the period of 3 years beginning when this Act is passed, andeach subsequent period of 3 years.
- (3) The Secretary of State must send a copy of the report to—
- (a) the Scottish Ministers,
- (b) the Welsh Ministers, and
- (c) the Executive Office in Northern Ireland.
### Jurisdiction of courts
#### Jurisdiction
##### 180
- (1) The jurisdiction conferred on a court by the provisions listed in subsection (2) is exercisable—
- (a) in England and Wales, by the High Court or the county court,
- (b) in Northern Ireland, by the High Court or a county court, and
- (c) in Scotland, by the Court of Session or the sheriff,
subject to subsections (3) and (4).
- (2) Those provisions are—
- (a) in Chapter II of the applied GDPR (principles)—
- (i) Article 5(1)(a) to (c), (e) and (f) (principles relating to processing, other than the accuracy principle),
- (ii) Article 6 (lawfulness),
- (iii) Article 7 (conditions for consent),
- (iv) Article 8(1) and (2) (child's consent),
- (v) Article 9 (processing of special categories of personal data),
- (vi) Article 10 (data relating to criminal convictions etc), and
- (vii) Article 11(2) (processing not requiring identification);
- (b) in Chapter III of the applied GDPR (rights of the data subject)—
- (i) Article 13(1) to (3) (personal data collected from data subject: information to be provided),
- (ii) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided),
- (iii) Article 20 (right to data portability), and
- (iv) Article 21(1) (objections to processing);
- (c) in Chapter V of the applied GDPR, Articles 44 to 49 (transfers of personal data to third countries or international organisations);
- (d) sections 170 and 171 of this Act;
(see also paragraph 1(2) of Schedule 18).
- (3) In addition, the provisions of the applied GDPR listed in subsection (4) do not apply to personal data to which this Chapter applies by virtue of section 21(2) where the personal data relates to appointments, removals, pay, discipline, superannuation or other personnel matters in relation to—
- (a) service in any of the armed forces of the Crown;
- (b) service in any office or employment under the Crown or under any public authority;
- (c) service in any office or employment, or under any contract for services, in respect of which power to take action, or to determine or approve the action taken, in such matters is vested in—
- (i) Her Majesty,
- (ii) a Minister of the Crown,
- (iii) the National Assembly for Wales,
- (iv) the Welsh Ministers,
- (v) a Northern Ireland Minister (within the meaning of the Freedom of Information Act 2000), or
- (vi) an FOI public authority.
- (4) Those provisions are—
- (a) the remaining provisions of Chapters II and III (principles and rights of the data subject);
- (b) Chapter IV (controller and processor);
- (c) Chapter IX (specific processing situations).
- (5) A controller is not obliged to comply with Article 15(1) to (3) of the applied GDPR (right of access by the data subject) in relation to personal data to which this Chapter applies by virtue of section 21(2) if—
- (a) the request under that Article does not contain a description of the personal data, or
- (b) the controller estimates that the cost of complying with the request so far as relating to the personal data would exceed the appropriate maximum.
- (6) Subsection (5)(b) does not remove the controller's obligation to confirm whether or not personal data concerning the data subject is being processed unless the estimated cost of complying with that obligation alone in relation to the personal data would exceed the appropriate maximum.
- (7) An estimate for the purposes of this section must be made in accordance with regulations under section 12(5) of the Freedom of Information Act 2000.
- (8) In subsections (5) and (6), “*the appropriate maximum*” means the maximum amount specified by the Secretary of State by regulations.
- (9) Regulations under subsection (8) are subject to the negative resolution procedure.
#### Manual unstructured data used in longstanding historical research
##### 25
- (1) The provisions of the applied GDPR listed in subsection (2) do not apply to personal data to which this Chapter applies by virtue of section 21(2) (manual unstructured personal data held by FOI public authorities) at any time when—
- (a) the personal data—
- (i) is subject to processing which was already underway immediately before 24 October 1998, and
- (ii) is processed only for the purposes of historical research, and
- (b) the processing is not carried out—
- (i) for the purposes of measures or decisions with respect to a particular data subject, or
- (ii) in a way that causes, or is likely to cause, substantial damage or substantial distress to a data subject.
- (2) Those provisions are—
- (a) in Chapter II of the applied GDPR (principles), Article 5(1)(d) (the accuracy principle), and
- (b) in Chapter III of the applied GDPR (rights of the data subject)—
- (i) Article 16 (right to rectification), and
- (ii) Article 17(1) and (2) (right to erasure).
- (3) The exemptions in this section apply in addition to the exemptions in section 24.
#### National security and defence exemption
##### 26
- (1) A provision of the applied GDPR or this Act mentioned in subsection (2) does not apply to personal data to which this Chapter applies if exemption from the provision is required for—
- (a) the purpose of safeguarding national security, or
- (b) defence purposes.
- (2) The provisions are—
- (a) Chapter II of the applied GDPR (principles) except for—
- (i) Article 5(1)(a) (lawful, fair and transparent processing), so far as it requires processing of personal data to be lawful;
- (ii) Article 6 (lawfulness of processing);
- (iii) Article 9 (processing of special categories of personal data);
- (b) Chapter III of the applied GDPR (rights of data subjects);
- (c) in Chapter IV of the applied GDPR—
- (i) Article 33 (notification of personal data breach to the Commissioner);
- (ii) Article 34 (communication of personal data breach to the data subject);
- (d) Chapter V of the applied GDPR (transfers of personal data to third countries or international organisations);
- (e) in Chapter VI of the applied GDPR—
- (i) Article 57(1)(a) and (h) (Commissioner's duties to monitor and enforce the applied GDPR and to conduct investigations);
- (ii) Article 58 (investigative, corrective, authorisation and advisory powers of Commissioner);
- (f) Chapter VIII of the applied GDPR (remedies, liabilities and penalties) except for—
- (i) Article 83 (general conditions for imposing administrative fines);
- (ii) Article 84 (penalties);
- (g) in Part 5 of this Act—
- (i) in section 115 (general functions of the Commissioner), subsections (3) and (8);
- (ii) in section 115, subsection (9), so far as it relates to Article 58(2)(i) of the applied GDPR;
- (iii) section 119 (inspection in accordance with international obligations);
- (h) in Part 6 of this Act—
- (i) sections 142 to 154 and Schedule 15 (Commissioner's notices and powers of entry and inspection);
- (ii) sections 170 to 173 (offences relating to personal data);
- (i) in Part 7 of this Act, section 187 (representation of data subjects).
#### National security: certificate
##### 27
- (1) Subject to subsection (3), a certificate signed by a Minister of the Crown certifying that exemption from all or any of the provisions listed in section 26(2) is, or at any time was, required in relation to any personal data for the purpose of safeguarding national security is conclusive evidence of that fact.
- (2) A certificate under subsection (1)—
- (a) may identify the personal data to which it applies by means of a general description, and
- (b) may be expressed to have prospective effect.
- (3) Any person directly affected by a certificate under subsection (1) may appeal to the Tribunal against the certificate.
- (4) If, on an appeal under subsection (3), the Tribunal finds that, applying the principles applied by a court on an application for judicial review, the Minister did not have reasonable grounds for issuing a certificate, the Tribunal may—
- (a) allow the appeal, and
- (b) quash the certificate.
- (5) Where, in any proceedings under or by virtue of the applied GDPR or this Act, it is claimed by a controller that a certificate under subsection (1) which identifies the personal data to which it applies by means of a general description applies to any personal data, another party to the proceedings may appeal to the Tribunal on the ground that the certificate does not apply to the personal data in question.
- (6) But, subject to any determination under subsection (7), the certificate is to be conclusively presumed so to apply.
- (7) On an appeal under subsection (5), the Tribunal may determine that the certificate does not so apply.
- (8) A document purporting to be a certificate under subsection (1) is to be—
- (a) received in evidence, and
- (b) deemed to be such a certificate unless the contrary is proved.
- (9) A document which purports to be certified by or on behalf of a Minister of the Crown as a true copy of a certificate issued by that Minister under subsection (1) is—
- (a) in any legal proceedings, evidence of that certificate;
- (b) in any legal proceedings in Scotland, sufficient evidence of that certificate.
- (10) The power conferred by subsection (1) on a Minister of the Crown is exercisable only by—
- (a) a Minister who is a member of the Cabinet, or
- (b) the Attorney General or the Advocate General for Scotland.
#### National security and defence: modifications to Articles 9 and 32 of the applied GDPR
##### 28
- (1) Article 9(1) of the applied GDPR (prohibition on processing of special categories of personal data) does not prohibit the processing of personal data to which this Chapter applies to the extent that the processing is carried out—
- (a) for the purpose of safeguarding national security or for defence purposes, and
- (b) with appropriate safeguards for the rights and freedoms of data subjects.
- (2) Article 32 of the applied GDPR (security of processing) does not apply to a controller or processor to the extent that the controller or the processor (as the case may be) is processing personal data to which this Chapter applies for—
- (a) the purpose of safeguarding national security, or
- (b) defence purposes.
- (3) Where Article 32 of the applied GDPR does not apply, the controller or the processor must implement security measures appropriate to the risks arising from the processing of the personal data.
- (4) For the purposes of subsection (3), where the processing of personal data is carried out wholly or partly by automated means, the controller or the processor must, following an evaluation of the risks, implement measures designed to—
- (a) prevent unauthorised processing or unauthorised interference with the systems used in connection with the processing,
- (b) ensure that it is possible to establish the precise details of any processing that takes place,
- (c) ensure that any systems used in connection with the processing function properly and may, in the case of interruption, be restored, and
- (d) ensure that stored personal data cannot be corrupted if a system used in connection with the processing malfunctions.
## PART 3 — Law enforcement processing
### CHAPTER 1 — Scope and definitions
### Scope
#### Processing to which this Part applies
##### 29
- (1) This Part applies to—
- (a) the processing by a competent authority of personal data wholly or partly by automated means, and
- (b) the processing by a competent authority otherwise than by automated means of personal data which forms part of a filing system or is intended to form part of a filing system.
- (2) Any reference in this Part to the processing of personal data is to processing to which this Part applies.
- (3) For the meaning of “competent authority”, see section 30.
- (a) section 145 (information orders);
- (b) section 152 (enforcement notices and processing for the special purposes);
- (c) section 156 (penalty notices and processing for the special purposes);
- (d) section 167 and Article 79 of the UK GDPR (compliance orders);
- (e) sections 168 and 169 and Article 82 of the UK GDPR (compensation).
- (3) In relation to the processing of personal data to which Part 4 applies, the jurisdiction conferred by the provisions listed in subsection (2) is exercisable only by the High Court or, in Scotland, the Court of Session.
- (4) In relation to an information notice which contains a statement under section 142(7), the jurisdiction conferred on a court by section 145 is exercisable only by the High Court or, in Scotland, the Court of Session.
- (5) The jurisdiction conferred on a court by section 164 (applications in respect of urgent notices) is exercisable only by the High Court or, in Scotland, the Court of Session.
### Definitions
#### Meaning of “competent authority”
##### 30
- (1) In this Part, “*competent authority*” means—
- (a) a person specified or described in Schedule 7, and
- (b) any other person if and to the extent that the person has statutory functions for any of the law enforcement purposes.
- (2) But an intelligence service is not a competent authority within the meaning of this Part.
- (3) The Secretary of State may by regulations amend Schedule 7—
- (a) so as to add or remove a person or description of person;
- (b) so as to reflect any change in the name of a person specified in the Schedule.
- (4) Regulations under subsection (3) which make provision of the kind described in subsection (3)(a) may also make consequential amendments of section 73(4)(b).
- (5) Regulations under subsection (3) which make provision of the kind described in subsection (3)(a), or which make provision of that kind and of the kind described in subsection (3)(b), are subject to the affirmative resolution procedure.
- (6) Regulations under subsection (3) which make provision only of the kind described in subsection (3)(b) are subject to the negative resolution procedure.
- (7) In this section—
- “*intelligence service*” means—the Security Service;the Secret Intelligence Service;the Government Communications Headquarters;
- “*statutory function*” means a function under or by virtue of an enactment.
#### “The law enforcement purposes”
##### 31
For the purposes of this Part, “the law enforcement purposes” are the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.
#### Meaning of “controller” and “processor”
##### 32
- (1) In this Part, “*controller*” means the competent authority which, alone or jointly with others—
- (a) determines the purposes and means of the processing of personal data, or
- (b) is the controller by virtue of subsection (2).
- (2) Where personal data is processed only—
- (a) for purposes for which it is required by an enactment to be processed, and
- (b) by means by which it is required by an enactment to be processed,
the competent authority on which the obligation to process the data is imposed by the enactment (or, if different, one of the enactments) is the controller.
- (3) In this Part, “*processor*” means any person who processes personal data on behalf of the controller (other than a person who is an employee of the controller).
#### Other definitions
##### 33
- (1) This section defines certain other expressions used in this Part.
- (2) “*Employee*”, in relation to any person, includes an individual who holds a position (whether paid or unpaid) under the direction and control of that person.
- (3) “*Personal data breach*” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.
- (4) “*Profiling*” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to an individual, in particular to analyse or predict aspects concerning that individual's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
- (5) “*Recipient*”, in relation to any personal data, means any person to whom the data is disclosed, whether a third party or not, but it does not include a public authority to whom disclosure is or may be made in the framework of a particular inquiry in accordance with the law.
- (6) “*Restriction of processing*” means the marking of stored personal data with the aim of limiting its processing for the future.
- (7) “*Third country*” means a country or territory other than a member State.
- (8) Sections 3 and 205 include definitions of other expressions used in this Part.
### CHAPTER 2 — Principles
#### Overview and general duty of controller
##### 34
- (1) This Chapter sets out the six data protection principles as follows—
- (a) section 35(1) sets out the first data protection principle (requirement that processing be lawful and fair);
- (b) section 36(1) sets out the second data protection principle (requirement that purposes of processing be specified, explicit and legitimate);
- (c) section 37 sets out the third data protection principle (requirement that personal data be adequate, relevant and not excessive);
- (d) section 38(1) sets out the fourth data protection principle (requirement that personal data be accurate and kept up to date);
- (e) section 39(1) sets out the fifth data protection principle (requirement that personal data be kept for no longer than is necessary);
- (f) section 40 sets out the sixth data protection principle (requirement that personal data be processed in a secure manner).
- (2) In addition—
- (a) each of sections 35, 36, 38 and 39 makes provision to supplement the principle to which it relates, and
- (b) sections 41 and 42 make provision about the safeguards that apply in relation to certain types of processing.
- (3) The controller in relation to personal data is responsible for, and must be able to demonstrate, compliance with this Chapter.
#### The first data protection principle
##### 35
- (1) The first data protection principle is that the processing of personal data for any of the law enforcement purposes must be lawful and fair.
- (2) The processing of personal data for any of the law enforcement purposes is lawful only if and to the extent that it is based on law and either—
- (a) the data subject has given consent to the processing for that purpose, or
- (b) the processing is necessary for the performance of a task carried out for that purpose by a competent authority.
- (3) In addition, where the processing for any of the law enforcement purposes is sensitive processing, the processing is permitted only in the two cases set out in subsections (4) and (5).
- (4) The first case is where—
- (a) the data subject has given consent to the processing for the law enforcement purpose as mentioned in subsection (2)(a), and
- (b) at the time when the processing is carried out, the controller has an appropriate policy document in place (see section 42).
- (5) The second case is where—
- (a) the processing is strictly necessary for the law enforcement purpose,
- (b) the processing meets at least one of the conditions in Schedule 8, and
- (c) at the time when the processing is carried out, the controller has an appropriate policy document in place (see section 42).
- (6) The Secretary of State may by regulations amend Schedule 8—
- (a) by adding conditions;
- (b) by omitting conditions added by regulations under paragraph (a).
- (7) Regulations under subsection (6) are subject to the affirmative resolution procedure.
- (8) In this section, “*sensitive processing*” means—
- (a) the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership;
- (b) the processing of genetic data, or of biometric data, for the purpose of uniquely identifying an individual;
- (c) the processing of data concerning health;
- (d) the processing of data concerning an individual's sex life or sexual orientation.
#### The second data protection principle
##### 36
- (1) The second data protection principle is that—
- (a) the law enforcement purpose for which personal data is collected on any occasion must be specified, explicit and legitimate, and
- (b) personal data so collected must not be processed in a manner that is incompatible with the purpose for which it was collected.
- (2) Paragraph (b) of the second data protection principle is subject to subsections (3) and (4).
- (3) Personal data collected for a law enforcement purpose may be processed for any other law enforcement purpose (whether by the controller that collected the data or by another controller) provided that—
- (a) the controller is authorised by law to process the data for the other purpose, and
- (b) the processing is necessary and proportionate to that other purpose.
- (4) Personal data collected for any of the law enforcement purposes may not be processed for a purpose that is not a law enforcement purpose unless the processing is authorised by law.
#### The third data protection principle
##### 37
The third data protection principle is that personal data processed for any of the law enforcement purposes must be adequate, relevant and not excessive in relation to the purpose for which it is processed.
#### The fourth data protection principle
##### 38
- (1) The fourth data protection principle is that—
- (a) personal data processed for any of the law enforcement purposes must be accurate and, where necessary, kept up to date, and
- (b) every reasonable step must be taken to ensure that personal data that is inaccurate, having regard to the law enforcement purpose for which it is processed, is erased or rectified without delay.
- (2) In processing personal data for any of the law enforcement purposes, personal data based on facts must, so far as possible, be distinguished from personal data based on personal assessments.
- (3) In processing personal data for any of the law enforcement purposes, a clear distinction must, where relevant and as far as possible, be made between personal data relating to different categories of data subject, such as—
- (a) persons suspected of having committed or being about to commit a criminal offence;
- (b) persons convicted of a criminal offence;
- (c) persons who are or may be victims of a criminal offence;
- (d) witnesses or other persons with information about offences.
- (4) All reasonable steps must be taken to ensure that personal data which is inaccurate, incomplete or no longer up to date is not transmitted or made available for any of the law enforcement purposes.
- (5) For that purpose—
- (a) the quality of personal data must be verified before it is transmitted or made available,
- (b) in all transmissions of personal data, the necessary information enabling the recipient to assess the degree of accuracy, completeness and reliability of the data and the extent to which it is up to date must be included, and
- (c) if, after personal data has been transmitted, it emerges that the data was incorrect or that the transmission was unlawful, the recipient must be notified without delay.
#### The fifth data protection principle
##### 39
- (1) The fifth data protection principle is that personal data processed for any of the law enforcement purposes must be kept for no longer than is necessary for the purpose for which it is processed.
- (2) Appropriate time limits must be established for the periodic review of the need for the continued storage of personal data for any of the law enforcement purposes.
#### The sixth data protection principle
##### 40
The sixth data protection principle is that personal data processed for any of the law enforcement purposes must be so processed in a manner that ensures appropriate security of the personal data, using appropriate technical or organisational measures (and, in this principle, “*appropriate security*” includes protection against unauthorised or unlawful processing and against accidental loss, destruction or damage).
#### Safeguards: archiving
##### 41
- (1) This section applies in relation to the processing of personal data for a law enforcement purpose where the processing is necessary—
- (a) for archiving purposes in the public interest,
- (b) for scientific or historical research purposes, or
- (c) for statistical purposes.
- (2) The processing is not permitted if—
- (a) it is carried out for the purposes of, or in connection with, measures or decisions with respect to a particular data subject, or
- (b) it is likely to cause substantial damage or substantial distress to a data subject.
#### Safeguards: sensitive processing
##### 42
- (1) This section applies for the purposes of section 35(4) and (5) (which require a controller to have an appropriate policy document in place when carrying out sensitive processing in reliance on the consent of the data subject or, as the case may be, in reliance on a condition specified in Schedule 8).
- (2) The controller has an appropriate policy document in place in relation to the sensitive processing if the controller has produced a document which—
- (a) explains the controller's procedures for securing compliance with the data protection principles (see section 34(1)) in connection with sensitive processing in reliance on the consent of the data subject or (as the case may be) in reliance on the condition in question, and
- (b) explains the controller's policies as regards the retention and erasure of personal data processed in reliance on the consent of the data subject or (as the case may be) in reliance on the condition in question, giving an indication of how long such personal data is likely to be retained.
- (3) Where personal data is processed on the basis that an appropriate policy document is in place, the controller must during the relevant period—
- (a) retain the appropriate policy document,
- (b) review and (if appropriate) update it from time to time, and
- (c) make it available to the Commissioner, on request, without charge.
- (4) The record maintained by the controller under section 61(1) and, where the sensitive processing is carried out by a processor on behalf of the controller, the record maintained by the processor under section 61(3) must include the following information—
- (a) whether the sensitive processing is carried out in reliance on the consent of the data subject or, if not, which condition in Schedule 8 is relied on,
- (b) how the processing satisfies section 35 (lawfulness of processing), and
- (c) whether the personal data is retained and erased in accordance with the policies described in subsection (2)(b) and, if it is not, the reasons for not following those policies.
- (5) In this section, “*relevant period*”, in relation to sensitive processing in reliance on the consent of the data subject or in reliance on a condition specified in Schedule 8, means a period which—
- (a) begins when the controller starts to carry out the sensitive processing in reliance on the data subject's consent or (as the case may be) in reliance on that condition, and
- (b) ends at the end of the period of 6 months beginning when the controller ceases to carry out the processing.
### CHAPTER 3 — Rights of the data subject
### Overview and scope
#### Overview and scope
##### 43
- (1) This Chapter—
- (a) imposes general duties on the controller to make information available (see section 44);
- (b) confers a right of access by the data subject (see section 45);
- (c) confers rights on the data subject with respect to the rectification of personal data and the erasure of personal data or the restriction of its processing (see sections 46 to 48);
- (d) regulates automated decision-making (see sections 49 and 50);
- (e) makes supplementary provision (see sections 51 to 54).
- (2) This Chapter applies only in relation to the processing of personal data for a law enforcement purpose.
- (3) But sections 44 to 48 do not apply in relation to the processing of relevant personal data in the course of a criminal investigation or criminal proceedings, including proceedings for the purpose of executing a criminal penalty.
- (4) In subsection (3), “*relevant personal data*” means personal data contained in a judicial decision or in other documents relating to the investigation or proceedings which are created by or on behalf of a court or other judicial authority.
- (5) In this Chapter, “*the controller*”, in relation to a data subject, means the controller in relation to personal data relating to the data subject.
### Information: controller's general duties
#### Information: controller’s general duties
##### 44
- (1) The controller must make available to data subjects the following information (whether by making the information generally available to the public or in any other way)—
- (a) the identity and the contact details of the controller;
- (b) where applicable, the contact details of the data protection officer (see sections 69 to 71);
- (c) the purposes for which the controller processes personal data;
- (d) the existence of the rights of data subjects to request from the controller—
- (i) access to personal data (see section 45),
- (ii) rectification of personal data (see section 46), and
- (iii) erasure of personal data or the restriction of its processing (see section 47);
- (e) the existence of the right to lodge a complaint with the Commissioner and the contact details of the Commissioner.
- (2) The controller must also, in specific cases for the purpose of enabling the exercise of a data subject's rights under this Part, give the data subject the following—
- (a) information about the legal basis for the processing;
- (b) information about the period for which the personal data will be stored or, where that is not possible, about the criteria used to determine that period;
- (c) where applicable, information about the categories of recipients of the personal data (including recipients in third countries or international organisations);
- (d) such further information as is necessary to enable the exercise of the data subject's rights under this Part.
- (3) An example of where further information may be necessary as mentioned in subsection (2)(d) is where the personal data being processed was collected without the knowledge of the data subject.
- (4) The controller may restrict, wholly or partly, the provision of information to the data subject under subsection (2) to the extent that and for so long as the restriction is, having regard to the fundamental rights and legitimate interests of the data subject, a necessary and proportionate measure to—
- (a) avoid obstructing an official or legal inquiry, investigation or procedure;
- (b) avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;
- (c) protect public security;
- (d) protect national security;
- (e) protect the rights and freedoms of others.
- (5) Where the provision of information to a data subject under subsection (2) is restricted, wholly or partly, the controller must inform the data subject in writing without undue delay—
- (a) that the provision of information has been restricted,
- (b) of the reasons for the restriction,
- (c) of the data subject's right to make a request to the Commissioner under section 51,
- (d) of the data subject's right to lodge a complaint with the Commissioner, and
- (e) of the data subject's right to apply to a court under section 167.
- (6) Subsection (5)(a) and (b) do not apply to the extent that complying with them would undermine the purpose of the restriction.
- (7) The controller must—
- (a) record the reasons for a decision to restrict (whether wholly or partly) the provision of information to a data subject under subsection (2), and
- (b) if requested to do so by the Commissioner, make the record available to the Commissioner.
### Data subject's right of access
#### Right of access by the data subject
##### 45
- (1) A data subject is entitled to obtain from the controller—
- (a) confirmation as to whether or not personal data concerning him or her is being processed, and
- (b) where that is the case, access to the personal data and the information set out in subsection (2).
- (2) That information is—
- (a) the purposes of and legal basis for the processing;
- (b) the categories of personal data concerned;
- (c) the recipients or categories of recipients to whom the personal data has been disclosed (including recipients or categories of recipients in third countries or international organisations);
- (d) the period for which it is envisaged that the personal data will be stored or, where that is not possible, the criteria used to determine that period;
- (e) the existence of the data subject's rights to request from the controller—
- (i) rectification of personal data (see section 46), and
- (ii) erasure of personal data or the restriction of its processing (see section 47);
- (f) the existence of the data subject's right to lodge a complaint with the Commissioner and the contact details of the Commissioner;
- (g) communication of the personal data undergoing processing and of any available information as to its origin.
- (3) Where a data subject makes a request under subsection (1), the information to which the data subject is entitled must be provided in writing —
- (a) without undue delay, and
- (b) in any event, before the end of the applicable time period (as to which see section 54).
- (4) The controller may restrict, wholly or partly, the rights conferred by subsection (1) to the extent that and for so long as the restriction is, having regard to the fundamental rights and legitimate interests of the data subject, a necessary and proportionate measure to—
- (a) avoid obstructing an official or legal inquiry, investigation or procedure;
- (b) avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;
- (c) protect public security;
- (d) protect national security;
- (e) protect the rights and freedoms of others.
- (5) Where the rights of a data subject under subsection (1) are restricted, wholly or partly, the controller must inform the data subject in writing without undue delay—
- (a) that the rights of the data subject have been restricted,
- (b) of the reasons for the restriction,
- (c) of the data subject's right to make a request to the Commissioner under section 51,
- (d) of the data subject's right to lodge a complaint with the Commissioner, and
- (e) of the data subject's right to apply to a court under section 167.
- (6) Subsection (5)(a) and (b) do not apply to the extent that the provision of the information would undermine the purpose of the restriction.
- (7) The controller must—
- (a) record the reasons for a decision to restrict (whether wholly or partly) the rights of a data subject under subsection (1), and
- (b) if requested to do so by the Commissioner, make the record available to the Commissioner.
### Data subject's rights to rectification or erasure etc
#### Right to rectification
##### 46
- (1) The controller must, if so requested by a data subject, rectify without undue delay inaccurate personal data relating to the data subject.
- (2) Where personal data is inaccurate because it is incomplete, the controller must, if so requested by a data subject, complete it.
- (3) The duty under subsection (2) may, in appropriate cases, be fulfilled by the provision of a supplementary statement.
- (4) Where the controller would be required to rectify personal data under this section but the personal data must be maintained for the purposes of evidence, the controller must (instead of rectifying the personal data) restrict its processing.
#### Right to erasure or restriction of processing
##### 47
- (1) The controller must erase personal data without undue delay where—
- (a) the processing of the personal data would infringe section 35, 36(1) to (3), 37, 38(1), 39(1), 40, 41 or 42, or
- (b) the controller has a legal obligation to erase the data.
- (2) Where the controller would be required to erase personal data under subsection (1) but the personal data must be maintained for the purposes of evidence, the controller must (instead of erasing the personal data) restrict its processing.
- (3) Where a data subject contests the accuracy of personal data (whether in making a request under this section or section 46 or in any other way), but it is not possible to ascertain whether it is accurate or not, the controller must restrict its processing.
- (4) A data subject may request the controller to erase personal data or to restrict its processing (but the duties of the controller under this section apply whether or not such a request is made).
#### Rights under section 46 or 47: supplementary
##### 48
- (1) Where a data subject requests the rectification or erasure of personal data or the restriction of its processing, the controller must inform the data subject in writing—
- (a) whether the request has been granted, and
- (b) if it has been refused—
- (i) of the reasons for the refusal,
- (ii) of the data subject's right to make a request to the Commissioner under section 51,
- (iii) of the data subject's right to lodge a complaint with the Commissioner, and
- (iv) of the data subject's right to apply to a court under section 167.
- (2) The controller must comply with the duty under subsection (1)—
- (a) without undue delay, and
- (b) in any event, before the end of the applicable time period (see section 54).
- (3) The controller may restrict, wholly or partly, the provision of information to the data subject under subsection (1)(b)(i) to the extent that and for so long as the restriction is, having regard to the fundamental rights and legitimate interests of the data subject, a necessary and proportionate measure to—
- (a) avoid obstructing an official or legal inquiry, investigation or procedure;
- (b) avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;
- (c) protect public security;
- (d) protect national security;
- (e) protect the rights and freedoms of others.
- (4) Where the rights of a data subject under subsection (1) are restricted, wholly or partly, the controller must inform the data subject in writing without undue delay—
- (a) that the rights of the data subject have been restricted,
- (b) of the reasons for the restriction,
- (c) of the data subject's right to lodge a complaint with the Commissioner, and
- (d) of the data subject's right to apply to a court under section 167.
- (5) Subsection (4)(a) and (b) do not apply to the extent that the provision of the information would undermine the purpose of the restriction.
- (6) The controller must—
- (a) record the reasons for a decision to restrict (whether wholly or partly) the provision of information to a data subject under subsection (1)(b)(i), and
- (b) if requested to do so by the Commissioner, make the record available to the Commissioner.
- (7) Where the controller rectifies personal data, it must notify the competent authority (if any) from which the inaccurate personal data originated.
- (8) In subsection (7), the reference to a competent authority includes (in addition to a competent authority within the meaning of this Part) any person that is a competent authority for the purposes of the Law Enforcement Directive in a member State other than the United Kingdom.
- (9) Where the controller rectifies, erases or restricts the processing of personal data which has been disclosed by the controller—
- (a) the controller must notify the recipients, and
- (b) the recipients must similarly rectify, erase or restrict the processing of the personal data (so far as they retain responsibility for it).
- (10) Where processing is restricted in accordance with section 47(3), the controller must inform the data subject before lifting the restriction.
### Automated individual decision-making
#### Right not to be subject to automated decision-making
##### 49
- (1) A controller may not take a significant decision based solely on automated processing unless that decision is required or authorised by law.
- (2) A decision is a “significant decision” for the purpose of this section if, in relation to a data subject, it—
- (a) produces an adverse legal effect concerning the data subject, or
- (b) significantly affects the data subject.
#### Automated decision-making authorised by law: safeguards
##### 50
- (1) A decision is a “*qualifying significant decision*” for the purposes of this section if—
- (a) it is a significant decision in relation to a data subject, and
- (b) it is required or authorised by law.
- (2) Where a controller takes a qualifying significant decision in relation to a data subject based solely on automated processing—
- (a) the controller must, as soon as reasonably practicable, notify the data subject in writing that a decision has been taken based solely on automated processing, and
- (b) the data subject may, before the end of the period of 1 month beginning with receipt of the notification, request the controller to—
- (i) reconsider the decision, or
- (ii) take a new decision that is not based solely on automated processing.
- (3) If a request is made to a controller under subsection (2), the controller must, before the end of the period of 1 month beginning with receipt of the request—
- (a) consider the request, including any information provided by the data subject that is relevant to it,
- (b) comply with the request, and
- (c) by notice in writing inform the data subject of—
- (i) the steps taken to comply with the request, and
- (ii) the outcome of complying with the request.
- (4) The Secretary of State may by regulations make such further provision as the Secretary of State considers appropriate to provide suitable measures to safeguard a data subject's rights, freedoms and legitimate interests in connection with the taking of qualifying significant decisions based solely on automated processing.
- (5) Regulations under subsection (4)—
- (a) may amend this section, and
- (b) are subject to the affirmative resolution procedure.
- (6) In this section “*significant decision*” has the meaning given by section 49(2).
### Supplementary
#### Exercise of rights through the Commissioner
##### 51
- (1) This section applies where a controller—
- (a) restricts under section 44(4) the information provided to the data subject under section 44(2) (duty of the controller to give the data subject additional information),
- (b) restricts under section 45(4) the data subject's rights under section 45(1) (right of access), or
- (c) refuses a request by the data subject for rectification under section 46 or for erasure or restriction of processing under section 47.
- (2) The data subject may—
- (a) where subsection (1)(a) or (b) applies, request the Commissioner to check that the restriction imposed by the controller was lawful;
- (b) where subsection (1)(c) applies, request the Commissioner to check that the refusal of the data subject's request was lawful.
- (3) The Commissioner must take such steps as appear to the Commissioner to be appropriate to respond to a request under subsection (2) (which may include the exercise of any of the powers conferred by sections 142 and 146).
- (4) After taking those steps, the Commissioner must inform the data subject—
- (a) where subsection (1)(a) or (b) applies, whether the Commissioner is satisfied that the restriction imposed by the controller was lawful;
- (b) where subsection (1)(c) applies, whether the Commissioner is satisfied that the controller's refusal of the data subject's request was lawful.
- (5) The Commissioner must also inform the data subject of the data subject's right to apply to a court under section 167.
- (6) Where the Commissioner is not satisfied as mentioned in subsection (4)(a) or (b), the Commissioner may also inform the data subject of any further steps that the Commissioner is considering taking under Part 6 .
#### Form of provision of information etc
##### 52
- (1) The controller must take reasonable steps to ensure that any information that is required by this Chapter to be provided to the data subject is provided in a concise, intelligible and easily accessible form, using clear and plain language.
- (2) Subject to subsection (3), the information may be provided in any form, including electronic form.
- (3) Where information is provided in response to a request by the data subject under section 45, 46, 47 or 50, the controller must provide the information in the same form as the request where it is practicable to do so.
- (4) Where the controller has reasonable doubts about the identity of an individual making a request under section 45, 46 or 47, the controller may—
- (a) request the provision of additional information to enable the controller to confirm the identity, and
- (b) delay dealing with the request until the identity is confirmed.
- (5) Subject to section 53, any information that is required by this Chapter to be provided to the data subject must be provided free of charge.
- (6) The controller must facilitate the exercise of the rights of the data subject under sections 45 to 50.
#### Manifestly unfounded or excessive requests by the data subject
##### 53
- (1) Where a request from a data subject under section 45, 46, 47 or 50 is manifestly unfounded or excessive, the controller may—
- (a) charge a reasonable fee for dealing with the request, or
- (b) refuse to act on the request.
- (2) An example of a request that may be excessive is one that merely repeats the substance of previous requests.
- (3) In any proceedings where there is an issue as to whether a request under section 45, 46, 47 or 50 is manifestly unfounded or excessive, it is for the controller to show that it is.
- (4) The Secretary of State may by regulations specify limits on the fees that a controller may charge in accordance with subsection (1)(a).
- (5) Regulations under subsection (4) are subject to the negative resolution procedure.
#### Meaning of “applicable time period”
##### 54
- (1) This section defines “*the applicable time period*” for the purposes of sections 45(3)(b) and 48(2)(b).
- (2) “*The applicable time period*” means the period of 1 month, or such longer period as may be specified in regulations, beginning with the relevant time.
- (3) “*The relevant time*” means the latest of the following—
- (a) when the controller receives the request in question;
- (b) when the controller receives the information (if any) requested in connection with a request under section 52(4);
- (c) when the fee (if any) charged in connection with the request under section 53 is paid.
- (4) The power to make regulations under subsection (2) is exercisable by the Secretary of State.
- (5) Regulations under subsection (2) may not specify a period which is longer than 3 months.
- (6) Regulations under subsection (2) are subject to the negative resolution procedure.
### CHAPTER 4 — Controller and processor
### Overview and scope
#### Overview and scope
##### 55
- (1) This Chapter—
- (a) sets out the general obligations of controllers and processors (see sections 56 to 65);
- (b) sets out specific obligations of controllers and processors with respect to security (see section 66);
- (c) sets out specific obligations of controllers and processors with respect to personal data breaches (see sections 67 and 68);
- (d) makes provision for the designation, position and tasks of data protection officers (see sections 69 to 71).
- (2) This Chapter applies only in relation to the processing of personal data for a law enforcement purpose.
- (3) Where a controller is required by any provision of this Chapter to implement appropriate technical and organisational measures, the controller must (in deciding what measures are appropriate) take into account—
- (a) the latest developments in technology,
- (b) the cost of implementation,
- (c) the nature, scope, context and purposes of processing, and
- (d) the risks for the rights and freedoms of individuals arising from the processing.
### General obligations
#### General obligations of the controller
##### 56
- (1) Each controller must implement appropriate technical and organisational measures to ensure, and to be able to demonstrate, that the processing of personal data complies with the requirements of this Part.
- (2) Where proportionate in relation to the processing, the measures implemented to comply with the duty under subsection (1) must include appropriate data protection policies.
- (3) The technical and organisational measures implemented under subsection (1) must be reviewed and updated where necessary.
#### Data protection by design and default
##### 57
- (1) Each controller must implement appropriate technical and organisational measures which are designed—
- (a) to implement the data protection principles in an effective manner, and
- (b) to integrate into the processing itself the safeguards necessary for that purpose.
- (2) The duty under subsection (1) applies both at the time of the determination of the means of processing the data and at the time of the processing itself.
- (3) Each controller must implement appropriate technical and organisational measures for ensuring that, by default, only personal data which is necessary for each specific purpose of the processing is processed.
- (4) The duty under subsection (3) applies to—
- (a) the amount of personal data collected,
- (b) the extent of its processing,
- (c) the period of its storage, and
- (d) its accessibility.
- (5) In particular, the measures implemented to comply with the duty under subsection (3) must ensure that, by default, personal data is not made accessible to an indefinite number of people without an individual's intervention.
#### Joint controllers
##### 58
- (1) Where two or more competent authorities jointly determine the purposes and means of processing personal data, they are joint controllers for the purposes of this Part.
- (2) Joint controllers must, in a transparent manner, determine their respective responsibilities for compliance with this Part by means of an arrangement between them, except to the extent that those responsibilities are determined under or by virtue of an enactment.
- (3) The arrangement must designate the controller which is to be the contact point for data subjects.
#### Processors
##### 59
- (1) This section applies to the use by a controller of a processor to carry out processing of personal data on behalf of the controller.
- (2) The controller may use only a processor who provides guarantees to implement appropriate technical and organisational measures that are sufficient to secure that the processing will—
- (a) meet the requirements of this Part, and
- (b) ensure the protection of the rights of the data subject.
- (3) The processor used by the controller may not engage another processor (“a sub-processor”) without the prior written authorisation of the controller, which may be specific or general.
- (4) Where the controller gives a general written authorisation to a processor, the processor must inform the controller if the processor proposes to add to the number of sub-processors engaged by it or to replace any of them (so that the controller has the opportunity to object to the proposal).
- (5) The processing by the processor must be governed by a contract in writing between the controller and the processor setting out the following—
- (a) the subject-matter and duration of the processing;
- (b) the nature and purpose of the processing;
- (c) the type of personal data and categories of data subjects involved;
- (d) the obligations and rights of the controller and processor.
- (6) The contract must, in particular, provide that the processor must—
- (a) act only on instructions from the controller,
- (b) ensure that the persons authorised to process personal data are subject to an appropriate duty of confidentiality,
- (c) assist the controller by any appropriate means to ensure compliance with the rights of the data subject under this Part,
- (d) at the end of the provision of services by the processor to the controller—
- (i) either delete or return to the controller (at the choice of the controller) the personal data to which the services relate, and
- (ii) delete copies of the personal data unless subject to a legal obligation to store the copies,
- (e) make available to the controller all information necessary to demonstrate compliance with this section, and
- (f) comply with the requirements of this section for engaging sub-processors.
- (7) The terms included in the contract in accordance with subsection (6)(a) must provide that the processor may transfer personal data to a third country or international organisation only if instructed by the controller to make the particular transfer.
- (8) If a processor determines, in breach of this Part, the purposes and means of processing, the processor is to be treated for the purposes of this Part as a controller in respect of that processing.
#### Processing under the authority of the controller or processor
##### 60
A processor, and any person acting under the authority of a controller or processor, who has access to personal data may not process the data except—
- (a) on instructions from the controller, or
- (b) to comply with a legal obligation.
#### Records of processing activities
##### 61
- (1) Each controller must maintain a record of all categories of processing activities for which the controller is responsible.
- (2) The controller's record must contain the following information—
- (a) the name and contact details of the controller;
- (b) where applicable, the name and contact details of the joint controller;
- (c) where applicable, the name and contact details of the data protection officer;
- (d) the purposes of the processing;
- (e) the categories of recipients to whom personal data has been or will be disclosed (including recipients in third countries or international organisations);
- (f) a description of the categories of—
- (i) data subject, and
- (ii) personal data;
- (g) where applicable, details of the use of profiling;
- (h) where applicable, the categories of transfers of personal data to a third country or an international organisation;
- (i) an indication of the legal basis for the processing operations, including transfers, for which the personal data is intended;
- (j) where possible, the envisaged time limits for erasure of the different categories of personal data;
- (k) where possible, a general description of the technical and organisational security measures referred to in section 66.
- (3) Each processor must maintain a record of all categories of processing activities carried out on behalf of a controller.
- (4) The processor's record must contain the following information—
- (a) the name and contact details of the processor and of any other processors engaged by the processor in accordance with section 59(3);
- (b) the name and contact details of the controller on behalf of which the processor is acting;
- (c) where applicable, the name and contact details of the data protection officer;
- (d) the categories of processing carried out on behalf of the controller;
- (e) where applicable, details of transfers of personal data to a third country or an international organisation where explicitly instructed to do so by the controller, including the identification of that third country or international organisation;
- (f) where possible, a general description of the technical and organisational security measures referred to in section 66.
- (5) The controller and the processor must make the records kept under this section available to the Commissioner on request.
#### Logging
##### 62
- (1) A controller (or, where personal data is processed on behalf of the controller by a processor, the processor) must keep logs for at least the following processing operations in automated processing systems—
- (a) collection;
- (b) alteration;
- (c) consultation;
- (d) disclosure (including transfers);
- (e) combination;
- (f) erasure.
- (2) The logs of consultation must make it possible to establish—
- (a) the justification for, and date and time of, the consultation, and
- (b) so far as possible, the identity of the person who consulted the data.
- (3) The logs of disclosure must make it possible to establish—
- (a) the justification for, and date and time of, the disclosure, and
- (b) so far as possible—
- (i) the identity of the person who disclosed the data, and
- (ii) the identity of the recipients of the data.
- (4) The logs kept under subsection (1) may be used only for one or more of the following purposes—
- (a) to verify the lawfulness of processing;
- (b) to assist with self-monitoring by the controller or (as the case may be) the processor, including the conduct of internal disciplinary proceedings;
- (c) to ensure the integrity and security of personal data;
- (d) the purposes of criminal proceedings.
- (5) The controller or (as the case may be) the processor must make the logs available to the Commissioner on request.
#### Co-operation with the Commissioner
##### 63
Each controller and each processor must co-operate, on request, with the Commissioner in the performance of the Commissioner's tasks.
#### Data protection impact assessment
##### 64
- (1) Where a type of processing is likely to result in a high risk to the rights and freedoms of individuals, the controller must, prior to the processing, carry out a data protection impact assessment.
- (2) A data protection impact assessment is an assessment of the impact of the envisaged processing operations on the protection of personal data.
- (3) A data protection impact assessment must include the following—
- (a) a general description of the envisaged processing operations;
- (b) an assessment of the risks to the rights and freedoms of data subjects;
- (c) the measures envisaged to address those risks;
- (d) safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this Part, taking into account the rights and legitimate interests of the data subjects and other persons concerned.
- (4) In deciding whether a type of processing is likely to result in a high risk to the rights and freedoms of individuals, the controller must take into account the nature, scope, context and purposes of the processing.
#### Prior consultation with the Commissioner
##### 65
- (1) This section applies where a controller intends to create a filing system and process personal data forming part of it.
- (2) The controller must consult the Commissioner prior to the processing if a data protection impact assessment prepared under section 64 indicates that the processing of the data would result in a high risk to the rights and freedoms of individuals (in the absence of measures to mitigate the risk).
- (3) Where the controller is required to consult the Commissioner under subsection (2), the controller must give the Commissioner—
- (a) the data protection impact assessment prepared under section 64, and
- (b) any other information requested by the Commissioner to enable the Commissioner to make an assessment of the compliance of the processing with the requirements of this Part.
- (4) Where the Commissioner is of the opinion that the intended processing referred to in subsection (1) would infringe any provision of this Part, the Commissioner must provide written advice to the controller and, where the controller is using a processor, to the processor.
- (5) The written advice must be provided before the end of the period of 6 weeks beginning with receipt of the request for consultation by the controller or the processor.
- (6) The Commissioner may extend the period of 6 weeks by a further period of 1 month, taking into account the complexity of the intended processing.
- (7) If the Commissioner extends the period of 6 weeks, the Commissioner must—
- (a) inform the controller and, where applicable, the processor of any such extension before the end of the period of 1 month beginning with receipt of the request for consultation, and
- (b) provide reasons for the delay.
### Obligations relating to security
#### Security of processing
##### 66
- (1) Each controller and each processor must implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks arising from the processing of personal data.
- (2) In the case of automated processing, each controller and each processor must, following an evaluation of the risks, implement measures designed to—
- (a) prevent unauthorised processing or unauthorised interference with the systems used in connection with it,
- (b) ensure that it is possible to establish the precise details of any processing that takes place,
- (c) ensure that any systems used in connection with the processing function properly and may, in the case of interruption, be restored, and
- (d) ensure that stored personal data cannot be corrupted if a system used in connection with the processing malfunctions.
### Obligations relating to personal data breaches
#### Notification of a personal data breach to the Commissioner
##### 67
- (1) If a controller becomes aware of a personal data breach in relation to personal data for which the controller is responsible, the controller must notify the breach to the Commissioner—
- (a) without undue delay, and
- (b) where feasible, not later than 72 hours after becoming aware of it.
- (2) Subsection (1) does not apply if the personal data breach is unlikely to result in a risk to the rights and freedoms of individuals.
- (3) Where the notification to the Commissioner is not made within 72 hours, the notification must be accompanied by reasons for the delay.
- (4) Subject to subsection (5), the notification must include—
- (a) a description of the nature of the personal data breach including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
- (b) the name and contact details of the data protection officer or other contact point from whom more information can be obtained;
- (c) a description of the likely consequences of the personal data breach;
- (d) a description of the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
- (5) Where and to the extent that it is not possible to provide all the information mentioned in subsection (4) at the same time, the information may be provided in phases without undue further delay.
- (6) The controller must record the following information in relation to a personal data breach—
- (a) the facts relating to the breach,
- (b) its effects, and
- (c) the remedial action taken.
- (7) The information mentioned in subsection (6) must be recorded in such a way as to enable the Commissioner to verify compliance with this section.
- (8) Where a personal data breach involves personal data that has been transmitted by or to a person who is a controller under the law of another member State, the information mentioned in subsection (6) must be communicated to that person without undue delay.
- (9) If a processor becomes aware of a personal data breach (in relation to personal data processed by the processor), the processor must notify the controller without undue delay.
#### Communication of a personal data breach to the data subject
##### 68
- (1) Where a personal data breach is likely to result in a high risk to the rights and freedoms of individuals, the controller must inform the data subject of the breach without undue delay.
- (2) The information given to the data subject must include the following—
- (a) a description of the nature of the breach;
- (b) the name and contact details of the data protection officer or other contact point from whom more information can be obtained;
- (c) a description of the likely consequences of the personal data breach;
- (d) a description of the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
- (3) The duty under subsection (1) does not apply where—
- (a) the controller has implemented appropriate technological and organisational protection measures which were applied to the personal data affected by the breach,
- (b) the controller has taken subsequent measures which ensure that the high risk to the rights and freedoms of data subjects referred to in subsection (1) is no longer likely to materialise, or
- (c) it would involve a disproportionate effort.
- (4) An example of a case which may fall within subsection (3)(a) is where measures that render personal data unintelligible to any person not authorised to access the data have been applied, such as encryption.
- (5) In a case falling within subsection (3)(c) (but not within subsection (3)(a) or (b)), the information mentioned in subsection (2) must be made available to the data subject in another equally effective way, for example, by means of a public communication.
- (6) Where the controller has not informed the data subject of the breach the Commissioner, on being notified under section 67 and after considering the likelihood of the breach resulting in a high risk, may—
- (a) require the controller to notify the data subject of the breach, or
- (b) decide that the controller is not required to do so because any of paragraphs (a) to (c) of subsection (3) applies.
- (7) The controller may restrict, wholly or partly, the provision of information to the data subject under subsection (1) to the extent that and for so long as the restriction is, having regard to the fundamental rights and legitimate interests of the data subject, a necessary and proportionate measure to—
- (a) avoid obstructing an official or legal inquiry, investigation or procedure;
- (b) avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;
- (c) protect public security;
- (d) protect national security;
- (e) protect the rights and freedoms of others.
- (8) Subsection (6) does not apply where the controller's decision not to inform the data subject of the breach was made in reliance on subsection (7).
- (9) The duties in section 52(1) and (2) apply in relation to information that the controller is required to provide to the data subject under this section as they apply in relation to information that the controller is required to provide to the data subject under Chapter 3 .
### Data protection officers
#### Designation of a data protection officer
##### 69
- (1) The controller must designate a data protection officer, unless the controller is a court, or other judicial authority, acting in its judicial capacity.
- (2) When designating a data protection officer, the controller must have regard to the professional qualities of the proposed officer, in particular—
- (a) the proposed officer's expert knowledge of data protection law and practice, and
- (b) the ability of the proposed officer to perform the tasks mentioned in section 71.
- (3) The same person may be designated as a data protection officer by several controllers, taking account of their organisational structure and size.
- (4) The controller must publish the contact details of the data protection officer and communicate these to the Commissioner.
#### Position of data protection officer
##### 70
- (1) The controller must ensure that the data protection officer is involved, properly and in a timely manner, in all issues which relate to the protection of personal data.
- (2) The controller must provide the data protection officer with the necessary resources and access to personal data and processing operations to enable the data protection officer to—
- (a) perform the tasks mentioned in section 71, and
- (b) maintain his or her expert knowledge of data protection law and practice.
- (3) The controller—
- (a) must ensure that the data protection officer does not receive any instructions regarding the performance of the tasks mentioned in section 71;
- (b) must ensure that the data protection officer does not perform a task or fulfil a duty other than those mentioned in this Part where such task or duty would result in a conflict of interests;
- (c) must not dismiss or penalise the data protection officer for performing the tasks mentioned in section 71.
- (4) A data subject may contact the data protection officer with regard to all issues relating to—
- (a) the processing of that data subject's personal data, or
- (b) the exercise of that data subject's rights under this Part.
- (5) The data protection officer, in the performance of this role, must report to the highest management level of the controller.
#### Tasks of data protection officer
##### 71
- (1) The controller must entrust the data protection officer with at least the following tasks—
- (a) informing and advising the controller, any processor engaged by the controller, and any employee of the controller who carries out processing of personal data, of that person's obligations under this Part,
- (b) providing advice on the carrying out of a data protection impact assessment under section 64 and monitoring compliance with that section,
- (c) co-operating with the Commissioner,
- (d) acting as the contact point for the Commissioner on issues relating to processing, including in relation to the consultation mentioned in section 65, and consulting with the Commissioner, where appropriate, in relation to any other matter,
- (e) monitoring compliance with policies of the controller in relation to the protection of personal data, and
- (f) monitoring compliance by the controller with this Part.
- (2) In relation to the policies mentioned in subsection (1)(e), the data protection officer's tasks include—
- (a) assigning responsibilities under those policies,
- (b) raising awareness of those policies,
- (c) training staff involved in processing operations, and
- (d) conducting audits required under those policies.
- (3) In performing the tasks set out in subsections (1) and (2), the data protection officer must have regard to the risks associated with processing operations, taking into account the nature, scope, context and purposes of processing.
### CHAPTER 5 — Transfers of personal data to third countries etc
### Overview and interpretation
#### Overview and interpretation
##### 72
- (1) This Chapter deals with the transfer of personal data to third countries or international organisations, as follows—
- (a) sections 73 to 76 set out the general conditions that apply;
- (b) section 77 sets out the special conditions that apply where the intended recipient of personal data is not a relevant authority in a third country or an international organisation;
- (c) section 78 makes special provision about subsequent transfers of personal data.
- (2) In this Chapter, “*relevant authority*”, in relation to a third country, means any person based in a third country that has (in that country) functions comparable to those of a competent authority.
### General principles for transfers
#### General principles for transfers of personal data
##### 73
- (1) A controller may not transfer personal data to a third country or to an international organisation unless—
- (a) the three conditions set out in subsections (2) to (4) are met, and
- (b) in a case where the personal data was originally transmitted or otherwise made available to the controller or another competent authority by a member State other than the United Kingdom, that member State, or any person based in that member State which is a competent authority for the purposes of the Law Enforcement Directive, has authorised the transfer in accordance with the law of the member State.
- (2) Condition 1 is that the transfer is necessary for any of the law enforcement purposes.
- (3) Condition 2 is that the transfer—
- (a) is based on an adequacy decision (see section 74),
- (b) if not based on an adequacy decision, is based on there being appropriate safeguards (see section 75), or
- (c) if not based on an adequacy decision or on there being appropriate safeguards, is based on special circumstances (see section 76).
- (4) Condition 3 is that—
- (a) the intended recipient is a relevant authority in a third country or an international organisation that is a relevant international organisation, or
- (b) in a case where the controller is a competent authority specified in any of paragraphs 5 to 17, 21, 24 to 28, 34 to 51, 54 and 56 of Schedule 7—
- (i) the intended recipient is a person in a third country other than a relevant authority, and
- (ii) the additional conditions in section 77 are met.
- (5) Authorisation is not required as mentioned in subsection (1)(b) if—
- (a) the transfer is necessary for the prevention of an immediate and serious threat either to the public security of a member State or a third country or to the essential interests of a member State, and
- (b) the authorisation cannot be obtained in good time.
- (6) Where a transfer is made without the authorisation mentioned in subsection (1)(b), the authority in the member State which would have been responsible for deciding whether to authorise the transfer must be informed without delay.
- (7) In this section, “*relevant international organisation*” means an international organisation that carries out functions for any of the law enforcement purposes.
#### Transfers on the basis of an adequacy decision
##### 74
A transfer of personal data to a third country or an international organisation is based on an adequacy decision where—
- (a) the European Commission has decided, in accordance with Article 36 of the Law Enforcement Directive, that—
- (i) the third country or a territory or one or more specified sectors within that third country, or
- (ii) (as the case may be) the international organisation,
ensures an adequate level of protection of personal data, and
- (b) that decision has not been repealed or suspended, or amended in a way that demonstrates that the Commission no longer considers there to be an adequate level of protection of personal data.
#### Transfers on the basis of appropriate safeguards
##### 75
- (1) A transfer of personal data to a third country or an international organisation is based on there being appropriate safeguards where—
- (a) a legal instrument containing appropriate safeguards for the protection of personal data binds the intended recipient of the data, or
- (b) the controller, having assessed all the circumstances surrounding transfers of that type of personal data to the third country or international organisation, concludes that appropriate safeguards exist to protect the data.
- (2) The controller must inform the Commissioner about the categories of data transfers that take place in reliance on subsection (1)(b).
- (3) Where a transfer of data takes place in reliance on subsection (1)—
- (a) the transfer must be documented,
- (b) the documentation must be provided to the Commissioner on request, and
- (c) the documentation must include, in particular—
- (i) the date and time of the transfer,
- (ii) the name of and any other pertinent information about the recipient,
- (iii) the justification for the transfer, and
- (iv) a description of the personal data transferred.
#### Transfers on the basis of special circumstances
##### 76
- (1) A transfer of personal data to a third country or international organisation is based on special circumstances where the transfer is necessary—
- (a) to protect the vital interests of the data subject or another person,
- (b) to safeguard the legitimate interests of the data subject,
- (c) for the prevention of an immediate and serious threat to the public security of a member State or a third country,
- (d) in individual cases for any of the law enforcement purposes, or
- (e) in individual cases for a legal purpose.
- (2) But subsection (1)(d) and (e) do not apply if the controller determines that fundamental rights and freedoms of the data subject override the public interest in the transfer.
- (3) Where a transfer of data takes place in reliance on subsection (1)—
- (a) the transfer must be documented,
- (b) the documentation must be provided to the Commissioner on request, and
- (c) the documentation must include, in particular—
- (i) the date and time of the transfer,
- (ii) the name of and any other pertinent information about the recipient,
- (iii) the justification for the transfer, and
- (iv) a description of the personal data transferred.
- (4) For the purposes of this section, a transfer is necessary for a legal purpose if—
- (a) it is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings) relating to any of the law enforcement purposes,
- (b) it is necessary for the purpose of obtaining legal advice in relation to any of the law enforcement purposes, or
- (c) it is otherwise necessary for the purposes of establishing, exercising or defending legal rights in relation to any of the law enforcement purposes.
### Transfers to particular recipients
#### Transfers of personal data to persons other than relevant authorities
##### 77
- (1) The additional conditions referred to in section 73(4)(b)(ii) are the following four conditions.
- (2) Condition 1 is that the transfer is strictly necessary in a specific case for the performance of a task of the transferring controller as provided by law for any of the law enforcement purposes.
- (3) Condition 2 is that the transferring controller has determined that there are no fundamental rights and freedoms of the data subject concerned that override the public interest necessitating the transfer.
- (4) Condition 3 is that the transferring controller considers that the transfer of the personal data to a relevant authority in the third country would be ineffective or inappropriate (for example, where the transfer could not be made in sufficient time to enable its purpose to be fulfilled).
- (5) Condition 4 is that the transferring controller informs the intended recipient of the specific purpose or purposes for which the personal data may, so far as necessary, be processed.
- (6) Where personal data is transferred to a person in a third country other than a relevant authority, the transferring controller must inform a relevant authority in that third country without undue delay of the transfer, unless this would be ineffective or inappropriate.
- (7) The transferring controller must—
- (a) document any transfer to a recipient in a third country other than a relevant authority, and
- (b) inform the Commissioner about the transfer.
- (8) This section does not affect the operation of any international agreement in force between member States and third countries in the field of judicial co-operation in criminal matters and police co-operation.
### Subsequent transfers
#### Subsequent transfers
##### 78
- (1) Where personal data is transferred in accordance with section 73, the transferring controller must make it a condition of the transfer that the data is not to be further transferred to a third country or international organisation without the authorisation of the transferring controller or another competent authority.
- (2) A competent authority may give an authorisation under subsection (1) only where the further transfer is necessary for a law enforcement purpose.
- (3) In deciding whether to give the authorisation, the competent authority must take into account (among any other relevant factors)—
- (a) the seriousness of the circumstances leading to the request for authorisation,
- (b) the purpose for which the personal data was originally transferred, and
- (c) the standards for the protection of personal data that apply in the third country or international organisation to which the personal data would be transferred.
- (4) In a case where the personal data was originally transmitted or otherwise made available to the transferring controller or another competent authority by a member State other than the United Kingdom, an authorisation may not be given under subsection (1) unless that member State, or any person based in that member State which is a competent authority for the purposes of the Law Enforcement Directive, has authorised the transfer in accordance with the law of the member State.
- (5) Authorisation is not required as mentioned in subsection (4) if—
- (a) the transfer is necessary for the prevention of an immediate and serious threat either to the public security of a member State or a third country or to the essential interests of a member State, and
- (b) the authorisation cannot be obtained in good time.
- (6) Where a transfer is made without the authorisation mentioned in subsection (4), the authority in the member State which would have been responsible for deciding whether to authorise the transfer must be informed without delay.
### CHAPTER 6 — Supplementary
#### National security: certificate
##### 79
- (1) A Minister of the Crown may issue a certificate certifying, for the purposes of section 44(4), 45(4), 48(3) or 68(7), that a restriction is a necessary and proportionate measure to protect national security.
- (2) The certificate may—
- (a) relate to a specific restriction (described in the certificate) which a controller has imposed or is proposing to impose under section 44(4), 45(4), 48(3) or 68(7), or
- (b) identify any restriction to which it relates by means of a general description.
- (3) Subject to subsection (6), a certificate issued under subsection (1) is conclusive evidence that the specific restriction or (as the case may be) any restriction falling within the general description is, or at any time was, a necessary and proportionate measure to protect national security.
- (4) A certificate issued under subsection (1) may be expressed to have prospective effect.
- (5) Any person directly affected by the issuing of a certificate under subsection (1) may appeal to the Tribunal against the certificate.
- (6) If, on an appeal under subsection (5), the Tribunal finds that, applying the principles applied by a court on an application for judicial review, the Minister did not have reasonable grounds for issuing the certificate, the Tribunal may —
- (a) allow the appeal, and
- (b) quash the certificate.
- (7) Where in any proceedings under or by virtue of this Act, it is claimed by a controller that a restriction falls within a general description in a certificate issued under subsection (1), any other party to the proceedings may appeal to the Tribunal on the ground that the restriction does not fall within that description.
- (8) But, subject to any determination under subsection (9), the restriction is to be conclusively presumed to fall within the general description.
- (9) On an appeal under subsection (7), the Tribunal may determine that the certificate does not so apply.
- (10) A document purporting to be a certificate under subsection (1) is to be—
- (a) received in evidence, and
- (b) deemed to be such a certificate unless the contrary is proved.
- (11) A document which purports to be certified by or on behalf of a Minister of the Crown as a true copy of a certificate issued by that Minister under subsection (1) is—
- (a) in any legal proceedings, evidence of that certificate, and
- (b) in any legal proceedings in Scotland, sufficient evidence of that certificate.
- (12) The power conferred by subsection (1) on a Minister of the Crown is exercisable only by—
- (a) a Minister who is a member of the Cabinet, or
- (b) the Attorney General or the Advocate General for Scotland.
- (13) No power conferred by any provision of Part 6 may be exercised in relation to the imposition of—
- (a) a specific restriction in a certificate under subsection (1), or
- (b) a restriction falling within a general description in such a certificate.
#### Special processing restrictions
##### 80
- (1) Subsections (3) and (4) apply where, for a law enforcement purpose, a controller transmits or otherwise makes available personal data to an EU recipient or a non-EU recipient.
- (2) In this section—
- “*EU recipient*” means—a recipient in a member State other than the United Kingdom, oran agency, office or body established pursuant to Chapters 4 and 5 of Title V of the Treaty on the Functioning of the European Union;
- “*non-EU recipient*” means—a recipient in a third country, oran international organisation.
- (3) The controller must consider whether, if the personal data had instead been transmitted or otherwise made available within the United Kingdom to another competent authority, processing of the data by the other competent authority would have been subject to any restrictions by virtue of any enactment or rule of law.
- (4) Where that would be the case, the controller must inform the EU recipient or non-EU recipient that the data is transmitted or otherwise made available subject to compliance by that person with the same restrictions (which must be set out in the information given to that person).
- (5) Except as provided by subsection (4), the controller may not impose restrictions on the processing of personal data transmitted or otherwise made available by the controller to an EU recipient.
- (6) Subsection (7) applies where—
- (a) a competent authority for the purposes of the Law Enforcement Directive in a member State other than the United Kingdom transmits or otherwise makes available personal data to a controller for a law enforcement purpose, and
- (b) the competent authority in the other member State informs the controller, in accordance with any law of that member State which implements Article 9(3) and (4) of the Law Enforcement Directive, that the data is transmitted or otherwise made available subject to compliance by the controller with restrictions set out by the competent authority.
- (7) The controller must comply with the restrictions.
#### Reporting of infringements
##### 81
- (1) Each controller must implement effective mechanisms to encourage the reporting of an infringement of this Part.
- (2) The mechanisms implemented under subsection (1) must provide that an infringement may be reported to any of the following persons—
- (a) the controller;
- (b) the Commissioner.
- (3) The mechanisms implemented under subsection (1) must include—
- (a) raising awareness of the protections provided by Part 4A of the Employment Rights Act 1996 and Part 5A of the Employment Rights (Northern Ireland) Order 1996 (S.I. 1996/1919 (N.I. 16)), and
- (b) such other protections for a person who reports an infringement of this Part as the controller considers appropriate.
- (4) A person who reports an infringement of this Part does not breach—
- (a) an obligation of confidence owed by the person, or
- (b) any other restriction on the disclosure of information (however imposed).
- (5) Subsection (4) does not apply if or to the extent that the report includes a disclosure which is prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.
- (6) Until the repeal of Part 1 of the Regulation of Investigatory Powers Act 2000 by paragraphs 45 and 54 of Schedule 10 to the Investigatory Powers Act 2016 is fully in force, subsection (5) has effect as if it included a reference to that Part.
## PART 4 — Intelligence services processing
### CHAPTER 1 — Scope and definitions
### Scope
#### Processing to which this Part applies
##### 82
- (1) This Part applies to—
- (a) the processing by an intelligence service of personal data wholly or partly by automated means, and
- (b) the processing by an intelligence service otherwise than by automated means of personal data which forms part of a filing system or is intended to form part of a filing system.
- (2) In this Part, “*intelligence service*” means—
- (a) the Security Service;
- (b) the Secret Intelligence Service;
- (c) the Government Communications Headquarters.
- (3) A reference in this Part to the processing of personal data is to processing to which this Part applies.
### Definitions
#### Meaning of “controller” and “processor”
##### 83
- (1) In this Part, “*controller*” means the intelligence service which, alone or jointly with others—
- (a) determines the purposes and means of the processing of personal data, or
- (b) is the controller by virtue of subsection (2).
- (2) Where personal data is processed only—
- (a) for purposes for which it is required by an enactment to be processed, and
- (b) by means by which it is required by an enactment to be processed,
the intelligence service on which the obligation to process the data is imposed by the enactment (or, if different, one of the enactments) is the controller.
- (3) In this Part, “*processor*” means any person who processes personal data on behalf of the controller (other than a person who is an employee of the controller).
#### Other definitions
##### 84
- (1) This section defines other expressions used in this Part.
- (2) “*Consent*”, in relation to the processing of personal data relating to an individual, means a freely given, specific, informed and unambiguous indication of the individual's wishes by which the individual, by a statement or by a clear affirmative action, signifies agreement to the processing of the personal data.
- (3) “*Employee*”, in relation to any person, includes an individual who holds a position (whether paid or unpaid) under the direction and control of that person.
- (4) “*Personal data breach*” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.
- (5) “*Recipient*”, in relation to any personal data, means any person to whom the data is disclosed, whether a third party or not, but it does not include a person to whom disclosure is or may be made in the framework of a particular inquiry in accordance with the law.
- (6) “*Restriction of processing*” means the marking of stored personal data with the aim of limiting its processing for the future.
- (7) Sections 3 and 205 include definitions of other expressions used in this Part.
### CHAPTER 2 — Principles
### Overview
#### Overview
##### 85
- (1) This Chapter sets out the six data protection principles as follows—
- (a) section 86 sets out the first data protection principle (requirement that processing be lawful, fair and transparent);
- (b) section 87 sets out the second data protection principle (requirement that the purposes of processing be specified, explicit and legitimate);
- (c) section 88 sets out the third data protection principle (requirement that personal data be adequate, relevant and not excessive);
- (d) section 89 sets out the fourth data protection principle (requirement that personal data be accurate and kept up to date);
- (e) section 90 sets out the fifth data protection principle (requirement that personal data be kept for no longer than is necessary);
- (f) section 91 sets out the sixth data protection principle (requirement that personal data be processed in a secure manner).
- (2) Each of sections 86, 87 and 91 makes provision to supplement the principle to which it relates.
### The data protection principles
#### The first data protection principle
##### 86
- (1) The first data protection principle is that the processing of personal data must be—
- (a) lawful, and
- (b) fair and transparent.
- (2) The processing of personal data is lawful only if and to the extent that—
- (a) at least one of the conditions in Schedule 9 is met, and
- (b) in the case of sensitive processing, at least one of the conditions in Schedule 10 is also met.
- (3) The Secretary of State may by regulations amend Schedule 10—
- (a) by adding conditions;
- (b) by omitting conditions added by regulations under paragraph (a).
- (4) Regulations under subsection (3) are subject to the affirmative resolution procedure.
- (5) In determining whether the processing of personal data is fair and transparent, regard is to be had to the method by which it is obtained.
- (6) For the purposes of subsection (5), data is to be treated as obtained fairly and transparently if it consists of information obtained from a person who—
- (a) is authorised by an enactment to supply it, or
- (b) is required to supply it by an enactment or by an international obligation of the United Kingdom.
- (7) In this section, “*sensitive processing*” means—
- (a) the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership;
- (b) the processing of genetic data for the purpose of uniquely identifying an individual;
- (c) the processing of biometric data for the purpose of uniquely identifying an individual;
- (d) the processing of data concerning health;
- (e) the processing of data concerning an individual's sex life or sexual orientation;
- (f) the processing of personal data as to—
- (i) the commission or alleged commission of an offence by an individual, or
- (ii) proceedings for an offence committed or alleged to have been committed by an individual, the disposal of such proceedings or the sentence of a court in such proceedings.
#### The second data protection principle
##### 87
- (1) The second data protection principle is that—
- (a) the purpose for which personal data is collected on any occasion must be specified, explicit and legitimate, and
- (b) personal data so collected must not be processed in a manner that is incompatible with the purpose for which it is collected.
- (2) Paragraph (b) of the second data protection principle is subject to subsections (3) and (4).
- (3) Personal data collected by a controller for one purpose may be processed for any other purpose of the controller that collected the data or any purpose of another controller provided that—
- (a) the controller is authorised by law to process the data for that purpose, and
- (b) the processing is necessary and proportionate to that other purpose.
- (4) Processing of personal data is to be regarded as compatible with the purpose for which it is collected if the processing—
- (a) consists of—
- (i) processing for archiving purposes in the public interest,
- (ii) processing for the purposes of scientific or historical research, or
- (iii) processing for statistical purposes, and
- (b) is subject to appropriate safeguards for the rights and freedoms of the data subject.
#### The third data protection principle
##### 88
The third data protection principle is that personal data must be adequate, relevant and not excessive in relation to the purpose for which it is processed.
#### The fourth data protection principle
##### 89
The fourth data protection principle is that personal data undergoing processing must be accurate and, where necessary, kept up to date.
#### The fifth data protection principle
##### 90
The fifth data protection principle is that personal data must be kept for no longer than is necessary for the purpose for which it is processed.
#### The sixth data protection principle
##### 91
- (1) The sixth data protection principle is that personal data must be processed in a manner that includes taking appropriate security measures as regards risks that arise from processing personal data.
- (2) The risks referred to in subsection (1) include (but are not limited to) accidental or unauthorised access to, or destruction, loss, use, modification or disclosure of, personal data.
### CHAPTER 3 — Rights of the data subject
### Overview
#### Overview
##### 92
- (1) This Chapter sets out the rights of the data subject as follows—
- (a) section 93 deals with the information to be made available to the data subject;
- (b) sections 94 and 95 deal with the right of access by the data subject;
- (c) sections 96 and 97 deal with rights in relation to automated processing;
- (d) section 98 deals with the right to information about decision-making;
- (e) section 99 deals with the right to object to processing;
- (f) section 100 deals with rights to rectification and erasure of personal data.
- (2) In this Chapter, “*the controller*”, in relation to a data subject, means the controller in relation to personal data relating to the data subject.
### Rights
#### Right to information
##### 93
- (1) The controller must give a data subject the following information—
- (a) the identity and the contact details of the controller;
- (b) the legal basis on which, and the purposes for which, the controller processes personal data;
- (c) the categories of personal data relating to the data subject that are being processed;
- (d) the recipients or the categories of recipients of the personal data (if applicable);
- (e) the right to lodge a complaint with the Commissioner and the contact details of the Commissioner;
- (f) how to exercise rights under this Chapter;
- (g) any other information needed to secure that the personal data is processed fairly and transparently.
- (2) The controller may comply with subsection (1) by making information generally available, where the controller considers it appropriate to do so.
- (3) The controller is not required under subsection (1) to give a data subject information that the data subject already has.
- (4) Where personal data relating to a data subject is collected by or on behalf of the controller from a person other than the data subject, the requirement in subsection (1) has effect, in relation to the personal data so collected, with the following exceptions—
- (a) the requirement does not apply in relation to processing that is authorised by an enactment;
- (b) the requirement does not apply in relation to the data subject if giving the information to the data subject would be impossible or involve disproportionate effort.
#### Right of access
##### 94
- (1) An individual is entitled to obtain from a controller—
- (a) confirmation as to whether or not personal data concerning the individual is being processed, and
- (b) where that is the case—
- (i) communication, in intelligible form, of the personal data of which that individual is the data subject, and
- (ii) the information set out in subsection (2).
- (2) That information is—
- (a) the purposes of and legal basis for the processing;
- (b) the categories of personal data concerned;
- (c) the recipients or categories of recipients to whom the personal data has been disclosed;
- (d) the period for which the personal data is to be preserved;
- (e) the existence of a data subject's rights to rectification and erasure of personal data (see section 100);
- (f) the right to lodge a complaint with the Commissioner and the contact details of the Commissioner;
- (g) any information about the origin of the personal data concerned.
- (3) A controller is not obliged to provide information under this section unless the controller has received such reasonable fee as the controller may require, subject to subsection (4).
- (4) The Secretary of State may by regulations—
- (a) specify cases in which a controller may not charge a fee;
- (b) specify the maximum amount of a fee.
- (5) Where a controller—
- (a) reasonably requires further information—
- (i) in order that the controller be satisfied as to the identity of the individual making a request under subsection (1), or
- (ii) to locate the information which that individual seeks, and
- (b) has informed that individual of that requirement,
the controller is not obliged to comply with the request unless the controller is supplied with that further information.
- (6) Where a controller cannot comply with the request without disclosing information relating to another individual who can be identified from that information, the controller is not obliged to comply with the request unless—
- (a) the other individual has consented to the disclosure of the information to the individual making the request, or
- (b) it is reasonable in all the circumstances to comply with the request without the consent of the other individual.
- (7) In subsection (6), the reference to information relating to another individual includes a reference to information identifying that individual as the source of the information sought by the request.
- (8) Subsection (6) is not to be construed as excusing a controller from communicating so much of the information sought by the request as can be communicated without disclosing the identity of the other individual concerned, whether by the omission of names or other identifying particulars or otherwise.
- (9) In determining for the purposes of subsection (6)(b) whether it is reasonable in all the circumstances to comply with the request without the consent of the other individual concerned, regard must be had, in particular, to—
- (a) any duty of confidentiality owed to the other individual,
- (b) any steps taken by the controller with a view to seeking the consent of the other individual,
- (c) whether the other individual is capable of giving consent, and
- (d) any express refusal of consent by the other individual.
- (10) Subject to subsection (6), a controller must comply with a request under subsection (1)—
- (a) promptly, and
- (b) in any event before the end of the applicable time period.
- (11) If a court is satisfied on the application of an individual who has made a request under subsection (1) that the controller in question has failed to comply with the request in contravention of this section, the court may order the controller to comply with the request.
- (12) A court may make an order under subsection (11) in relation to a joint controller whose responsibilities are determined in an arrangement under section 104 only if the controller is responsible for compliance with the obligation to which the order relates.
- (13) The jurisdiction conferred on a court by this section is exercisable by the High Court or, in Scotland, by the Court of Session.
- (14) In this section—
- “*the applicable time period*” means—the period of 1 month, orsuch longer period, not exceeding 3 months, as may be specified in regulations made by the Secretary of State,beginning with the relevant time;
- “*the relevant time*”, in relation to a request under subsection (1), means the latest of the following—when the controller receives the request,when the fee (if any) is paid, andwhen the controller receives the information (if any) required under subsection (5) in connection with the request.
- (15) Regulations under this section are subject to the negative resolution procedure.
#### Right of access: supplementary
##### 95
- (1) The controller must comply with the obligation imposed by section 94(1)(b)(i) by supplying the data subject with a copy of the information in writing unless—
- (a) the supply of such a copy is not possible or would involve disproportionate effort, or
- (b) the data subject agrees otherwise;
and where any of the information referred to in section 94(1)(b)(i) is expressed in terms which are not intelligible without explanation the copy must be accompanied by an explanation of those terms.
- (2) Where a controller has previously complied with a request made under section 94 by an individual, the controller is not obliged to comply with a subsequent identical or similar request under that section by that individual unless a reasonable interval has elapsed between compliance with the previous request and the making of the current request.
- (3) In determining for the purposes of subsection (2) whether requests under section 94 are made at reasonable intervals, regard must be had to—
- (a) the nature of the data,
- (b) the purpose for which the data is processed, and
- (c) the frequency with which the data is altered.
- (4) The information to be supplied pursuant to a request under section 94 must be supplied by reference to the data in question at the time when the request is received, except that it may take account of any amendment or deletion made between that time and the time when the information is supplied, being an amendment or deletion that would have been made regardless of the receipt of the request.
- (5) For the purposes of section 94(6) to (8), an individual can be identified from information to be disclosed to a data subject by a controller if the individual can be identified from—
- (a) that information, or
- (b) that and any other information that the controller reasonably believes the data subject making the request is likely to possess or obtain.
#### Right not to be subject to automated decision-making
##### 96
- (1) The controller may not take a decision significantly affecting a data subject that is based solely on automated processing of personal data relating to the data subject.
- (2) Subsection (1) does not prevent such a decision being made on that basis if—
- (a) the decision is required or authorised by law,
- (b) the data subject has given consent to the decision being made on that basis, or
- (c) the decision is a decision taken in the course of steps taken—
- (i) for the purpose of considering whether to enter into a contract with the data subject,
- (ii) with a view to entering into such a contract, or
- (iii) in the course of performing such a contract.
- (3) For the purposes of this section, a decision that has legal effects as regards an individual is to be regarded as significantly affecting the individual.
#### Right to intervene in automated decision-making
##### 97
- (1) This section applies where—
- (a) the controller takes a decision significantly affecting a data subject that is based solely on automated processing of personal data relating to the data subject, and
- (b) the decision is required or authorised by law.
- (2) This section does not apply to such a decision if—
- (a) the data subject has given consent to the decision being made on that basis, or
- (b) the decision is a decision taken in the course of steps taken—
- (i) for the purpose of considering whether to enter into a contract with the data subject,
- (ii) with a view to entering into such a contract, or
- (iii) in the course of performing such a contract.
- (3) The controller must as soon as reasonably practicable notify the data subject that such a decision has been made.
- (4) The data subject may, before the end of the period of 1 month beginning with receipt of the notification, request the controller—
- (a) to reconsider the decision, or
- (b) to take a new decision that is not based solely on automated processing.
- (5) If a request is made to the controller under subsection (4), the controller must, before the end of the period of 1 month beginning with receipt of the request—
- (a) consider the request, including any information provided by the data subject that is relevant to it, and
- (b) by notice in writing inform the data subject of the outcome of that consideration.
- (6) For the purposes of this section, a decision that has legal effects as regards an individual is to be regarded as significantly affecting the individual.
#### Right to information about decision-making
##### 98
- (1) Where—
- (a) the controller processes personal data relating to a data subject, and
- (b) results produced by the processing are applied to the data subject,
the data subject is entitled to obtain from the controller, on request, knowledge of the reasoning underlying the processing.
- (2) Where the data subject makes a request under subsection (1), the controller must comply with the request without undue delay.
#### Right to object to processing
##### 99
- (1) A data subject is entitled at any time, by notice given to the controller, to require the controller—
- (a) not to process personal data relating to the data subject, or
- (b) not to process such data for a specified purpose or in a specified manner,
on the ground that, for specified reasons relating to the situation of the data subject, the processing in question is an unwarranted interference with the interests or rights of the data subject.
- (2) Where the controller—
- (a) reasonably requires further information—
- (i) in order that the controller be satisfied as to the identity of the individual giving notice under subsection (1), or
- (ii) to locate the data to which the notice relates, and
- (b) has informed that individual of that requirement,
the controller is not obliged to comply with the notice unless the controller is supplied with that further information.
- (3) The controller must, before the end of 21 days beginning with the relevant time, give a notice to the data subject—
- (a) stating that the controller has complied or intends to comply with the notice under subsection (1), or
- (b) stating the controller's reasons for not complying with the notice to any extent and the extent (if any) to which the controller has complied or intends to comply with the notice under subsection (1).
- (4) If the controller does not comply with a notice under subsection (1) to any extent, the data subject may apply to a court for an order that the controller take steps for complying with the notice.
- (5) If the court is satisfied that the controller should comply with the notice (or should comply to any extent), the court may order the controller to take such steps for complying with the notice (or for complying with it to that extent) as the court thinks fit.
- (6) A court may make an order under subsection (5) in relation to a joint controller whose responsibilities are determined in an arrangement under section 104 only if the controller is responsible for compliance with the obligation to which the order relates.
- (7) The jurisdiction conferred on a court by this section is exercisable by the High Court or, in Scotland, by the Court of Session.
- (8) In this section, “*the relevant time*”, in relation to a notice under subsection (1), means—
- (a) when the controller receives the notice, or
- (b) if later, when the controller receives the information (if any) required under subsection (2) in connection with the notice.
#### Rights to rectification and erasure
##### 100
- (1) If a court is satisfied on the application of a data subject that personal data relating to the data subject is inaccurate, the court may order the controller to rectify that data without undue delay.
- (2) If a court is satisfied on the application of a data subject that the processing of personal data relating to the data subject would infringe any of sections 86 to 91, the court may order the controller to erase that data without undue delay.
- (3) If personal data relating to the data subject must be maintained for the purposes of evidence, the court may (instead of ordering the controller to rectify or erase the personal data) order the controller to restrict its processing without undue delay.
- (4) If—
- (a) the data subject contests the accuracy of personal data, and
- (b) the court is satisfied that the controller is not able to ascertain whether the data is accurate or not,
the court may (instead of ordering the controller to rectify or erase the personal data) order the controller to restrict its processing without undue delay.
- (5) A court may make an order under this section in relation to a joint controller whose responsibilities are determined in an arrangement under section 104 only if the controller is responsible for carrying out the rectification, erasure or restriction of processing that the court proposes to order.
- (6) The jurisdiction conferred on a court by this section is exercisable by the High Court or, in Scotland, by the Court of Session.
### CHAPTER 4 — Controller and processor
### Overview
#### Overview
##### 101
This Chapter sets out—
- (a) the general obligations of controllers and processors (see sections 102 to 106);
- (b) specific obligations of controllers and processors with respect to security (see section 107);
- (c) specific obligations of controllers and processors with respect to personal data breaches (see section 108).
### General obligations
#### General obligations of the controller
##### 102
Each controller must implement appropriate measures—
- (a) to ensure, and
- (b) to be able to demonstrate, in particular to the Commissioner,
that the processing of personal data complies with the requirements of this Part.
#### Data protection by design
##### 103
- (1) Where a controller proposes that a particular type of processing of personal data be carried out by or on behalf of the controller, the controller must, prior to the processing, consider the impact of the proposed processing on the rights and freedoms of data subjects.
- (2) A controller must implement appropriate technical and organisational measures which are designed to ensure that—
- (a) the data protection principles are implemented, and
- (b) risks to the rights and freedoms of data subjects are minimised.
#### Joint controllers
##### 104
- (1) Where two or more intelligence services jointly determine the purposes and means of processing personal data, they are joint controllers for the purposes of this Part.
- (2) Joint controllers must, in a transparent manner, determine their respective responsibilities for compliance with this Part by means of an arrangement between them, except to the extent that those responsibilities are determined under or by virtue of an enactment.
- (3) The arrangement must designate the controller which is to be the contact point for data subjects.
#### Processors
##### 105
- (1) This section applies to the use by a controller of a processor to carry out processing of personal data on behalf of the controller.
- (2) The controller may use only a processor who undertakes—
- (a) to implement appropriate measures that are sufficient to secure that the processing complies with this Part;
- (b) to provide to the controller such information as is necessary for demonstrating that the processing complies with this Part.
- (3) If a processor determines, in breach of this Part, the purposes and means of processing, the processor is to be treated for the purposes of this Part as a controller in respect of that processing.
#### Processing under the authority of the controller or processor
##### 106
A processor, and any person acting under the authority of a controller or processor, who has access to personal data may not process the data except—
- (a) on instructions from the controller, or
- (b) to comply with a legal obligation.
### Obligations relating to security
#### Security of processing
##### 107
- (1) Each controller and each processor must implement security measures appropriate to the risks arising from the processing of personal data.
- (2) In the case of automated processing, each controller and each processor must, following an evaluation of the risks, implement measures designed to—
- (a) prevent unauthorised processing or unauthorised interference with the systems used in connection with it,
- (b) ensure that it is possible to establish the precise details of any processing that takes place,
- (c) ensure that any systems used in connection with the processing function properly and may, in the case of interruption, be restored, and
- (d) ensure that stored personal data cannot be corrupted if a system used in connection with the processing malfunctions.
### Obligations relating to personal data breaches
#### Communication of a personal data breach
##### 108
- (1) If a controller becomes aware of a serious personal data breach in relation to personal data for which the controller is responsible, the controller must notify the Commissioner of the breach without undue delay.
- (2) Where the notification to the Commissioner is not made within 72 hours, the notification must be accompanied by reasons for the delay.
- (3) Subject to subsection (4), the notification must include—
- (a) a description of the nature of the personal data breach including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
- (b) the name and contact details of the contact point from whom more information can be obtained;
- (c) a description of the likely consequences of the personal data breach;
- (d) a description of the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
- (4) Where and to the extent that it is not possible to provide all the information mentioned in subsection (3) at the same time, the information may be provided in phases without undue further delay.
- (5) If a processor becomes aware of a personal data breach (in relation to data processed by the processor), the processor must notify the controller without undue delay.
- (6) Subsection (1) does not apply in relation to a personal data breach if the breach also constitutes a relevant error within the meaning given by section 231(9) of the Investigatory Powers Act 2016.
- (7) For the purposes of this section, a personal data breach is serious if the breach seriously interferes with the rights and freedoms of a data subject.
### CHAPTER 5 — Transfers of personal data outside the United Kingdom
#### Transfers of personal data outside the United Kingdom
##### 109
- (1) A controller may not transfer personal data to—
- (a) a country or territory outside the United Kingdom, or
- (b) an international organisation,
unless the transfer falls within subsection (2).
- (2) A transfer of personal data falls within this subsection if the transfer is a necessary and proportionate measure carried out—
- (a) for the purposes of the controller's statutory functions, or
- (b) for other purposes provided for, in relation to the controller, in section 2(2)(a) of the Security Service Act 1989 or section 2(2)(a) or 4(2)(a) of the Intelligence Services Act 1994.
### CHAPTER 6 — Exemptions
#### National security
##### 110
- (1) A provision mentioned in subsection (2) does not apply to personal data to which this Part applies if exemption from the provision is required for the purpose of safeguarding national security.
- (2) The provisions are—
- (a) Chapter 2 (the data protection principles), except section 86(1)(a) and (2) and Schedules 9 and 10;
- (b) Chapter 3 (rights of data subjects);
- (c) in Chapter 4 , section 108 (communication of a personal data breach to the Commissioner);
- (d) in Part 5—
- (i) section 119 (inspection in accordance with international obligations);
- (ii) in Schedule 13 (other general functions of the Commissioner), paragraphs 1(a) and (g) and 2;
- (e) in Part 6—
- (i) sections 142 to 154 and Schedule 15 (Commissioner's notices and powers of entry and inspection);
- (ii) sections 170 to 173 (offences relating to personal data);
- (iii) sections 174 to 176 (provision relating to the special purposes).
#### National security: certificate
##### 111
- (1) Subject to subsection (3), a certificate signed by a Minister of the Crown certifying that exemption from all or any of the provisions mentioned in section 110(2) is, or at any time was, required for the purpose of safeguarding national security in respect of any personal data is conclusive evidence of that fact.
- (2) A certificate under subsection (1)—
- (a) may identify the personal data to which it applies by means of a general description, and
- (b) may be expressed to have prospective effect.
- (3) Any person directly affected by the issuing of a certificate under subsection (1) may appeal to the Tribunal against the certificate.
- (4) If on an appeal under subsection (3), the Tribunal finds that, applying the principles applied by a court on an application for judicial review, the Minister did not have reasonable grounds for issuing the certificate, the Tribunal may—
- (a) allow the appeal, and
- (b) quash the certificate.
- (5) Where, in any proceedings under or by virtue of this Act, it is claimed by a controller that a certificate under subsection (1) which identifies the personal data to which it applies by means of a general description applies to any personal data, another party to the proceedings may appeal to the Tribunal on the ground that the certificate does not apply to the personal data in question.
- (6) But, subject to any determination under subsection (7), the certificate is to be conclusively presumed so to apply.
- (7) On an appeal under subsection (5), the Tribunal may determine that the certificate does not so apply.
- (8) A document purporting to be a certificate under subsection (1) is to be—
- (a) received in evidence, and
- (b) deemed to be such a certificate unless the contrary is proved.
- (9) A document which purports to be certified by or on behalf of a Minister of the Crown as a true copy of a certificate issued by that Minister under subsection (1) is—
- (a) in any legal proceedings, evidence of that certificate, and
- (b) in any legal proceedings in Scotland, sufficient evidence of that certificate.
- (10) The power conferred by subsection (1) on a Minister of the Crown is exercisable only by—
- (a) a Minister who is a member of the Cabinet, or
- (b) the Attorney General or the Advocate General for Scotland.
#### Other exemptions
##### 112
Schedule 11 provides for further exemptions.
#### Power to make further exemptions
##### 113
- (1) The Secretary of State may by regulations amend Schedule 11—
- (a) by adding exemptions from any provision of this Part;
- (b) by omitting exemptions added by regulations under paragraph (a).
- (2) Regulations under this section are subject to the affirmative resolution procedure.
## PART 5 — The Information Commissioner
### The Commissioner
#### The Information Commissioner
##### 114
- (1) There is to continue to be an Information Commissioner.
- (2) Schedule 12 makes provision about the Commissioner.
### General functions
#### General functions under the GDPR and safeguards
##### 115
- (1) The Commissioner is to be the supervisory authority in the United Kingdom for the purposes of Article 51 of the GDPR.
- (2) General functions are conferred on the Commissioner by—
- (a) Article 57 of the GDPR (tasks), and
- (b) Article 58 of the GDPR (powers),
(and see also the Commissioner's duty under section 2).
- (3) The Commissioner's functions in relation to the processing of personal data to which the GDPR applies include—
- (a) a duty to advise Parliament, the government and other institutions and bodies on legislative and administrative measures relating to the protection of individuals' rights and freedoms with regard to the processing of personal data, and
- (b) a power to issue, on the Commissioner's own initiative or on request, opinions to Parliament, the government or other institutions and bodies as well as to the public on any issue related to the protection of personal data.
- (4) The Commissioner's functions under Article 58 of the GDPR are subject to the safeguards in subsections (5) to (9).
- (5) The Commissioner's power under Article 58(1)(a) of the GDPR (power to require a controller or processor to provide information that the Commissioner requires for the performance of the Commissioner's tasks under the GDPR) is exercisable only by giving an information notice under section 142.
- (6) The Commissioner's power under Article 58(1)(b) of the GDPR (power to carry out data protection audits) is exercisable only in accordance with section 146.
- (7) The Commissioner's powers under Article 58(1)(e) and (f) of the GDPR (power to obtain information from controllers and processors and access to their premises) are exercisable only—
- (a) in accordance with Schedule 15 (see section 154), or
- (b) to the extent that they are exercised in conjunction with the power under Article 58(1)(b) of the GDPR, in accordance with section 146.
- (8) The following powers are exercisable only by giving an enforcement notice under section 149—
- (a) the Commissioner's powers under Article 58(2)(c) to (g) and (j) of the GDPR (certain corrective powers);
- (b) the Commissioner's powers under Article 58(2)(h) to order a certification body to withdraw, or not to issue, a certification under Articles 42 and 43 of the GDPR.
- (9) The Commissioner's powers under Articles 58(2)(i) and 83 of the GDPR (administrative fines) are exercisable only by giving a penalty notice under section 155.
- (10) This section is without prejudice to other functions conferred on the Commissioner, whether by the GDPR, this Act or otherwise.
#### Other general functions
##### 116
- (1) The Commissioner—
- (a) is to be the supervisory authority in the United Kingdom for the purposes of Article 41 of the Law Enforcement Directive, and
- (b) is to continue to be the designated authority in the United Kingdom for the purposes of Article 13 of the Data Protection Convention.
- (2) Schedule 13 confers general functions on the Commissioner in connection with processing to which the GDPR does not apply (and see also the Commissioner's duty under section 2).
- (3) This section and Schedule 13 are without prejudice to other functions conferred on the Commissioner, whether by this Act or otherwise.
#### Competence in relation to courts etc
##### 117
Nothing in this Act permits or requires the Commissioner to exercise functions in relation to the processing of personal data by—
- (a) an individual acting in a judicial capacity, or
- (b) a court or tribunal acting in its judicial capacity,
(and see also Article 55(3) of the GDPR).
### International role
#### Co-operation and mutual assistance
##### 118
- (1) Articles 60 to 62 of the GDPR confer functions on the Commissioner in relation to co-operation and mutual assistance between, and joint operations of, supervisory authorities under the GDPR.
- (2) References to the GDPR in subsection (1) do not include the applied GDPR.
- (3) Article 61 of the applied GDPR confers functions on the Commissioner in relation to co-operation with other supervisory authorities (as defined in Article 4(21) of the applied GDPR).
- (4) Part 1 of Schedule 14 makes provision as to the functions to be carried out by the Commissioner for the purposes of Article 50 of the Law Enforcement Directive (mutual assistance).
- (5) Part 2 of Schedule 14 makes provision as to the functions to be carried out by the Commissioner for the purposes of Article 13 of the Data Protection Convention (co-operation between parties).
#### Inspection of personal data in accordance with international obligations
##### 119
- (1) The Commissioner may inspect personal data where the inspection is necessary in order to discharge an international obligation of the United Kingdom, subject to the restriction in subsection (2).
- (2) The power under subsection (1) is exercisable only if the personal data—
- (a) is processed wholly or partly by automated means, or
- (b) is processed otherwise than by automated means and forms part of a filing system or is intended to form part of a filing system.
- (3) The power under subsection (1) includes power to inspect, operate and test equipment which is used for the processing of personal data.
- (4) Before exercising the power under subsection (1), the Commissioner must by written notice inform the controller and any processor that the Commissioner intends to do so.
- (5) Subsection (4) does not apply if the Commissioner considers that the case is urgent.
- (6) It is an offence—
- (a) intentionally to obstruct a person exercising the power under subsection (1), or
- (b) to fail without reasonable excuse to give a person exercising that power any assistance the person may reasonably require.
- (7) Paragraphs (c) and (d) of section 3(14) do not apply to references in this section to personal data, the processing of personal data, a controller or a processor.
#### Further international role
##### 120
- (1) The Commissioner must, in relation to third countries and international organisations, take appropriate steps to—
- (a) develop international co-operation mechanisms to facilitate the effective enforcement of legislation for the protection of personal data;
- (b) provide international mutual assistance in the enforcement of legislation for the protection of personal data, subject to appropriate safeguards for the protection of personal data and other fundamental rights and freedoms;
- (c) engage relevant stakeholders in discussion and activities aimed at furthering international co-operation in the enforcement of legislation for the protection of personal data;
- (d) promote the exchange and documentation of legislation and practice for the protection of personal data, including legislation and practice relating to jurisdictional conflicts with third countries.
- (2) Subsection (1) applies only in connection with the processing of personal data to which the GDPR does not apply; for the equivalent duty in connection with the processing of personal data to which the GDPR applies, see Article 50 of the GDPR (international co-operation for the protection of personal data).
- (3) The Commissioner must carry out data protection functions which the Secretary of State directs the Commissioner to carry out for the purpose of enabling Her Majesty's Government in the United Kingdom to give effect to an international obligation of the United Kingdom.
- (4) The Commissioner may provide an authority carrying out data protection functions under the law of a British overseas territory with assistance in carrying out those functions.
- (5) The Secretary of State may direct that assistance under subsection (4) is to be provided on terms, including terms as to payment, specified or approved by the Secretary of State.
#### Interpretation of Part 6
##### 181
In this Part—
- “*assessment notice*” has the meaning given in section 146;
- “*certification provider*” has the meaning given in section 17;
- “*enforcement notice*” has the meaning given in section 149;
- “*information notice*” has the meaning given in section 142;
- “*penalty notice*” has the meaning given in section 155;
- “*penalty variation notice*” has the meaning given in Schedule 16;
- “*representative*”, in relation to a controller or processor, means a person designated by the controller or processor under Article 27 of the UK GDPR to represent the controller or processor with regard to the controller's or processor's obligations under the UK GDPR.
## PART 7 — Supplementary and final provision
### Regulations under this Act
#### Regulations and consultation
##### 182
- (1) Regulations under this Act are to be made by statutory instrument.
- (2) Before making regulations under this Act, the Secretary of State must consult—
- (a) the Commissioner, and
- (b) such other persons as the Secretary of State considers appropriate.
- (3) Subsection (2) does not apply to regulations made under—
- (a) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (b) section 30;
- (c) section 211;
- (d) section 212;
- (e) section 213;
- (f) paragraph 15 of Schedule 2.
- (4) Subsection (2) does not apply to regulations made under section 18 where the Secretary of State has made an urgency statement in respect of them.
- (5) Regulations under this Act may—
- (a) make different provision for different purposes;
- (b) include consequential, supplementary, incidental, transitional, transitory or saving provision.
- (6) Where regulations under this Act are subject to “the negative resolution procedure” the statutory instrument containing the regulations is subject to annulment in pursuance of a resolution of either House of Parliament.
- (7) Where regulations under this Act are subject to “the affirmative resolution procedure” the regulations may not be made unless a draft of the statutory instrument containing them has been laid before Parliament and approved by a resolution of each House of Parliament.
- (8) Where regulations under this Act are subject to “the made affirmative resolution procedure”—
- (a) the statutory instrument containing the regulations must be laid before Parliament after being made, together with the urgency statement in respect of them, and
- (b) the regulations cease to have effect at the end of the period of 120 days beginning with the day on which the instrument is made, unless within that period the instrument is approved by a resolution of each House of Parliament.
- (9) In calculating the period of 120 days, no account is to be taken of any time during which—
- (a) Parliament is dissolved or prorogued, or
- (b) both Houses of Parliament are adjourned for more than 4 days.
- (10) Where regulations cease to have effect as a result of subsection (8), that does not—
- (a) affect anything previously done under the regulations, or
- (b) prevent the making of new regulations.
- (11) Any provision that may be included in regulations under this Act subject to the negative resolution procedure may be made by regulations subject to the affirmative resolution procedure or the made affirmative resolution procedure.
- (12) If a draft of a statutory instrument containing regulations under section 7 would, apart from this subsection, be treated for the purposes of the standing orders of either House of Parliament as a hybrid instrument, it is to proceed in that House as if it were not such an instrument.
- (13) A requirement under a provision of this Act to consult may be satisfied by consultation before, as well as by consultation after, the provision comes into force.
- (14) In this section, “*urgency statement*” has the meaning given in section 18(4).
### Changes to the Data Protection Convention
#### Power to reflect changes to the Data Protection Convention
##### 183
- (1) The Secretary of State may by regulations make such provision as the Secretary of State considers necessary or appropriate in connection with an amendment of, or an instrument replacing, the Data Protection Convention which has effect, or is expected to have effect, in the United Kingdom.
- (2) The power under subsection (1) includes power—
- (a) to amend or replace the definition of “the Data Protection Convention” in section 3;
- (b) to amend Chapter 3 of Part 2 of this Act;
- (c) to amend Part 4 of this Act;
- (d) to make provision about the functions of the Commissioner, courts or tribunals in connection with relevant processing of personal data, including provision amending Parts 5 to 7 of this Act;
- (e) to make provision about the functions of the Commissioner in connection with the Data Protection Convention or an instrument replacing that Convention, including provision amending Parts 5 to 7 of this Act;
- (f) to consequentially amend this Act.
- (2A) In subsection (2)(d), “*relevant processing of personal data*” means—
- (a) processing of personal data described in Article 2(1)(a) or (b) or (1A) of the UK GDPR, and
- (b) processing of personal data to which Part 4 of this Act applies.
- (3) Regulations under this section are subject to the affirmative resolution procedure.
- (4) Regulations under this section may not be made after the end of the period of 3 years beginning with the day on which this Act is passed.
### Rights of the data subject
#### Prohibition of requirement to produce relevant records
##### 184
- (1) It is an offence for a person (“P1”) to require another person to provide P1 with, or give P1 access to, a relevant record in connection with—
- (a) the recruitment of an employee by P1,
- (b) the continued employment of a person by P1, or
- (c) a contract for the provision of services to P1.
- (2) It is an offence for a person (“P2”) to require another person to provide P2 with, or give P2 access to, a relevant record if—
- (a) P2 is involved in the provision of goods, facilities or services to the public or a section of the public, and
- (b) the requirement is a condition of providing or offering to provide goods, facilities or services to the other person or to a third party.
- (3) It is a defence for a person charged with an offence under subsection (1) or (2) to prove that imposing the requirement—
- (a) was required or authorised by an enactment, by a rule of law or by the order of a court or tribunal, or
- (b) in the particular circumstances, was justified as being in the public interest.
- (4) The imposition of the requirement referred to in subsection (1) or (2) is not to be regarded as justified as being in the public interest on the ground that it would assist in the prevention or detection of crime, given Part 5 of the Police Act 1997 (certificates of criminal records etc).
- (5) In subsections (1) and (2), the references to a person who requires another person to provide or give access to a relevant record include a person who asks another person to do so—
- (a) knowing that, in the circumstances, it would be reasonable for the other person to feel obliged to comply with the request, or
- (b) being reckless as to whether, in the circumstances, it would be reasonable for the other person to feel obliged to comply with the request,
and the references to a “requirement” in subsections (3) and (4) are to be interpreted accordingly.
- (6) In this section—
- “*data protection functions*” means functions relating to the protection of individuals with respect to the processing of personal data;
- “*mutual assistance in the enforcement of legislation for the protection of personal data*” includes assistance in the form of notification, complaint referral, investigative assistance and information exchange;
- “*third country*” means a country or territory that is not a member State.
- (7) Section 3(14)(c) does not apply to references to personal data and the processing of personal data in this section.
### Codes of practice
#### Data-sharing code
##### 121
- (1) The Commissioner must prepare a code of practice which contains—
- (a) practical guidance in relation to the sharing of personal data in accordance with the requirements of the data protection legislation, and
- (b) such other guidance as the Commissioner considers appropriate to promote good practice in the sharing of personal data.
- (2) Where a code under this section is in force, the Commissioner may prepare amendments of the code or a replacement code.
- (3) Before preparing a code or amendments under this section, the Commissioner must consult the Secretary of State and such of the following as the Commissioner considers appropriate—
- (a) trade associations;
- (b) data subjects;
- (c) persons who appear to the Commissioner to represent the interests of data subjects.
- (4) A code under this section may include transitional provision or savings.
- (5) In this section—
- “*good practice in the sharing of personal data*” means such practice in the sharing of personal data as appears to the Commissioner to be desirable having regard to the interests of data subjects and others, including compliance with the requirements of the data protection legislation;
- “*the sharing of personal data*” means the disclosure of personal data by transmission, dissemination or otherwise making it available;
- “*trade association*” includes a body representing controllers or processors.
#### Direct marketing code
##### 122
- (1) The Commissioner must prepare a code of practice which contains—
- (a) practical guidance in relation to the carrying out of direct marketing in accordance with the requirements of the data protection legislation and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426), and
- (b) such other guidance as the Commissioner considers appropriate to promote good practice in direct marketing.
- (2) Where a code under this section is in force, the Commissioner may prepare amendments of the code or a replacement code.
- (3) Before preparing a code or amendments under this section, the Commissioner must consult the Secretary of State and such of the following as the Commissioner considers appropriate—
- (a) trade associations;
- (b) data subjects;
- (c) persons who appear to the Commissioner to represent the interests of data subjects.
- (4) A code under this section may include transitional provision or savings.
- (5) In this section—
- “*direct marketing*” means the communication (by whatever means) of advertising or marketing material which is directed to particular individuals;
- “*good practice in direct marketing*” means such practice in direct marketing as appears to the Commissioner to be desirable having regard to the interests of data subjects and others, including compliance with the requirements mentioned in subsection (1)(a);
- “*trade association*” includes a body representing controllers or processors.
#### Age-appropriate design code
##### 123
- (1) The Commissioner must prepare a code of practice which contains such guidance as the Commissioner considers appropriate on standards of age-appropriate design of relevant information society services which are likely to be accessed by children.
- (2) Where a code under this section is in force, the Commissioner may prepare amendments of the code or a replacement code.
- (3) Before preparing a code or amendments under this section, the Commissioner must consult the Secretary of State and such other persons as the Commissioner considers appropriate, including—
- (a) children,
- (b) parents,
- (c) persons who appear to the Commissioner to represent the interests of children,
- “*employment*” means any employment, including—work under a contract for services or as an office-holder,work under an apprenticeship,work experience as part of a training course or in the course of training for employment, andvoluntary work,and “employee” is to be interpreted accordingly;
- “*relevant record*” has the meaning given in Schedule 18 and references to a relevant record include—a part of such a record, anda copy of, or of part of, such a record.
#### Avoidance of certain contractual terms relating to health records
##### 185
- (1) A term or condition of a contract is void in so far as it purports to require an individual to supply another person with a record which—
- (a) consists of the information contained in a health record, and
- (b) has been or is to be obtained by a data subject in the exercise of a data subject access right.
- (2) A term or condition of a contract is also void in so far as it purports to require an individual to produce such a record to another person.
- (3) The references in subsections (1) and (2) to a record include a part of a record and a copy of all or part of a record.
- (4) In this section, “*data subject access right*” means a right under—
- (a) Article 15 of the UK GDPR (right of access by the data subject);
- (b) Article 20 of the UK GDPR (right to data portability);
- (c) section 45 of this Act (law enforcement processing: right of access by the data subject);
- (d) section 94 of this Act (intelligence services processing: right of access by the data subject).
#### Data subject’s rights and other prohibitions and restrictions
##### 186
- (1) An enactment or rule of law prohibiting or restricting the disclosure of information, or authorising the withholding of information, does not remove or restrict the obligations and rights provided for in the provisions listed in subsection (2), except as provided by or under the provisions listed in subsection (3).
- (2) The provisions providing obligations and rights are—
- (a) Chapter III of the UK GDPR (rights of the data subject),
- (b) Chapter 3 of Part 3 of this Act (law enforcement processing: rights of the data subject), and
- (c) Chapter 3 of Part 4 of this Act (intelligence services processing: rights of the data subject).
- (3) The provisions providing exceptions are—
- (a) in Chapter 2 of Part 2 of this Act, sections 15 and 16 and Schedules 2, 3 and 4,
- (b) in Chapter 3 of Part 2 of this Act, sections ... 24, 25 and 26,
- (c) in Part 3 of this Act, sections 44(4), 45(4) and 48(3), and
- (d) in Part 4 of this Act, Chapter 6 .
### Representation of data subjects
#### Representation of data subjects with their authority
##### 187
- (1) In relation to the processing of personal data to which the UK GDPR applies, Article 80(1) of the UK GDPR (representation of data subjects)—
- (a) ... enables a data subject to authorise a body or other organisation which meets the conditions set out in subsections (3) and (4) to exercise the data subject's rights under Articles 77, 78 and 79 of the UK GDPR (rights to lodge complaints and to an effective judicial remedy) on the data subject's behalf, and
- (b) also authorises such a body or organisation to exercise the data subject's rights under Article 82 of the UK GDPR (right to compensation).
- (2) In relation to the processing of personal data to which the UK GDPR does not apply, a body or other organisation which meets the conditions in subsections (3) and (4), if authorised to do so by a data subject, may exercise some or all of the following rights of a data subject on the data subject's behalf—
- (a) rights under section 165(2) and (4)(d) (complaints to the Commissioner);
- (b) rights under section 166(2) (orders for the Commissioner to progress complaints);
- (c) rights under section 167(1) (compliance orders);
- (d) the right to bring judicial review proceedings against the Commissioner.
- (3) The first condition is that the body or organisation, by virtue of its constitution or an enactment—
- (a) is required (after payment of outgoings) to apply the whole of its income and any capital it expends for charitable or public purposes,
- (b) is prohibited from directly or indirectly distributing amongst its members any part of its assets (otherwise than for charitable or public purposes), and
- (c) has objectives which are in the public interest.
- (4) The second condition is that the body or organisation is active in the field of protection of data subjects' rights and freedoms with regard to the protection of their personal data.
- (5) In this Act, references to a “*representative body*”, in relation to a right of a data subject, are to a body or other organisation authorised to exercise the right on the data subject's behalf under Article 80 of the UK GDPR or this section.
#### Representation of data subjects with their authority: collective proceedings
##### 188
- (1) The Secretary of State may by regulations make provision for representative bodies to bring proceedings before a court or tribunal in England and Wales or Northern Ireland combining two or more relevant claims.
- (2) In this section, “*relevant claim*”, in relation to a representative body, means a claim in respect of a right of a data subject which the representative body is authorised to exercise on the data subject's behalf under Article 80(1) of the UK GDPR or section 187.
- (3) The power under subsection (1) includes power—
- (a) to make provision about the proceedings;
- (b) to confer functions on a person, including functions involving the exercise of a discretion;
- (c) to make different provision in relation to England and Wales and in relation to Northern Ireland.
- (4) The provision mentioned in subsection (3)(a) includes provision about—
- (a) the effect of judgments and orders;
- (b) agreements to settle claims;
- (c) the assessment of the amount of compensation;
- (d) the persons to whom compensation may or must be paid, including compensation not claimed by the data subject;
- (e) costs.
- (5) Regulations under this section are subject to the negative resolution procedure.
#### Duty to review provision for representation of data subjects
##### 189
- (1) Before the end of the review period, the Secretary of State must—
- (a) review the matters listed in subsection (2) in relation to England and Wales and Northern Ireland,
- (b) prepare a report of the review, and
- (c) lay a copy of the report before Parliament.
- (2) Those matters are—
- (a) the operation of Article 80(1) of the UK GDPR,
- (b) the operation of section 187,
- (c) the merits of exercising the power under Article 80(2) of the UK GDPR (power to enable a body or other organisation which meets the conditions in Article 80(1) of the UK GDPR to exercise some or all of a data subject's rights under Articles 77, 78 and 79 of the UK GDPR without being authorised to do so by the data subject),
- (d) the merits of making equivalent provision in relation to data subjects' rights under Article 82 of the UK GDPR (right to compensation), and
- (e) the merits of making provision for a children's rights organisation to exercise some or all of a data subject's rights under Articles 77, 78, 79 and 82 of the UK GDPR on behalf of a data subject who is a child, with or without being authorised to do so by the data subject.
- (3) “The review period” is the period of 30 months beginning when section 187 comes into force.
- (4) In carrying out the review, the Secretary of State must—
- (a) consider the particular needs of children separately from the needs of adults,
- (b) have regard to the fact that children have different needs at different stages of development,
- (c) carry out an analysis of the particular challenges that children face in authorising, and deciding whether to authorise, other persons to act on their behalf under Article 80(1) of the UK GDPR or section 187,
- (d) consider the support and advice available to children in connection with the exercise of their rights under Articles 77, 78, 79 and 82 of the UK GDPR by another person on their behalf and the merits of making available other support or advice, and
- (e) have regard to the United Kingdom's obligations under the United Nations Convention on the Rights of the Child.
- (5) Before preparing the report under subsection (1), the Secretary of State must consult the Commissioner and such other persons as the Secretary of State considers appropriate, including—
- (a) persons active in the field of protection of data subjects' rights and freedoms with regard to the protection of their personal data,
- (b) children and parents,
- (c) children's rights organisations and other persons who appear to the Secretary of State to represent the interests of children,
- (d) child development experts, and
- (e) trade associations.
- (4) In preparing a code or amendments under this section, the Commissioner must have regard—
- (a) to the fact that children have different needs at different ages, and
- (b) to the United Kingdom's obligations under the United Nations Convention on the Rights of the Child.
- (5) A code under this section may include transitional provision or savings.
- (6) Any transitional provision included in the first code under this section must cease to have effect before the end of the period of 12 months beginning when the code comes into force.
- (7) In this section—
- “*age-appropriate design*” means the design of services so that they are appropriate for use by, and meet the development needs of, children;
- “*information society services*” has the same meaning as in the GDPR, but does not include preventive or counselling services;
- “*relevant information society services*” means information society services which involve the processing of personal data to which the GDPR applies;
- “*standards of age-appropriate design of relevant information society services*” means such standards of age-appropriate design of such services as appear to the Commissioner to be desirable having regard to the best interests of children;
- (6) In this section—
- “*children's rights organisation*” means a body or other organisation which—is active in representing the interests of children, andhas objectives which are in the public interest;
- “*trade association*” includes a body representing controllers or processors;
- “*the United Nations Convention on the Rights of the Child*” means the Convention on the Rights of the Child adopted by the General Assembly of the United Nations on 20 November 1989 (including any Protocols to that Convention which are in force in relation to the United Kingdom), subject to any reservations, objections or interpretative declarations by the United Kingdom for the time being in force.
#### Data protection and journalism code
##### 124
- (1) The Commissioner must prepare a code of practice which contains—
- (a) practical guidance in relation to the processing of personal data for the purposes of journalism in accordance with the requirements of the data protection legislation, and
- (b) such other guidance as the Commissioner considers appropriate to promote good practice in the processing of personal data for the purposes of journalism.
- (2) Where a code under this section is in force, the Commissioner may prepare amendments of the code or a replacement code.
- (3) Before preparing a code or amendments under this section, the Commissioner must consult such of the following as the Commissioner considers appropriate—
- (a) trade associations;
- (b) data subjects;
- (c) persons who appear to the Commissioner to represent the interests of data subjects.
- (4) A code under this section may include transitional provision or savings.
- (5) In this section—
- “*good practice in the processing of personal data for the purposes of journalism*” means such practice in the processing of personal data for those purposes as appears to the Commissioner to be desirable having regard to—the interests of data subjects and others, including compliance with the requirements of the data protection legislation, andthe special importance of the public interest in the freedom of expression and information;
- “*trade association*” includes a body representing controllers or processors.
#### Approval of codes prepared under sections 121 to 124
##### 125
- (1) When a code is prepared under section 121, 122, 123 or 124—
- (a) the Commissioner must submit the final version to the Secretary of State, and
- (b) the Secretary of State must lay the code before Parliament.
- (2) In relation to the first code under section 123—
- (a) the Commissioner must prepare the code as soon as reasonably practicable and must submit it to the Secretary of State before the end of the period of 18 months beginning when this Act is passed, and
- (b) the Secretary of State must lay it before Parliament as soon as reasonably practicable.
- (3) If, within the 40-day period, either House of Parliament resolves not to approve a code prepared under section 121, 122, 123 or 124, the Commissioner must not issue the code.
- (4) If no such resolution is made within that period—
- (a) the Commissioner must issue the code, and
- (b) the code comes into force at the end of the period of 21 days beginning with the day on which it is issued.
- (5) If, as a result of subsection (3), there is no code in force under section 121, 122, 123 or 124, the Commissioner must prepare another version of the code.
- (6) Nothing in subsection (3) prevents another version of the code being laid before Parliament.
- (7) In this section, “*the 40-day period*” means—
- (a) if the code is laid before both Houses of Parliament on the same day, the period of 40 days beginning with that day, or
- (b) if the code is laid before the Houses of Parliament on different days, the period of 40 days beginning with the later of those days.
- (8) In calculating the 40-day period, no account is to be taken of any period during which Parliament is dissolved or prorogued or during which both Houses of Parliament are adjourned for more than 4 days.
- (9) This section, other than subsections (2) and (5), applies in relation to amendments prepared under section 121, 122, 123 or 124 as it applies in relation to codes prepared under those sections.
#### Publication and review of codes issued under section 125(4)
##### 126
- (1) The Commissioner must publish a code issued under section 125(4).
- (2) Where an amendment of a code is issued under section 125(4), the Commissioner must publish—
- (a) the amendment, or
- (b) the code as amended by it.
- (3) The Commissioner must keep under review each code issued under section 125(4) for the time being in force.
- (4) Where the Commissioner becomes aware that the terms of such a code could result in a breach of an international obligation of the United Kingdom, the Commissioner must exercise the power under section 121(2), 122(2), 123(2) or 124(2) with a view to remedying the situation.
#### Effect of codes issued under section 125(4)
##### 127
- (1) A failure by a person to act in accordance with a provision of a code issued under section 125(4) does not of itself make that person liable to legal proceedings in a court or tribunal.
- (2) A code issued under section 125(4), including an amendment or replacement code, is admissible in evidence in legal proceedings.
- (3) In any proceedings before a court or tribunal, the court or tribunal must take into account a provision of a code issued under section 125(4) in determining a question arising in the proceedings if—
- (a) the question relates to a time when the provision was in force, and
- (b) the provision appears to the court or tribunal to be relevant to the question.
- (4) Where the Commissioner is carrying out a function described in subsection (5), the Commissioner must take into account a provision of a code issued under section 125(4) in determining a question arising in connection with the carrying out of the function if—
- (a) the question relates to a time when the provision was in force, and
- (b) the provision appears to the Commissioner to be relevant to the question.
- (5) Those functions are functions under—
- (a) the data protection legislation, or
- (b) the Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426).
#### Other codes of practice
##### 128
- (1) The Secretary of State may by regulations require the Commissioner—
- (a) to prepare appropriate codes of practice giving guidance as to good practice in the processing of personal data, and
- (b) to make them available to such persons as the Commissioner considers appropriate.
- (2) Before preparing such codes, the Commissioner must consult such of the following as the Commissioner considers appropriate—
- (a) trade associations;
- (b) data subjects;
- (c) persons who appear to the Commissioner to represent the interests of data subjects.
- (3) Regulations under this section—
- (a) must describe the personal data or processing to which the code of practice is to relate, and
- (b) may describe the persons or classes of person to whom it is to relate.
- (4) Regulations under this section are subject to the negative resolution procedure.
- (5) In this section—
- “*good practice in the processing of personal data*” means such practice in the processing of personal data as appears to the Commissioner to be desirable having regard to the interests of data subjects and others, including compliance with the requirements of the data protection legislation;
- “*trade association*” includes a body representing controllers or processors.
### Consensual audits
#### Consensual audits
##### 129
- (1) The Commissioner's functions under Article 58(1) of the GDPR and paragraph 1 of Schedule 13 include power, with the consent of a controller or processor, to carry out an assessment of whether the controller or processor is complying with good practice in the processing of personal data.
- (2) The Commissioner must inform the controller or processor of the results of such an assessment.
- (3) In this section, “*good practice in the processing of personal data*” has the same meaning as in section 128.
### Records of national security certificates
#### Records of national security certificates
##### 130
- (1) A Minister of the Crown who issues a certificate under section 27, 79 or 111 must send a copy of the certificate to the Commissioner.
- (2) If the Commissioner receives a copy of a certificate under subsection (1), the Commissioner must publish a record of the certificate.
- (3) The record must contain—
- (a) the name of the Minister who issued the certificate,
- (b) the date on which the certificate was issued, and
- (c) subject to subsection (4), the text of the certificate.
- (4) The Commissioner must not publish the text, or a part of the text, of the certificate if—
- (a) the Minister determines that publishing the text or that part of the text—
- (i) would be against the interests of national security,
- (ii) would be contrary to the public interest, or
- (iii) might jeopardise the safety of any person, and
- (b) the Minister has notified the Commissioner of that determination.
- (5) The Commissioner must keep the record of the certificate available to the public while the certificate is in force.
- (6) If a Minister of the Crown revokes a certificate issued under section 27, 79 or 111, the Minister must notify the Commissioner.
### Information provided to the Commissioner
#### Disclosure of information to the Commissioner
##### 131
- (1) No enactment or rule of law prohibiting or restricting the disclosure of information precludes a person from providing the Commissioner with information necessary for the discharge of the Commissioner's functions.
- (2) But this section does not authorise the making of a disclosure which is prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.
- (3) Until the repeal of Part 1 of the Regulation of Investigatory Powers Act 2000 by paragraphs 45 and 54 of Schedule 10 to the Investigatory Powers Act 2016 is fully in force, subsection (2) has effect as if it included a reference to that Part.
#### Confidentiality of information
##### 132
- (1) A person who is or has been the Commissioner, or a member of the Commissioner's staff or an agent of the Commissioner, must not disclose information which—
- (a) has been obtained by, or provided to, the Commissioner in the course of, or for the purposes of, the discharging of the Commissioner's functions,
- (b) relates to an identified or identifiable individual or business, and
- (c) is not available to the public from other sources at the time of the disclosure and has not previously been available to the public from other sources,
unless the disclosure is made with lawful authority.
- (2) For the purposes of subsection (1), a disclosure is made with lawful authority only if and to the extent that—
- (a) the disclosure was made with the consent of the individual or of the person for the time being carrying on the business,
- (b) the information was obtained or provided as described in subsection (1)(a) for the purpose of its being made available to the public (in whatever manner),
- (c) the disclosure was made for the purposes of, and is necessary for, the discharge of one or more of the Commissioner's functions,
- (d) the disclosure was made for the purposes of, and is necessary for, the discharge of an EU obligation,
- (e) the disclosure was made for the purposes of criminal or civil proceedings, however arising, or
- (f) having regard to the rights, freedoms and legitimate interests of any person, the disclosure was necessary in the public interest.
- (3) It is an offence for a person knowingly or recklessly to disclose information in contravention of subsection (1).
#### Guidance about privileged communications
##### 133
- (1) The Commissioner must produce and publish guidance about—
- (a) how the Commissioner proposes to secure that privileged communications which the Commissioner obtains or has access to in the course of carrying out the Commissioner's functions are used or disclosed only so far as necessary for carrying out those functions, and
- (b) how the Commissioner proposes to comply with restrictions and prohibitions on obtaining or having access to privileged communications which are imposed by an enactment.
- (2) The Commissioner—
- (a) may alter or replace the guidance, and
- (b) must publish any altered or replacement guidance.
- (3) The Commissioner must consult the Secretary of State before publishing guidance under this section (including altered or replacement guidance).
- (4) The Commissioner must arrange for guidance under this section (including altered or replacement guidance) to be laid before Parliament.
- (5) In this section, “*privileged communications*” means—
- (a) communications made—
- (i) between a professional legal adviser and the adviser's client, and
- (ii) in connection with the giving of legal advice to the client with respect to legal obligations, liabilities or rights, and
- (b) communications made—
- (i) between a professional legal adviser and the adviser's client or between such an adviser or client and another person,
- (ii) in connection with or in contemplation of legal proceedings, and
- (iii) for the purposes of such proceedings.
- (6) In subsection (5)—
- (a) references to the client of a professional legal adviser include references to a person acting on behalf of the client, and
- (b) references to a communication include—
- (i) a copy or other record of the communication, and
- (ii) anything enclosed with or referred to in the communication if made as described in subsection (5)(a)(ii) or in subsection (5)(b)(ii) and (iii).
### Fees
#### Fees for services
##### 134
The Commissioner may require a person other than a data subject or a data protection officer to pay a reasonable fee for a service provided to the person, or at the person's request, which the Commissioner is required or authorised to provide under the data protection legislation.
#### Manifestly unfounded or excessive requests by data subjects etc
##### 135
- (1) Where a request to the Commissioner from a data subject or a data protection officer is manifestly unfounded or excessive, the Commissioner may—
- (a) charge a reasonable fee for dealing with the request, or
- (b) refuse to act on the request.
- (2) An example of a request that may be excessive is one that merely repeats the substance of previous requests.
- (3) In any proceedings where there is an issue as to whether a request described in subsection (1) is manifestly unfounded or excessive, it is for the Commissioner to show that it is.
- (4) Subsections (1) and (3) apply only in cases in which the Commissioner does not already have such powers and obligations under Article 57(4) of the GDPR.
#### Guidance about fees
##### 136
- (1) The Commissioner must produce and publish guidance about the fees the Commissioner proposes to charge in accordance with—
- (a) section 134 or 135, or
- (b) Article 57(4) of the GDPR.
- (2) Before publishing the guidance, the Commissioner must consult the Secretary of State.
### Charges
#### Charges payable to the Commissioner by controllers
##### 137
- (1) The Secretary of State may by regulations require controllers to pay charges of an amount specified in the regulations to the Commissioner.
- (2) Regulations under subsection (1) may require a controller to pay a charge regardless of whether the Commissioner has provided, or proposes to provide, a service to the controller.
- (3) Regulations under subsection (1) may—
- (a) make provision about the time or times at which, or period or periods within which, a charge must be paid;
- (b) make provision for cases in which a discounted charge is payable;
- (c) make provision for cases in which no charge is payable;
- (d) make provision for cases in which a charge which has been paid is to be refunded.
- (4) In making regulations under subsection (1), the Secretary of State must have regard to the desirability of securing that the charges payable to the Commissioner under such regulations are sufficient to offset—
- (a) expenses incurred by the Commissioner in discharging the Commissioner's functions—
- (i) under the data protection legislation,
- (ii) under the Data Protection Act 1998,
- (iii) under or by virtue of sections 108 and 109 of the Digital Economy Act 2017, and
- (iv) under or by virtue of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426),
- (b) any expenses of the Secretary of State in respect of the Commissioner so far as attributable to those functions,
- (c) to the extent that the Secretary of State considers appropriate, any deficit previously incurred (whether before or after the passing of this Act) in respect of the expenses mentioned in paragraph (a), and
- (d) to the extent that the Secretary of State considers appropriate, expenses incurred by the Secretary of State in respect of the inclusion of any officers or staff of the Commissioner in any scheme under section 1 of the Superannuation Act 1972 or section 1 of the Public Service Pensions Act 2013.
- (5) The Secretary of State may from time to time require the Commissioner to provide information about the expenses referred to in subsection (4)(a).
- (6) The Secretary of State may by regulations make provision—
- (a) requiring a controller to provide information to the Commissioner, or
- (b) enabling the Commissioner to require a controller to provide information to the Commissioner,
for either or both of the purposes mentioned in subsection (7).
- (7) Those purposes are—
- (a) determining whether a charge is payable by the controller under regulations under subsection (1);
- (b) determining the amount of a charge payable by the controller.
- (8) The provision that may be made under subsection (6)(a) includes provision requiring a controller to notify the Commissioner of a change in the controller's circumstances of a kind specified in the regulations.
#### Regulations under section 137: supplementary
##### 138
- (1) Before making regulations under section 137(1) or (6), the Secretary of State must consult such representatives of persons likely to be affected by the regulations as the Secretary of State thinks appropriate (and see also section 182).
- (2) The Commissioner—
- (a) must keep under review the working of regulations under section 137(1) or (6), and
- (b) may from time to time submit proposals to the Secretary of State for amendments to be made to the regulations.
- (3) The Secretary of State must review the working of regulations under section 137(1) or (6)—
- (a) at the end of the period of 5 years beginning with the making of the first set of regulations under section 108 of the Digital Economy Act 2017, and
- (b) at the end of each subsequent 5 year period.
- (4) Regulations under section 137(1) are subject to the negative resolution procedure if—
- (a) they only make provision increasing a charge for which provision is made by previous regulations under section 137(1) or section 108(1) of the Digital Economy Act 2017, and
- (b) they do so to take account of an increase in the retail prices index since the previous regulations were made.
- (5) Subject to subsection (4), regulations under section 137(1) or (6) are subject to the affirmative resolution procedure.
- (6) In subsection (4), “*the retail prices index*” means—
- (a) the general index of retail prices (for all items) published by the Statistics Board, or
- (b) where that index is not published for a month, any substitute index or figures published by the Board.
- (7) Regulations under section 137(1) or (6) may not apply to—
- (a) Her Majesty in her private capacity,
- (b) Her Majesty in right of the Duchy of Lancaster, or
- (c) the Duke of Cornwall.
### Reports etc
#### Reporting to Parliament
##### 139
- (1) The Commissioner must—
- (a) produce a general report on the carrying out of the Commissioner's functions annually,
- (b) arrange for it to be laid before Parliament, and
- (c) publish it.
- (2) The report must include the annual report required under Article 59 of the GDPR.
- (3) The Commissioner may produce other reports relating to the carrying out of the Commissioner's functions and arrange for them to be laid before Parliament.
#### Publication by the Commissioner
##### 140
A duty under this Act for the Commissioner to publish a document is a duty for the Commissioner to publish it, or to arrange for it to be published, in such form and manner as the Commissioner considers appropriate.
#### Notices from the Commissioner
##### 141
- (1) This section applies in relation to a notice authorised or required by this Act to be given to a person by the Commissioner.
- (2) The notice may be given to an individual—
- (a) by delivering it to the individual,
- (b) by sending it to the individual by post addressed to the individual at his or her usual or last-known place of residence or business, or
- (c) by leaving it for the individual at that place.
- (3) The notice may be given to a body corporate or unincorporate—
- (a) by sending it by post to the proper officer of the body at its principal office, or
- (b) by addressing it to the proper officer of the body and leaving it at that office.
- (4) The notice may be given to a partnership in Scotland—
- (a) by sending it by post to the principal office of the partnership, or
- (b) by addressing it to that partnership and leaving it at that office.
- (5) The notice may be given to the person by other means, including by electronic means, with the person's consent.
- (6) In this section—
- “*principal office*”, in relation to a registered company, means its registered office;
- “*proper officer*”, in relation to any body, means the secretary or other executive officer charged with the conduct of its general affairs;
- “*registered company*” means a company registered under the enactments relating to companies for the time being in force in the United Kingdom.
- (7) This section is without prejudice to any other lawful method of giving a notice.
## PART 6 — Enforcement
### Information notices
#### Information notices
##### 142
- (1) The Commissioner may, by written notice (an “information notice”)—
- (a) require a controller or processor to provide the Commissioner with information that the Commissioner reasonably requires for the purposes of carrying out the Commissioner's functions under the data protection legislation, or
- (b) require any person to provide the Commissioner with information that the Commissioner reasonably requires for the purposes of—
- (i) investigating a suspected failure of a type described in section 149(2) or a suspected offence under this Act, or
- (ii) determining whether the processing of personal data is carried out by an individual in the course of a purely personal or household activity.
- (2) An information notice must state—
- (a) whether it is given under subsection (1)(a), (b)(i) or (b)(ii), and
- (b) why the Commissioner requires the information.
- (3) An information notice—
- (a) may specify or describe particular information or a category of information;
- (b) may specify the form in which the information must be provided;
- (c) may specify the time at which, or the period within which, the information must be provided;
- (d) may specify the place where the information must be provided;
(but see the restrictions in subsections (5) to (7)).
- (4) An information notice must provide information about—
- (a) the consequences of failure to comply with it, and
- (b) the rights under sections 162 and 164 (appeals etc).
- (5) An information notice may not require a person to provide information before the end of the period within which an appeal can be brought against the notice.
- (6) If an appeal is brought against an information notice, the information need not be provided pending the determination or withdrawal of the appeal.
- (7) If an information notice—
- (a) states that, in the Commissioner's opinion, the information is required urgently, and
- (b) gives the Commissioner's reasons for reaching that opinion,
subsections (5) and (6) do not apply but the notice must not require the information to be provided before the end of the period of 24 hours beginning when the notice is given.
- (8) The Commissioner may cancel an information notice by written notice to the person to whom it was given.
- (9) In subsection (1), in relation to a person who is a controller or processor for the purposes of the GDPR, the reference to a controller or processor includes a representative of a controller or processor designated under Article 27 of the GDPR (representatives of controllers or processors not established in the European Union).
- (10) Section 3(14)(c) does not apply to the reference to the processing of personal data in subsection (1)(b).
#### Information notices: restrictions
##### 143
- (1) The Commissioner may not give an information notice with respect to the processing of personal data for the special purposes unless—
- (a) a determination under section 174 with respect to the data or the processing has taken effect, or
- (b) the Commissioner—
- (i) has reasonable grounds for suspecting that such a determination could be made, and
- (ii) the information is required for the purposes of making such a determination.
- (2) An information notice does not require a person to give the Commissioner information to the extent that requiring the person to do so would involve an infringement of the privileges of either House of Parliament.
- (3) An information notice does not require a person to give the Commissioner information in respect of a communication which is made—
- (a) between a professional legal adviser and the adviser's client, and
- (b) in connection with the giving of legal advice to the client with respect to obligations, liabilities or rights under the data protection legislation.
- (4) An information notice does not require a person to give the Commissioner information in respect of a communication which is made—
- (a) between a professional legal adviser and the adviser's client or between such an adviser or client and another person,
- (b) in connection with or in contemplation of proceedings under or arising out of the data protection legislation, and
- (c) for the purposes of such proceedings.
- (5) In subsections (3) and (4), references to the client of a professional legal adviser include references to a person acting on behalf of the client.
- (6) An information notice does not require a person to provide the Commissioner with information if doing so would, by revealing evidence of the commission of an offence expose the person to proceedings for that offence.
- (7) The reference to an offence in subsection (6) does not include an offence under—
- (a) this Act;
- (b) section 5 of the Perjury Act 1911 (false statements made otherwise than on oath);
- (c) section 44(2) of the Criminal Law (Consolidation) (Scotland) Act 1995 (false statements made otherwise than on oath);
- (d) Article 10 of the Perjury (Northern Ireland) Order 1979 (S.I. 1979/1714 (N.I. 19)) (false statutory declarations and other false unsworn statements).
- (8) An oral or written statement provided by a person in response to an information notice may not be used in evidence against that person on a prosecution for an offence under this Act (other than an offence under section 144) unless in the proceedings—
- (a) in giving evidence the person provides information inconsistent with the statement, and
- (b) evidence relating to the statement is adduced, or a question relating to it is asked, by that person or on that person's behalf.
- (9) In subsection (6), in relation to an information notice given to a representative of a controller or processor designated under Article 27 of the GDPR, the reference to the person providing the information being exposed to proceedings for an offence includes a reference to the controller or processor being exposed to such proceedings.
#### False statements made in response to information notices
##### 144
It is an offence for a person, in response to an information notice—
- (a) to make a statement which the person knows to be false in a material respect, or
- (b) recklessly to make a statement which is false in a material respect.
#### Information orders
##### 145
- (1) This section applies if, on an application by the Commissioner, a court is satisfied that a person has failed to comply with a requirement of an information notice.
- (2) The court may make an order requiring the person to provide to the Commissioner some or all of the following—
- (a) information referred to in the information notice;
- (b) other information which the court is satisfied the Commissioner requires, having regard to the statement included in the notice in accordance with section 142(2)(b).
- (3) The order—
- (a) may specify the form in which the information must be provided,
- (b) must specify the time at which, or the period within which, the information must be provided, and
- (c) may specify the place where the information must be provided.
### Assessment notices
#### Assessment notices
##### 146
- (1) The Commissioner may by written notice (an “assessment notice”) require a controller or processor to permit the Commissioner to carry out an assessment of whether the controller or processor has complied or is complying with the data protection legislation.
- (2) An assessment notice may require the controller or processor to do any of the following—
- (a) permit the Commissioner to enter specified premises;
- (b) direct the Commissioner to documents on the premises that are of a specified description;
- (c) assist the Commissioner to view information of a specified description that is capable of being viewed using equipment on the premises;
- (d) comply with a request from the Commissioner for a copy (in such form as may be requested) of—
- (i) the documents to which the Commissioner is directed;
- (ii) the information which the Commissioner is assisted to view;
- (e) direct the Commissioner to equipment or other material on the premises which is of a specified description;
- (f) permit the Commissioner to inspect or examine the documents, information, equipment or material to which the Commissioner is directed or which the Commissioner is assisted to view;
- (g) provide the Commissioner with an explanation of such documents, information, equipment or material;
- (h) permit the Commissioner to observe the processing of personal data that takes place on the premises;
- (i) make available for interview by the Commissioner a specified number of people of a specified description who process personal data on behalf of the controller, not exceeding the number who are willing to be interviewed.
- (3) In subsection (2), references to the Commissioner include references to the Commissioner's officers and staff.
- (4) An assessment notice must, in relation to each requirement imposed by the notice, specify the time or times at which, or period or periods within which, the requirement must be complied with (but see the restrictions in subsections (6) to (9)).
- (5) An assessment notice must provide information about—
- (a) the consequences of failure to comply with it, and
- (b) the rights under sections 162 and 164 (appeals etc).
- (6) An assessment notice may not require a person to do anything before the end of the period within which an appeal can be brought against the notice.
- (7) If an appeal is brought against an assessment notice, the controller or processor need not comply with a requirement in the notice pending the determination or withdrawal of the appeal.
- (8) If an assessment notice—
- (a) states that, in the Commissioner's opinion, it is necessary for the controller or processor to comply with a requirement in the notice urgently,
- (b) gives the Commissioner's reasons for reaching that opinion, and
- (c) does not meet the conditions in subsection (9)(a) to (d),
subsections (6) and (7) do not apply but the notice must not require the controller or processor to comply with the requirement before the end of the period of 7 days beginning when the notice is given.
- (9) If an assessment notice—
- (a) states that, in the Commissioner's opinion, there are reasonable grounds for suspecting that a controller or processor has failed or is failing as described in section 149(2) or that an offence under this Act has been or is being committed,
- (b) indicates the nature of the suspected failure or offence,
- (c) does not specify domestic premises,
- (d) states that, in the Commissioner's opinion, it is necessary for the controller or processor to comply with a requirement in the notice in less than 7 days, and
- (e) gives the Commissioner's reasons for reaching that opinion,
subsections (6) and (7) do not apply.
- (10) The Commissioner may cancel an assessment notice by written notice to the controller or processor to whom it was given.
- (11) Where the Commissioner gives an assessment notice to a processor, the Commissioner must, so far as reasonably practicable, give a copy of the notice to each controller for whom the processor processes personal data.
- (12) In this section—
- “*domestic premises*” means premises, or a part of premises, used as a dwelling;
- “*specified*” means specified in an assessment notice.
#### Assessment notices: restrictions
##### 147
- (1) An assessment notice does not require a person to do something to the extent that requiring the person to do it would involve an infringement of the privileges of either House of Parliament.
- (2) An assessment notice does not have effect so far as compliance would result in the disclosure of a communication which is made—
- (a) between a professional legal adviser and the adviser's client, and
- (b) in connection with the giving of legal advice to the client with respect to obligations, liabilities or rights under the data protection legislation.
- (3) An assessment notice does not have effect so far as compliance would result in the disclosure of a communication which is made—
- (a) between a professional legal adviser and the adviser's client or between such an adviser or client and another person,
- (b) in connection with or in contemplation of proceedings under or arising out of the data protection legislation, and
- (c) for the purposes of such proceedings.
- (4) In subsections (2) and (3)—
- (a) references to the client of a professional legal adviser include references to a person acting on behalf of such a client, and
- (b) references to a communication include—
- (i) a copy or other record of the communication, and
- (ii) anything enclosed with or referred to in the communication if made as described in subsection (2)(b) or in subsection (3)(b) and (c).
- (5) The Commissioner may not give a controller or processor an assessment notice with respect to the processing of personal data for the special purposes.
- (6) The Commissioner may not give an assessment notice to—
- (a) a body specified in section 23(3) of the Freedom of Information Act 2000 (bodies dealing with security matters), or
- (b) the Office for Standards in Education, Children's Services and Skills in so far as it is a controller or processor in respect of information processed for the purposes of functions exercisable by Her Majesty's Chief Inspector of Education, Children's Services and Skills by virtue of section 5(1)(a) of the Care Standards Act 2000.
### Information notices and assessment notices: destruction of documents etc
#### Destroying or falsifying information and documents etc
##### 148
- (1) This section applies where a person—
- (a) has been given an information notice requiring the person to provide the Commissioner with information, or
- (b) has been given an assessment notice requiring the person to direct the Commissioner to a document, equipment or other material or to assist the Commissioner to view information.
- (2) It is an offence for the person—
- (a) to destroy or otherwise dispose of, conceal, block or (where relevant) falsify all or part of the information, document, equipment or material, or
- (b) to cause or permit the destruction, disposal, concealment, blocking or (where relevant) falsification of all or part of the information, document, equipment or material,
with the intention of preventing the Commissioner from viewing, or being provided with or directed to, all or part of the information, document, equipment or material.
- (3) It is a defence for a person charged with an offence under subsection (2) to prove that the destruction, disposal, concealment, blocking or falsification would have occurred in the absence of the person being given the notice.
### Enforcement notices
#### Enforcement notices
##### 149
- (1) Where the Commissioner is satisfied that a person has failed, or is failing, as described in subsection (2), (3), (4) or (5), the Commissioner may give the person a written notice (an “enforcement notice”) which requires the person—
- (a) to take steps specified in the notice, or
- (b) to refrain from taking steps specified in the notice,
or both (and see also sections 150 and 151).
- (2) The first type of failure is where a controller or processor has failed, or is failing, to comply with any of the following—
- (a) a provision of Chapter II of the GDPR or Chapter 2 of Part 3 or Chapter 2 of Part 4 of this Act (principles of processing);
- (b) a provision of Articles 12 to 22 of the GDPR or Part 3 or 4 of this Act conferring rights on a data subject;
- (c) a provision of Articles 25 to 39 of the GDPR or section 64 or 65 of this Act (obligations of controllers and processors);
- (d) a requirement to communicate a personal data breach to the Commissioner or a data subject under section 67, 68 or 108 of this Act;
- (e) the principles for transfers of personal data to third countries, non-Convention countries and international organisations in Articles 44 to 49 of the GDPR or in sections 73 to 78 or 109 of this Act.
- (3) The second type of failure is where a monitoring body has failed, or is failing, to comply with an obligation under Article 41 of the GDPR (monitoring of approved codes of conduct).
- (4) The third type of failure is where a person who is a certification provider—
- (a) does not meet the requirements for accreditation,
- (b) has failed, or is failing, to comply with an obligation under Article 42 or 43 of the GDPR (certification of controllers and processors), or
- (c) has failed, or is failing, to comply with any other provision of the GDPR (whether in the person's capacity as a certification provider or otherwise).
- (5) The fourth type of failure is where a controller has failed, or is failing, to comply with regulations under section 137.
- (6) An enforcement notice given in reliance on subsection (2), (3) or (5) may only impose requirements which the Commissioner considers appropriate for the purpose of remedying the failure.
- (7) An enforcement notice given in reliance on subsection (4) may only impose requirements which the Commissioner considers appropriate having regard to the failure (whether or not for the purpose of remedying the failure).
- (8) The Secretary of State may by regulations confer power on the Commissioner to give an enforcement notice in respect of other failures to comply with the data protection legislation.
- (9) Regulations under this section—
- (a) may make provision about the giving of an enforcement notice in respect of the failure, including by amending this section and sections 150 to 152,
- (b) may make provision about the giving of an information notice, an assessment notice or a penalty notice, or about powers of entry and inspection, in connection with the failure, including by amending sections 142, 143, 146, 147 and 155 to 157 and Schedules 15 and 16, and
- (c) are subject to the affirmative resolution procedure.
#### Enforcement notices: supplementary
##### 150
- (1) An enforcement notice must—
- (a) state what the person has failed or is failing to do, and
- (b) give the Commissioner's reasons for reaching that opinion.
- (2) In deciding whether to give an enforcement notice in reliance on section 149(2), the Commissioner must consider whether the failure has caused or is likely to cause any person damage or distress.
- (3) In relation to an enforcement notice given in reliance on section 149(2), the Commissioner's power under section 149(1)(b) to require a person to refrain from taking specified steps includes power—
- (a) to impose a ban relating to all processing of personal data, or
- (b) to impose a ban relating only to a specified description of processing of personal data, including by specifying one or more of the following—
- (i) a description of personal data;
- (ii) the purpose or manner of the processing;
- (iii) the time when the processing takes place.
- (4) An enforcement notice may specify the time or times at which, or period or periods within which, a requirement imposed by the notice must be complied with (but see the restrictions in subsections (6) to (8)).
- (5) An enforcement notice must provide information about—
- (a) the consequences of failure to comply with it, and
- (b) the rights under sections 162 and 164 (appeals etc).
- (6) An enforcement notice must not specify a time for compliance with a requirement in the notice which falls before the end of the period within which an appeal can be brought against the notice.
- (7) If an appeal is brought against an enforcement notice, a requirement in the notice need not be complied with pending the determination or withdrawal of the appeal.
- (8) If an enforcement notice—
- (a) states that, in the Commissioner's opinion, it is necessary for a requirement to be complied with urgently, and
- (b) gives the Commissioner's reasons for reaching that opinion,
subsections (6) and (7) do not apply but the notice must not require the requirement to be complied with before the end of the period of 24 hours beginning when the notice is given.
- (9) In this section, “*specified*” means specified in an enforcement notice.
#### Enforcement notices: rectification and erasure of personal data etc
##### 151
- (1) Subsections (2) and (3) apply where an enforcement notice is given in respect of a failure by a controller or processor—
- (a) to comply with a data protection principle relating to accuracy, or
- (b) to comply with a data subject's request to exercise rights under Article 16, 17 or 18 of the GDPR (right to rectification, erasure or restriction on processing) or section 46, 47 or 100 of this Act.
- (2) If the enforcement notice requires the controller or processor to rectify or erase inaccurate personal data, it may also require the controller or processor to rectify or erase any other data which—
- (a) is held by the controller or processor, and
- (b) contains an expression of opinion which appears to the Commissioner to be based on the inaccurate personal data.
- (3) Where a controller or processor has accurately recorded personal data provided by the data subject or a third party but the data is inaccurate, the enforcement notice may require the controller or processor—
- (a) to take steps specified in the notice to ensure the accuracy of the data,
- (b) if relevant, to secure that the data indicates the data subject's view that the data is inaccurate, and
- (c) to supplement the data with a statement of the true facts relating to the matters dealt with by the data that is approved by the Commissioner,
(as well as imposing requirements under subsection (2)).
- (4) When deciding what steps it is reasonable to specify under subsection (3)(a), the Commissioner must have regard to the purpose for which the data was obtained and further processed.
- (5) Subsections (6) and (7) apply where—
- (a) an enforcement notice requires a controller or processor to rectify or erase personal data, or
- (b) the Commissioner is satisfied that the processing of personal data which has been rectified or erased by the controller or processor involved a failure described in subsection (1).
- (6) An enforcement notice may, if reasonably practicable, require the controller or processor to notify third parties to whom the data has been disclosed of the rectification or erasure.
- (7) In determining whether it is reasonably practicable to require such notification, the Commissioner must have regard, in particular, to the number of people who would have to be notified.
- (8) In this section, “*data protection principle relating to accuracy*” means the principle in—
- (a) Article 5(1)(d) of the GDPR,
- (b) section 38(1) of this Act, or
- (c) section 89 of this Act.
#### Enforcement notices: restrictions
##### 152
- (1) The Commissioner may not give a controller or processor an enforcement notice in reliance on section 149(2) with respect to the processing of personal data for the special purposes unless—
- (a) a determination under section 174 with respect to the data or the processing has taken effect, and
- (b) a court has granted leave for the notice to be given.
- (2) A court must not grant leave for the purposes of subsection (1)(b) unless it is satisfied that—
- (a) the Commissioner has reason to suspect a failure described in section 149(2) which is of substantial public importance, and
- (b) the controller or processor has been given notice of the application for leave in accordance with rules of court or the case is urgent.
- (3) An enforcement notice does not require a person to do something to the extent that requiring the person to do it would involve an infringement of the privileges of either House of Parliament.
- (4) In the case of a joint controller in respect of the processing of personal data to which Part 3 or 4 applies whose responsibilities for compliance with that Part are determined in an arrangement under section 58 or 104, the Commissioner may only give the controller an enforcement notice in reliance on section 149(2) if the controller is responsible for compliance with the provision, requirement or principle in question.
#### Enforcement notices: cancellation and variation
##### 153
- (1) The Commissioner may cancel or vary an enforcement notice by giving written notice to the person to whom it was given.
- (2) A person to whom an enforcement notice is given may apply in writing to the Commissioner for the cancellation or variation of the notice.
- (3) An application under subsection (2) may be made only—
- (a) after the end of the period within which an appeal can be brought against the notice, and
- (b) on the ground that, by reason of a change of circumstances, one or more of the provisions of that notice need not be complied with in order to remedy the failure identified in the notice.
### Powers of entry and inspection
#### Powers of entry and inspection
##### 154
Schedule 15 makes provision about powers of entry and inspection.
### Penalties
#### Penalty notices
##### 155
- (1) If the Commissioner is satisfied that a person—
- (a) has failed or is failing as described in section 149(2), (3), (4) or (5), or
- (b) has failed to comply with an information notice, an assessment notice or an enforcement notice,
the Commissioner may, by written notice (a “penalty notice”), require the person to pay to the Commissioner an amount in sterling specified in the notice.
- (2) Subject to subsection (4), when deciding whether to give a penalty notice to a person and determining the amount of the penalty, the Commissioner must have regard to the following, so far as relevant—
- (a) to the extent that the notice concerns a matter to which the GDPR applies, the matters listed in Article 83(1) and (2) of the GDPR;
- (b) to the extent that the notice concerns another matter, the matters listed in subsection (3).
- (3) Those matters are—
- (a) the nature, gravity and duration of the failure;
- (b) the intentional or negligent character of the failure;
- (c) any action taken by the controller or processor to mitigate the damage or distress suffered by data subjects;
- (d) the degree of responsibility of the controller or processor, taking into account technical and organisational measures implemented by the controller or processor in accordance with section 57, 66, 103 or 107;
- (e) any relevant previous failures by the controller or processor;
- (f) the degree of co-operation with the Commissioner, in order to remedy the failure and mitigate the possible adverse effects of the failure;
- (g) the categories of personal data affected by the failure;
- (h) the manner in which the infringement became known to the Commissioner, including whether, and if so to what extent, the controller or processor notified the Commissioner of the failure;
- (i) the extent to which the controller or processor has complied with previous enforcement notices or penalty notices;
- (j) adherence to approved codes of conduct or certification mechanisms;
- (k) any other aggravating or mitigating factor applicable to the case, including financial benefits gained, or losses avoided, as a result of the failure (whether directly or indirectly);
- (l) whether the penalty would be effective, proportionate and dissuasive.
- (4) Subsections (2) and (3) do not apply in the case of a decision or determination relating to a failure described in section 149(5).
- (5) Schedule 16 makes further provision about penalty notices, including provision requiring the Commissioner to give a notice of intent to impose a penalty and provision about payment, variation, cancellation and enforcement.
- (6) The Secretary of State may by regulations—
- (a) confer power on the Commissioner to give a penalty notice in respect of other failures to comply with the data protection legislation, and
- (b) provide for the maximum penalty that may be imposed in relation to such failures to be either the standard maximum amount or the higher maximum amount.
- (7) Regulations under this section—
- (a) may make provision about the giving of penalty notices in respect of the failure,
- (b) may amend this section and sections 156 to 158, and
- (c) are subject to the affirmative resolution procedure.
- (8) In this section, “*higher maximum amount*” and “*standard maximum amount*” have the same meaning as in section 157.
#### Penalty notices: restrictions
##### 156
- (1) The Commissioner may not give a controller or processor a penalty notice in reliance on section 149(2) with respect to the processing of personal data for the special purposes unless—
- (a) a determination under section 174 with respect to the data or the processing has taken effect, and
- (b) a court has granted leave for the notice to be given.
- (2) A court must not grant leave for the purposes of subsection (1)(b) unless it is satisfied that—
- (a) the Commissioner has reason to suspect a failure described in section 149(2) which is of substantial public importance, and
- (b) the controller or processor has been given notice of the application for leave in accordance with rules of court or the case is urgent.
- (3) The Commissioner may not give a controller or processor a penalty notice with respect to the processing of personal data where the purposes and manner of the processing are determined by or on behalf of either House of Parliament.
- (4) The Commissioner may not give a penalty notice to—
- (a) the Crown Estate Commissioners, or
- (b) a person who is a controller by virtue of section 209(4) (controller for the Royal Household etc).
- (5) In the case of a joint controller in respect of the processing of personal data to which Part 3 or 4 applies whose responsibilities for compliance with that Part are determined in an arrangement under section 58 or 104, the Commissioner may only give the controller a penalty notice in reliance on section 149(2) if the controller is responsible for compliance with the provision, requirement or principle in question.
#### Maximum amount of penalty
##### 157
- (1) In relation to an infringement of a provision of the GDPR, the maximum amount of the penalty that may be imposed by a penalty notice is—
- (a) the amount specified in Article 83 of the GDPR, or
- (b) if an amount is not specified there, the standard maximum amount.
- (2) In relation to an infringement of a provision of Part 3 of this Act, the maximum amount of the penalty that may be imposed by a penalty notice is—
- (a) in relation to a failure to comply with section 35, 36, 37, 38(1), 39(1), 40, 44, 45, 46, 47, 48, 49, 52, 53, 73, 74, 75, 76, 77 or 78, the higher maximum amount, and
- (b) otherwise, the standard maximum amount.
- (3) In relation to an infringement of a provision of Part 4 of this Act, the maximum amount of the penalty that may be imposed by a penalty notice is—
- (a) in relation to a failure to comply with section 86, 87, 88, 89, 90, 91, 93, 94, 100 or 109, the higher maximum amount, and
- (b) otherwise, the standard maximum amount.
- (4) In relation to a failure to comply with an information notice, an assessment notice or an enforcement notice, the maximum amount of the penalty that may be imposed by a penalty notice is the higher maximum amount.
- (5) The “higher maximum amount” is—
- (a) in the case of an undertaking, 20 million Euros or 4% of the undertaking's total annual worldwide turnover in the preceding financial year, whichever is higher, or
- (b) in any other case, 20 million Euros.
- (6) The “standard maximum amount” is—
- (a) in the case of an undertaking, 10 million Euros or 2% of the undertaking's total annual worldwide turnover in the preceding financial year, whichever is higher, or
- (b) in any other case, 10 million Euros.
- (7) The maximum amount of a penalty in sterling must be determined by applying the spot rate of exchange set by the Bank of England on the day on which the penalty notice is given.
#### Fixed penalties for non-compliance with charges regulations
##### 158
- (1) The Commissioner must produce and publish a document specifying the amount of the penalty for a failure to comply with regulations made under section 137.
- (2) The Commissioner may specify different amounts for different types of failure.
- (3) The maximum amount that may be specified is 150% of the highest charge payable by a controller in respect of a financial year in accordance with the regulations, disregarding any discount available under the regulations.
- (4) The Commissioner—
- (a) may alter or replace the document, and
- (b) must publish any altered or replacement document.
- (5) Before publishing a document under this section (including any altered or replacement document), the Commissioner must consult—
- (a) the Secretary of State, and
- (b) such other persons as the Commissioner considers appropriate.
- (6) The Commissioner must arrange for a document published under this section (including any altered or replacement document) to be laid before Parliament.
#### Amount of penalties: supplementary
##### 159
- (1) For the purposes of Article 83 of the GDPR and section 157, the Secretary of State may by regulations—
- (a) provide that a person of a description specified in the regulations is or is not an undertaking, and
- (b) make provision about how an undertaking's turnover is to be determined.
- (2) For the purposes of Article 83 of the GDPR, section 157 and section 158, the Secretary of State may by regulations provide that a period is or is not a financial year.
- (3) Regulations under this section are subject to the affirmative resolution procedure.
### Guidance
#### Guidance about regulatory action
##### 160
- (1) The Commissioner must produce and publish guidance about how the Commissioner proposes to exercise the Commissioner's functions in connection with—
- (a) information notices,
- (b) assessment notices,
- (c) enforcement notices, and
- (d) penalty notices.
- (2) The Commissioner may produce and publish guidance about how the Commissioner proposes to exercise the Commissioner's other functions under this Part.
- (3) In relation to information notices, the guidance must include—
- (a) provision specifying factors to be considered in determining the time at which, or the period within which, information is to be required to be provided;
- (b) provision about the circumstances in which the Commissioner would consider it appropriate to give an information notice to a person in reliance on section 142(7) (urgent cases);
- (c) provision about how the Commissioner will determine how to proceed if a person does not comply with an information notice.
- (4) In relation to assessment notices, the guidance must include—
- (a) provision specifying factors to be considered in determining whether to give an assessment notice to a person;
- (b) provision about the circumstances in which the Commissioner would consider it appropriate to give an assessment notice in reliance on section 146(8) or (9) (urgent cases);
- (c) provision specifying descriptions of documents or information that—
- (i) are not to be examined or inspected in accordance with an assessment notice, or
- (ii) are to be so examined or inspected only by a person of a description specified in the guidance;
- (d) provision about the nature of inspections and examinations carried out in accordance with an assessment notice;
- (e) provision about the nature of interviews carried out in accordance with an assessment notice;
- (f) provision about the preparation, issuing and publication by the Commissioner of assessment reports in respect of controllers and processors that have been given assessment notices;
- (g) provision about how the Commissioner will determine how to proceed if a person does not comply with an assessment notice.
- (5) The guidance produced in accordance with subsection (4)(c) must include provisions that relate to—
- (a) documents and information concerning an individual's physical or mental health;
- (b) documents and information concerning the provision of social care for an individual.
- (6) In relation to enforcement notices, the guidance must include—
- (a) provision specifying factors to be considered in determining whether to give an enforcement notice to a person;
- (b) provision about the circumstances in which the Commissioner would consider it appropriate to give an enforcement notice to a person in reliance on section 150(8) (urgent cases);
- (c) provision about how the Commissioner will determine how to proceed if a person does not comply with an enforcement notice.
- (7) In relation to penalty notices, the guidance must include—
- (a) provision about the circumstances in which the Commissioner would consider it appropriate to issue a penalty notice;
- (b) provision about the circumstances in which the Commissioner would consider it appropriate to allow a person to make oral representations about the Commissioner's intention to give the person a penalty notice;
- (c) provision explaining how the Commissioner will determine the amount of penalties;
- (d) provision about how the Commissioner will determine how to proceed if a person does not comply with a penalty notice.
- (8) The Commissioner—
- (a) may alter or replace guidance produced under this section, and
- (b) must publish any altered or replacement guidance.
- (9) Before producing guidance under this section (including any altered or replacement guidance), the Commissioner must consult—
- (a) the Secretary of State, and
- (b) such other persons as the Commissioner considers appropriate.
- (10) Section 161 applies in relation to the first guidance under subsection (1).
- (11) The Commissioner must arrange for other guidance under this section (including any altered or replacement guidance) to be laid before Parliament.
- (12) In this section, “*social care*” has the same meaning as in Part 1 of the Health and Social Care Act 2008 (see section 9(3) of that Act).
#### Approval of first guidance about regulatory action
##### 161
- (1) When the first guidance is produced under section 160(1)—
- (a) the Commissioner must submit the final version to the Secretary of State, and
- (b) the Secretary of State must lay the guidance before Parliament.
- (2) If, within the 40-day period, either House of Parliament resolves not to approve the guidance—
- (a) the Commissioner must not issue the guidance, and
- (b) the Commissioner must produce another version of the guidance (and this section applies to that version).
- (3) If, within the 40-day period, no such resolution is made—
- (a) the Commissioner must issue the guidance, and
- (b) the guidance comes into force at the end of the period of 21 days beginning with the day on which it is issued.
- (4) Nothing in subsection (2)(a) prevents another version of the guidance being laid before Parliament.
- (5) In this section, “*the 40-day period*” means—
- (a) if the guidance is laid before both Houses of Parliament on the same day, the period of 40 days beginning with that day, or
- (b) if the guidance is laid before the Houses of Parliament on different days, the period of 40 days beginning with the later of those days.
- (6) In calculating the 40-day period, no account is to be taken of any period during which Parliament is dissolved or prorogued or during which both Houses of Parliament are adjourned for more than 4 days.
### Appeals etc
#### Rights of appeal
##### 162
- (1) A person who is given any of the following notices may appeal to the Tribunal—
- (a) an information notice;
- (b) an assessment notice;
- (c) an enforcement notice;
- (d) a penalty notice;
- (e) a penalty variation notice.
- (2) A person who is given an enforcement notice may appeal to the Tribunal against the refusal of an application under section 153 for the cancellation or variation of the notice.
- (3) A person who is given a penalty notice or a penalty variation notice may appeal to the Tribunal against the amount of the penalty specified in the notice, whether or not the person appeals against the notice.
- (4) Where a determination is made under section 174 in respect of the processing of personal data, the controller or processor may appeal to the Tribunal against the determination.
#### Determination of appeals
##### 163
- (1) Subsections (2) to (4) apply where a person appeals to the Tribunal under section 162(1) or (3).
- (2) The Tribunal may review any determination of fact on which the notice or decision against which the appeal is brought was based.
- (3) If the Tribunal considers—
- (a) that the notice or decision against which the appeal is brought is not in accordance with the law, or
- (b) to the extent that the notice or decision involved an exercise of discretion by the Commissioner, that the Commissioner ought to have exercised the discretion differently,
the Tribunal must allow the appeal or substitute another notice or decision which the Commissioner could have given or made.
- (4) Otherwise, the Tribunal must dismiss the appeal.
- (5) On an appeal under section 162(2), if the Tribunal considers that the enforcement notice ought to be cancelled or varied by reason of a change in circumstances, the Tribunal must cancel or vary the notice.
- (6) On an appeal under section 162(4), the Tribunal may cancel the Commissioner's determination.
#### Applications in respect of urgent notices
##### 164
- (1) This section applies where an information notice, an assessment notice or an enforcement notice given to a person contains an urgency statement.
- (2) The person may apply to the court for either or both of the following—
- (a) the disapplication of the urgency statement in relation to some or all of the requirements of the notice;
- (b) a change to the time at which, or the period within which, a requirement of the notice must be complied with.
- (3) On an application under subsection (2), the court may do any of the following—
- (a) direct that the notice is to have effect as if it did not contain the urgency statement;
- (b) direct that the inclusion of the urgency statement is not to have effect in relation to a requirement of the notice;
- (c) vary the notice by changing the time at which, or the period within which, a requirement of the notice must be complied with;
- (d) vary the notice by making other changes required to give effect to a direction under paragraph (a) or (b) or in consequence of a variation under paragraph (c).
- (4) The decision of the court on an application under this section is final.
- (5) In this section, “*urgency statement*” means—
- (a) in relation to an information notice, a statement under section 142(7)(a),
- (b) in relation to an assessment notice, a statement under section 146(8)(a) or (9)(d), and
- (c) in relation to an enforcement notice, a statement under section 150(8)(a).
### Complaints
#### Complaints by data subjects
##### 165
- (1) Articles 57(1)(f) and (2) and 77 of the GDPR (data subject's right to lodge a complaint) confer rights on data subjects to complain to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of the GDPR.
- (2) A data subject may make a complaint to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of Part 3 or 4 of this Act.
- (3) The Commissioner must facilitate the making of complaints under subsection (2) by taking steps such as providing a complaint form which can be completed electronically and by other means.
- (4) If the Commissioner receives a complaint under subsection (2), the Commissioner must—
- (a) take appropriate steps to respond to the complaint,
- (b) inform the complainant of the outcome of the complaint,
- (c) inform the complainant of the rights under section 166, and
- (d) if asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint.
- (5) The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes—
- (a) investigating the subject matter of the complaint, to the extent appropriate, and
- (b) informing the complainant about progress on the complaint, including about whether further investigation or co-ordination with another supervisory authority or foreign designated authority is necessary.
- (6) If the Commissioner receives a complaint relating to the infringement of a data subject's rights under provisions adopted by a member State other than the United Kingdom pursuant to the Law Enforcement Directive, the Commissioner must—
- (a) send the complaint to the relevant supervisory authority for the purposes of that Directive,
- (b) inform the complainant that the Commissioner has done so, and
- (c) if asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint.
- (7) In this section—
- “*foreign designated authority*” means an authority designated for the purposes of Article 13 of the Data Protection Convention by a party, other than the United Kingdom, which is bound by that Convention;
- “*supervisory authority*” means a supervisory authority for the purposes of Article 51 of the GDPR or Article 41 of the Law Enforcement Directive in a member State other than the United Kingdom.
#### Orders to progress complaints
##### 166
- (1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the GDPR, the Commissioner—
- (a) fails to take appropriate steps to respond to the complaint,
- (b) fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or
- (c) if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.
- (2) The Tribunal may, on an application by the data subject, make an order requiring the Commissioner—
- (a) to take appropriate steps to respond to the complaint, or
- (b) to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.
- (3) An order under subsection (2)(a) may require the Commissioner—
- (a) to take steps specified in the order;
- (b) to conclude an investigation, or take a specified step, within a period specified in the order.
- (4) Section 165(5) applies for the purposes of subsections (1)(a) and (2)(a) as it applies for the purposes of section 165(4)(a).
### Remedies in the court
#### Compliance orders
##### 167
- (1) This section applies if, on an application by a data subject, a court is satisfied that there has been an infringement of the data subject's rights under the data protection legislation in contravention of that legislation.
- (2) A court may make an order for the purposes of securing compliance with the data protection legislation which requires the controller in respect of the processing, or a processor acting on behalf of that controller—
- (a) to take steps specified in the order, or
- (b) to refrain from taking steps specified in the order.
- (3) The order may, in relation to each step, specify the time at which, or the period within which, it must be taken.
- (4) In subsection (1)—
- (a) the reference to an application by a data subject includes an application made in exercise of the right under Article 79(1) of the GDPR (right to an effective remedy against a controller or processor);
- (b) the reference to the data protection legislation does not include Part 4 of this Act or regulations made under that Part.
- (5) In relation to a joint controller in respect of the processing of personal data to which Part 3 applies whose responsibilities are determined in an arrangement under section 58, a court may only make an order under this section if the controller is responsible for compliance with the provision of the data protection legislation that is contravened.
#### Compensation for contravention of the GDPR
##### 168
- (1) In Article 82 of the GDPR (right to compensation for material or non-material damage), “*non-material damage*” includes distress.
- (2) Subsection (3) applies where—
- (a) in accordance with rules of court, proceedings under Article 82 of the GDPR are brought by a representative body on behalf of a person, and
- (b) a court orders the payment of compensation.
- (3) The court may make an order providing for the compensation to be paid on behalf of the person to—
- (a) the representative body, or
- (b) such other person as the court thinks fit.
#### Compensation for contravention of other data protection legislation
##### 169
- (1) A person who suffers damage by reason of a contravention of a requirement of the data protection legislation, other than the GDPR, is entitled to compensation for that damage from the controller or the processor, subject to subsections (2) and (3).
- (2) Under subsection (1)—
- (a) a controller involved in processing of personal data is liable for any damage caused by the processing, and
- (b) a processor involved in processing of personal data is liable for damage caused by the processing only if the processor—
- (i) has not complied with an obligation under the data protection legislation specifically directed at processors, or
- (ii) has acted outside, or contrary to, the controller's lawful instructions.
- (3) A controller or processor is not liable as described in subsection (2) if the controller or processor proves that the controller or processor is not in any way responsible for the event giving rise to the damage.
- (4) A joint controller in respect of the processing of personal data to which Part 3 or 4 applies whose responsibilities are determined in an arrangement under section 58 or 104 is only liable as described in subsection (2) if the controller is responsible for compliance with the provision of the data protection legislation that is contravened.
- (5) In this section, “*damage*” includes financial loss and damage not involving financial loss, such as distress.
### Offences relating to personal data
#### Unlawful obtaining etc of personal data
##### 170
- (1) It is an offence for a person knowingly or recklessly—
- (a) to obtain or disclose personal data without the consent of the controller,
- (b) to procure the disclosure of personal data to another person without the consent of the controller, or
- (c) after obtaining personal data, to retain it without the consent of the person who was the controller in relation to the personal data when it was obtained.
- (2) It is a defence for a person charged with an offence under subsection (1) to prove that the obtaining, disclosing, procuring or retaining—
- (a) was necessary for the purposes of preventing or detecting crime,
- (b) was required or authorised by an enactment, by a rule of law or by the order of a court or tribunal, or
- (c) in the particular circumstances, was justified as being in the public interest.
- (3) It is also a defence for a person charged with an offence under subsection (1) to prove that—
- (a) the person acted in the reasonable belief that the person had a legal right to do the obtaining, disclosing, procuring or retaining,
- (b) the person acted in the reasonable belief that the person would have had the consent of the controller if the controller had known about the obtaining, disclosing, procuring or retaining and the circumstances of it, or
- (c) the person acted—
- (i) for the special purposes,
- (ii) with a view to the publication by a person of any journalistic, academic, artistic or literary material, and
- (iii) in the reasonable belief that in the particular circumstances the obtaining, disclosing, procuring or retaining was justified as being in the public interest.
- (4) It is an offence for a person to sell personal data if the person obtained the data in circumstances in which an offence under subsection (1) was committed.
- (5) It is an offence for a person to offer to sell personal data if the person—
- (a) has obtained the data in circumstances in which an offence under subsection (1) was committed, or
- (b) subsequently obtains the data in such circumstances.
- (6) For the purposes of subsection (5), an advertisement indicating that personal data is or may be for sale is an offer to sell the data.
- (7) In this section—
- (a) references to the consent of a controller do not include the consent of a person who is a controller by virtue of Article 28(10) of the GDPR or section 59(8) or 105(3) of this Act (processor to be treated as controller in certain circumstances);
- (b) where there is more than one controller, such references are references to the consent of one or more of them.
#### Re-identification of de-identified personal data
##### 171
- (1) It is an offence for a person knowingly or recklessly to re-identify information that is de-identified personal data without the consent of the controller responsible for de-identifying the personal data.
- (2) For the purposes of this section and section 172—
- (a) personal data is “de-identified” if it has been processed in such a manner that it can no longer be attributed, without more, to a specific data subject;
- (b) a person “re-identifies” information if the person takes steps which result in the information no longer being de-identified within the meaning of paragraph (a).
- (3) It is a defence for a person charged with an offence under subsection (1) to prove that the re-identification—
- (a) was necessary for the purposes of preventing or detecting crime,
- (b) was required or authorised by an enactment, by a rule of law or by the order of a court or tribunal, or
- (c) in the particular circumstances, was justified as being in the public interest.
- (4) It is also a defence for a person charged with an offence under subsection (1) to prove that—
- (a) the person acted in the reasonable belief that the person—
- (i) is the data subject to whom the information relates,
- (ii) had the consent of that data subject, or
- (iii) would have had such consent if the data subject had known about the re-identification and the circumstances of it,
- (b) the person acted in the reasonable belief that the person—
- (i) is the controller responsible for de-identifying the personal data,
- (ii) had the consent of that controller, or
- (iii) would have had such consent if that controller had known about the re-identification and the circumstances of it,
- (c) the person acted—
- (i) for the special purposes,
- (ii) with a view to the publication by a person of any journalistic, academic, artistic or literary material, and
- (iii) in the reasonable belief that in the particular circumstances the re-identification was justified as being in the public interest, or
- (d) the effectiveness testing conditions were met (see section 172).
- (5) It is an offence for a person knowingly or recklessly to process personal data that is information that has been re-identified where the person does so—
- (a) without the consent of the controller responsible for de-identifying the personal data, and
- (b) in circumstances in which the re-identification was an offence under subsection (1).
- (6) It is a defence for a person charged with an offence under subsection (5) to prove that the processing—
- (a) was necessary for the purposes of preventing or detecting crime,
- (b) was required or authorised by an enactment, by a rule of law or by the order of a court or tribunal, or
- (c) in the particular circumstances, was justified as being in the public interest.
- (7) It is also a defence for a person charged with an offence under subsection (5) to prove that—
- (a) the person acted in the reasonable belief that the processing was lawful,
- (b) the person acted in the reasonable belief that the person—
- (i) had the consent of the controller responsible for de-identifying the personal data, or
- (ii) would have had such consent if that controller had known about the processing and the circumstances of it, or
- (c) the person acted—
- (i) for the special purposes,
- (ii) with a view to the publication by a person of any journalistic, academic, artistic or literary material, and
- (iii) in the reasonable belief that in the particular circumstances the processing was justified as being in the public interest.
- (8) In this section—
- (a) references to the consent of a controller do not include the consent of a person who is a controller by virtue of Article 28(10) of the GDPR or section 59(8) or 105(3) of this Act (processor to be treated as controller in certain circumstances);
- (b) where there is more than one controller, such references are references to the consent of one or more of them.
#### Re-identification: effectiveness testing conditions
##### 172
- (1) For the purposes of section 171, in relation to a person who re-identifies information that is de-identified personal data, “*the effectiveness testing conditions*” means the conditions in subsections (2) and (3).
- (2) The first condition is that the person acted—
- (a) with a view to testing the effectiveness of the de-identification of personal data,
- (b) without intending to cause, or threaten to cause, damage or distress to a person, and
- (c) in the reasonable belief that, in the particular circumstances, re-identifying the information was justified as being in the public interest.
- (3) The second condition is that the person notified the Commissioner or the controller responsible for de-identifying the personal data about the re-identification—
- (a) without undue delay, and
- (b) where feasible, not later than 72 hours after becoming aware of it.
- (4) Where there is more than one controller responsible for de-identifying personal data, the requirement in subsection (3) is satisfied if one or more of them is notified.
#### Alteration etc of personal data to prevent disclosure to data subject
##### 173
- (1) Subsection (3) applies where—
- (a) a request has been made in exercise of a data subject access right, and
- (b) the person making the request would have been entitled to receive information in response to that request.
- (2) In this section, “*data subject access right*” means a right under—
- (a) Article 15 of the GDPR (right of access by the data subject);
- (b) Article 20 of the GDPR (right to data portability);
- (c) section 45 of this Act (law enforcement processing: right of access by the data subject);
- (d) section 94 of this Act (intelligence services processing: right of access by the data subject).
- (3) It is an offence for a person listed in subsection (4) to alter, deface, block, erase, destroy or conceal information with the intention of preventing disclosure of all or part of the information that the person making the request would have been entitled to receive.
- (4) Those persons are—
- (a) the controller, and
- (b) a person who is employed by the controller, an officer of the controller or subject to the direction of the controller.
- (5) It is a defence for a person charged with an offence under subsection (3) to prove that—
- (a) the alteration, defacing, blocking, erasure, destruction or concealment of the information would have occurred in the absence of a request made in exercise of a data subject access right, or
- (b) the person acted in the reasonable belief that the person making the request was not entitled to receive the information in response to the request.
### The special purposes
#### The special purposes
##### 174
- (1) In this Part, “*the special purposes*” means one or more of the following—
- (a) the purposes of journalism;
- (b) academic purposes;
- (c) artistic purposes;
- (d) literary purposes.
- (2) In this Part, “*special purposes proceedings*” means legal proceedings against a controller or processor which relate, wholly or partly, to personal data processed for the special purposes and which are—
- (a) proceedings under section 167 (including proceedings on an application under Article 79 of the GDPR), or
- (b) proceedings under Article 82 of the GDPR or section 169.
- (3) The Commissioner may make a written determination, in relation to the processing of personal data, that—
- (a) the personal data is not being processed only for the special purposes;
- (b) the personal data is not being processed with a view to the publication by a person of journalistic, academic, artistic or literary material which has not previously been published by the controller.
- (4) The Commissioner must give written notice of the determination to the controller and the processor.
- (5) The notice must provide information about the rights of appeal under section 162.
- (6) The determination does not take effect until one of the following conditions is satisfied—
- (a) the period for the controller or the processor to appeal against the determination has ended without an appeal having been brought, or
- (b) an appeal has been brought against the determination and—
- (i) the appeal and any further appeal in relation to the determination has been decided or has otherwise ended, and
- (ii) the time for appealing against the result of the appeal or further appeal has ended without another appeal having been brought.
#### Provision of assistance in special purposes proceedings
##### 175
- (1) An individual who is a party, or prospective party, to special purposes proceedings may apply to the Commissioner for assistance in those proceedings.
- (2) As soon as reasonably practicable after receiving an application under subsection (1), the Commissioner must decide whether, and to what extent, to grant it.
- (3) The Commissioner must not grant the application unless, in the Commissioner's opinion, the case involves a matter of substantial public importance.
- (4) If the Commissioner decides not to provide assistance, the Commissioner must, as soon as reasonably practicable, notify the applicant of the decision, giving reasons for the decision.
- (5) If the Commissioner decides to provide assistance, the Commissioner must—
- (a) as soon as reasonably practicable, notify the applicant of the decision, stating the extent of the assistance to be provided, and
- (b) secure that the person against whom the proceedings are, or are to be, brought is informed that the Commissioner is providing assistance.
- (6) The assistance that may be provided by the Commissioner includes—
- (a) paying costs in connection with the proceedings, and
- (b) indemnifying the applicant in respect of liability to pay costs, expenses or damages in connection with the proceedings.
- (7) In England and Wales or Northern Ireland, the recovery of expenses incurred by the Commissioner in providing an applicant with assistance under this section (as taxed or assessed in accordance with rules of court) is to constitute a first charge for the benefit of the Commissioner—
- (a) on any costs which, by virtue of any judgment or order of the court, are payable to the applicant by any other person in respect of the matter in connection with which the assistance is provided, and
- (b) on any sum payable to the applicant under a compromise or settlement arrived at in connection with that matter to avoid, or bring to an end, any proceedings.
- (8) In Scotland, the recovery of such expenses (as taxed or assessed in accordance with rules of court) is to be paid to the Commissioner, in priority to other debts—
- (a) out of any expenses which, by virtue of any judgment or order of the court, are payable to the applicant by any other person in respect of the matter in connection with which the assistance is provided, and
- (b) out of any sum payable to the applicant under a compromise or settlement arrived at in connection with that matter to avoid, or bring to an end, any proceedings.
#### Staying special purposes proceedings
##### 176
- (1) In any special purposes proceedings before a court, if the controller or processor claims, or it appears to the court, that any personal data to which the proceedings relate—
- (a) is being processed only for the special purposes,
- (b) is being processed with a view to the publication by any person of journalistic, academic, artistic or literary material, and
- (c) has not previously been published by the controller,
the court must stay or, in Scotland, sist the proceedings.
- (2) In considering, for the purposes of subsection (1)(c), whether material has previously been published, publication in the immediately preceding 24 hours is to be ignored.
- (3) Under subsection (1), the court must stay or sist the proceedings until either of the following conditions is met—
- (a) a determination of the Commissioner under section 174 with respect to the personal data or the processing takes effect;
- (b) where the proceedings were stayed or sisted on the making of a claim, the claim is withdrawn.
#### Guidance about how to seek redress against media organisations
##### 177
- (1) The Commissioner must produce and publish guidance about the steps that may be taken where an individual considers that a media organisation is failing or has failed to comply with the data protection legislation.
- (2) In this section, “*media organisation*” means a body or other organisation whose activities consist of or include journalism.
- (3) The guidance must include provision about relevant complaints procedures, including—
- (a) who runs them,
- (b) what can be complained about, and
- (c) how to make a complaint.
- (4) For the purposes of subsection (3), relevant complaints procedures include procedures for making complaints to the Commissioner, the Office of Communications, the British Broadcasting Corporation and other persons who produce or enforce codes of practice for media organisations.
- (5) The guidance must also include provision about—
- (a) the powers available to the Commissioner in relation to a failure to comply with the data protection legislation,
- (b) when a claim in respect of such a failure may be made before a court and how to make such a claim,
- (c) alternative dispute resolution procedures,
- (d) the rights of bodies and other organisations to make complaints and claims on behalf of data subjects, and
- (e) the Commissioner's power to provide assistance in special purpose proceedings.
- (6) The Commissioner—
- (a) may alter or replace the guidance, and
- (b) must publish any altered or replacement guidance.
- (7) The Commissioner must produce and publish the first guidance under this section before the end of the period of 1 year beginning when this Act is passed.
#### Review of processing of personal data for the purposes of journalism
##### 178
- (1) The Commissioner must—
- (a) review the extent to which, during each review period, the processing of personal data for the purposes of journalism complied with—
- (i) the data protection legislation, and
- (ii) good practice in the processing of personal data for the purposes of journalism,
- (b) prepare a report of the review, and
- (c) submit the report to the Secretary of State.
- (2) In this section—
- “*good practice in the processing of personal data for the purposes of journalism*” has the same meaning as in section 124;
- “*review period*” means—the period of 4 years beginning with the day on which Chapter 2 of Part 2 of this Act comes into force, andeach subsequent period of 5 years beginning with the day after the day on which the previous review period ended.
- (3) The Commissioner must start a review under this section, in respect of a review period, within the period of 6 months beginning when the review period ends.
- (4) The Commissioner must submit the report of a review under this section to the Secretary of State—
- (a) in the case of the first review, before the end of the period of 18 months beginning when the Commissioner started the review, and
- (b) in the case of each subsequent review, before the end of the period of 12 months beginning when the Commissioner started the review.
- (5) The report must include consideration of the extent of compliance (as described in subsection (1)(a)) in each part of the United Kingdom.
- (6) The Secretary of State must—
- (a) lay the report before Parliament, and
- (b) send a copy of the report to—
- (i) the Scottish Ministers,
- (ii) the Welsh Ministers, and
- (iii) the Executive Office in Northern Ireland.
- (7) Schedule 17 makes further provision for the purposes of a review under this section.
#### Effectiveness of the media’s dispute resolution procedures
##### 179
- (1) The Secretary of State must, before the end of each review period, lay before Parliament a report produced by the Secretary of State or an appropriate person on—
- (a) the use of relevant alternative dispute resolution procedures, during that period, in cases involving a failure, or alleged failure, by a relevant media organisation to comply with the data protection legislation, and
- (b) the effectiveness of those procedures in such cases.
- (2) In this section—
- “*appropriate person*” means a person who the Secretary of State considers has appropriate experience and skills to produce a report described in subsection (1);
- “*relevant alternative dispute resolution procedures*” means alternative dispute resolution procedures provided by persons who produce or enforce codes of practice for relevant media organisations;
- “*relevant media organisation*” means a body or other organisation whose activities consist of or include journalism, other than a broadcaster;
- “*review period*” means—the period of 3 years beginning when this Act is passed, andeach subsequent period of 3 years.
- (3) The Secretary of State must send a copy of the report to—
- (a) the Scottish Ministers,
- (b) the Welsh Ministers, and
- (c) the Executive Office in Northern Ireland.
### Jurisdiction of courts
#### Jurisdiction
##### 180
- (1) The jurisdiction conferred on a court by the provisions listed in subsection (2) is exercisable—
- (a) in England and Wales, by the High Court or the county court,
- (b) in Northern Ireland, by the High Court or a county court, and
- (c) in Scotland, by the Court of Session or the sheriff,
subject to subsections (3) and (4).
- (2) Those provisions are—
- (a) section 145 (information orders);
- (b) section 152 (enforcement notices and processing for the special purposes);
- (c) section 156 (penalty notices and processing for the special purposes);
- (d) section 167 and Article 79 of the GDPR (compliance orders);
- (e) sections 168 and 169 and Article 82 of the GDPR (compensation).
- (3) In relation to the processing of personal data to which Part 4 applies, the jurisdiction conferred by the provisions listed in subsection (2) is exercisable only by the High Court or, in Scotland, the Court of Session.
- (4) In relation to an information notice which contains a statement under section 142(7), the jurisdiction conferred on a court by section 145 is exercisable only by the High Court or, in Scotland, the Court of Session.
- (5) The jurisdiction conferred on a court by section 164 (applications in respect of urgent notices) is exercisable only by the High Court or, in Scotland, the Court of Session.
### Definitions
#### Interpretation of Part 6
##### 181
In this Part—
- “*assessment notice*” has the meaning given in section 146;
- “*certification provider*” has the meaning given in section 17;
- “*enforcement notice*” has the meaning given in section 149;
- “*information notice*” has the meaning given in section 142;
- “*penalty notice*” has the meaning given in section 155;
- “*penalty variation notice*” has the meaning given in Schedule 16;
- “*representative*”, in relation to a controller or processor, means a person designated by the controller or processor under Article 27 of the GDPR to represent the controller or processor with regard to the controller's or processor's obligations under the GDPR.
## PART 7 — Supplementary and final provision
### Regulations under this Act
#### Regulations and consultation
##### 182
- (1) Regulations under this Act are to be made by statutory instrument.
- (2) Before making regulations under this Act, the Secretary of State must consult—
- (a) the Commissioner, and
- (b) such other persons as the Secretary of State considers appropriate.
- (3) Subsection (2) does not apply to regulations made under—
- (a) section 23;
- (b) section 30;
- (c) section 211;
- (d) section 212;
- (e) section 213;
- (f) paragraph 15 of Schedule 2.
- (4) Subsection (2) does not apply to regulations made under section 18 where the Secretary of State has made an urgency statement in respect of them.
- (5) Regulations under this Act may—
- (a) make different provision for different purposes;
- (b) include consequential, supplementary, incidental, transitional, transitory or saving provision.
- (6) Where regulations under this Act are subject to “the negative resolution procedure” the statutory instrument containing the regulations is subject to annulment in pursuance of a resolution of either House of Parliament.
- (7) Where regulations under this Act are subject to “the affirmative resolution procedure” the regulations may not be made unless a draft of the statutory instrument containing them has been laid before Parliament and approved by a resolution of each House of Parliament.
- (8) Where regulations under this Act are subject to “the made affirmative resolution procedure”—
- (a) the statutory instrument containing the regulations must be laid before Parliament after being made, together with the urgency statement in respect of them, and
- (b) the regulations cease to have effect at the end of the period of 120 days beginning with the day on which the instrument is made, unless within that period the instrument is approved by a resolution of each House of Parliament.
- (9) In calculating the period of 120 days, no account is to be taken of any time during which—
- (a) Parliament is dissolved or prorogued, or
- (b) both Houses of Parliament are adjourned for more than 4 days.
- (10) Where regulations cease to have effect as a result of subsection (8), that does not—
- (a) affect anything previously done under the regulations, or
- (b) prevent the making of new regulations.
- (11) Any provision that may be included in regulations under this Act subject to the negative resolution procedure may be made by regulations subject to the affirmative resolution procedure or the made affirmative resolution procedure.
- (12) If a draft of a statutory instrument containing regulations under section 7 would, apart from this subsection, be treated for the purposes of the standing orders of either House of Parliament as a hybrid instrument, it is to proceed in that House as if it were not such an instrument.
- (13) A requirement under a provision of this Act to consult may be satisfied by consultation before, as well as by consultation after, the provision comes into force.
- (14) In this section, “*urgency statement*” has the meaning given in section 18(4).
### Changes to the Data Protection Convention
#### Power to reflect changes to the Data Protection Convention
##### 183
- (1) The Secretary of State may by regulations make such provision as the Secretary of State considers necessary or appropriate in connection with an amendment of, or an instrument replacing, the Data Protection Convention which has effect, or is expected to have effect, in the United Kingdom.
- (2) The power under subsection (1) includes power—
- (a) to amend or replace the definition of “the Data Protection Convention” in section 3;
- (b) to amend Chapter 3 of Part 2 of this Act;
- (c) to amend Part 4 of this Act;
- (d) to make provision about the functions of the Commissioner, courts or tribunals in connection with processing of personal data to which Chapter 3 of Part 2 or Part 4 of this Act applies, including provision amending Parts 5 to 7 of this Act;
- (e) to make provision about the functions of the Commissioner in connection with the Data Protection Convention or an instrument replacing that Convention, including provision amending Parts 5 to 7 of this Act;
- (f) to consequentially amend this Act.
- (3) Regulations under this section are subject to the affirmative resolution procedure.
- (4) Regulations under this section may not be made after the end of the period of 3 years beginning with the day on which this Act is passed.
### Rights of the data subject
#### Prohibition of requirement to produce relevant records
##### 184
- (1) It is an offence for a person (“P1”) to require another person to provide P1 with, or give P1 access to, a relevant record in connection with—
- (a) the recruitment of an employee by P1,
- (b) the continued employment of a person by P1, or
- (c) a contract for the provision of services to P1.
- (2) It is an offence for a person (“P2”) to require another person to provide P2 with, or give P2 access to, a relevant record if—
- (a) P2 is involved in the provision of goods, facilities or services to the public or a section of the public, and
- (b) the requirement is a condition of providing or offering to provide goods, facilities or services to the other person or to a third party.
- (3) It is a defence for a person charged with an offence under subsection (1) or (2) to prove that imposing the requirement—
- (a) was required or authorised by an enactment, by a rule of law or by the order of a court or tribunal, or
- (b) in the particular circumstances, was justified as being in the public interest.
- (4) The imposition of the requirement referred to in subsection (1) or (2) is not to be regarded as justified as being in the public interest on the ground that it would assist in the prevention or detection of crime, given Part 5 of the Police Act 1997 (certificates of criminal records etc).
- (5) In subsections (1) and (2), the references to a person who requires another person to provide or give access to a relevant record include a person who asks another person to do so—
- (a) knowing that, in the circumstances, it would be reasonable for the other person to feel obliged to comply with the request, or
- (b) being reckless as to whether, in the circumstances, it would be reasonable for the other person to feel obliged to comply with the request,
and the references to a “requirement” in subsections (3) and (4) are to be interpreted accordingly.
- (6) In this section—
- “*employment*” means any employment, including—work under a contract for services or as an office-holder,work under an apprenticeship,work experience as part of a training course or in the course of training for employment, andvoluntary work,and “employee” is to be interpreted accordingly;
- “*relevant record*” has the meaning given in Schedule 18 and references to a relevant record include—a part of such a record, anda copy of, or of part of, such a record.
#### Avoidance of certain contractual terms relating to health records
##### 185
- (1) A term or condition of a contract is void in so far as it purports to require an individual to supply another person with a record which—
- (a) consists of the information contained in a health record, and
- (b) has been or is to be obtained by a data subject in the exercise of a data subject access right.
- (2) A term or condition of a contract is also void in so far as it purports to require an individual to produce such a record to another person.
- (3) The references in subsections (1) and (2) to a record include a part of a record and a copy of all or part of a record.
- (4) In this section, “*data subject access right*” means a right under—
- (a) Article 15 of the GDPR (right of access by the data subject);
- (b) Article 20 of the GDPR (right to data portability);
- (c) section 45 of this Act (law enforcement processing: right of access by the data subject);
- (d) section 94 of this Act (intelligence services processing: right of access by the data subject).
#### Data subject’s rights and other prohibitions and restrictions
##### 186
- (1) An enactment or rule of law prohibiting or restricting the disclosure of information, or authorising the withholding of information, does not remove or restrict the obligations and rights provided for in the provisions listed in subsection (2), except as provided by or under the provisions listed in subsection (3).
- (2) The provisions providing obligations and rights are—
- (a) Chapter III of the GDPR (rights of the data subject),
- (b) Chapter 3 of Part 3 of this Act (law enforcement processing: rights of the data subject), and
- (c) Chapter 3 of Part 4 of this Act (intelligence services processing: rights of the data subject).
- (3) The provisions providing exceptions are—
- (a) in Chapter 2 of Part 2 of this Act, sections 15 and 16 and Schedules 2, 3 and 4,
- (b) in Chapter 3 of Part 2 of this Act, sections 23, 24, 25 and 26,
- (c) in Part 3 of this Act, sections 44(4), 45(4) and 48(3), and
- (d) in Part 4 of this Act, Chapter 6 .
### Representation of data subjects
#### Representation of data subjects with their authority
##### 187
- (1) In relation to the processing of personal data to which the GDPR applies—
- (a) Article 80(1) of the GDPR (representation of data subjects) enables a data subject to authorise a body or other organisation which meets the conditions set out in that Article to exercise the data subject's rights under Articles 77, 78 and 79 of the GDPR (rights to lodge complaints and to an effective judicial remedy) on the data subject's behalf, and
- (b) a data subject may also authorise such a body or organisation to exercise the data subject's rights under Article 82 of the GDPR (right to compensation).
- (2) In relation to the processing of personal data to which the GDPR does not apply, a body or other organisation which meets the conditions in subsections (3) and (4), if authorised to do so by a data subject, may exercise some or all of the following rights of a data subject on the data subject's behalf—
- (a) rights under section 165(2), (4)(d) and (6)(c) (complaints to the Commissioner);
- (b) rights under section 166(2) (orders for the Commissioner to progress complaints);
- (c) rights under section 167(1) (compliance orders);
- (d) the right to bring judicial review proceedings against the Commissioner.
- (3) The first condition is that the body or organisation, by virtue of its constitution or an enactment—
- (a) is required (after payment of outgoings) to apply the whole of its income and any capital it expends for charitable or public purposes,
- (b) is prohibited from directly or indirectly distributing amongst its members any part of its assets (otherwise than for charitable or public purposes), and
- (c) has objectives which are in the public interest.
- (4) The second condition is that the body or organisation is active in the field of protection of data subjects' rights and freedoms with regard to the protection of their personal data.
- (5) In this Act, references to a “*representative body*”, in relation to a right of a data subject, are to a body or other organisation authorised to exercise the right on the data subject's behalf under Article 80 of the GDPR or this section.
#### Representation of data subjects with their authority: collective proceedings
##### 188
- (1) The Secretary of State may by regulations make provision for representative bodies to bring proceedings before a court or tribunal in England and Wales or Northern Ireland combining two or more relevant claims.
- (2) In this section, “*relevant claim*”, in relation to a representative body, means a claim in respect of a right of a data subject which the representative body is authorised to exercise on the data subject's behalf under Article 80(1) of the GDPR or section 187.
- (3) The power under subsection (1) includes power—
- (a) to make provision about the proceedings;
- (b) to confer functions on a person, including functions involving the exercise of a discretion;
- (c) to make different provision in relation to England and Wales and in relation to Northern Ireland.
- (4) The provision mentioned in subsection (3)(a) includes provision about—
- (a) the effect of judgments and orders;
- (b) agreements to settle claims;
- (c) the assessment of the amount of compensation;
- (d) the persons to whom compensation may or must be paid, including compensation not claimed by the data subject;
- (e) costs.
- (5) Regulations under this section are subject to the negative resolution procedure.
#### Duty to review provision for representation of data subjects
##### 189
- (1) Before the end of the review period, the Secretary of State must—
- (a) review the matters listed in subsection (2) in relation to England and Wales and Northern Ireland,
- (b) prepare a report of the review, and
- (c) lay a copy of the report before Parliament.
- (2) Those matters are—
- (a) the operation of Article 80(1) of the GDPR,
- (b) the operation of section 187,
- (c) the merits of exercising the power under Article 80(2) of the GDPR (power to enable a body or other organisation which meets the conditions in Article 80(1) of the GDPR to exercise some or all of a data subject's rights under Articles 77, 78 and 79 of the GDPR without being authorised to do so by the data subject),
- (d) the merits of making equivalent provision in relation to data subjects' rights under Article 82 of the GDPR (right to compensation), and
- (e) the merits of making provision for a children's rights organisation to exercise some or all of a data subject's rights under Articles 77, 78, 79 and 82 of the GDPR on behalf of a data subject who is a child, with or without being authorised to do so by the data subject.
- (3) “The review period” is the period of 30 months beginning when section 187 comes into force.
- (4) In carrying out the review, the Secretary of State must—
- (a) consider the particular needs of children separately from the needs of adults,
- (b) have regard to the fact that children have different needs at different stages of development,
- (c) carry out an analysis of the particular challenges that children face in authorising, and deciding whether to authorise, other persons to act on their behalf under Article 80(1) of the GDPR or section 187,
- (d) consider the support and advice available to children in connection with the exercise of their rights under Articles 77, 78, 79 and 82 of the GDPR by another person on their behalf and the merits of making available other support or advice, and
- (e) have regard to the United Kingdom's obligations under the United Nations Convention on the Rights of the Child.
- (5) Before preparing the report under subsection (1), the Secretary of State must consult the Commissioner and such other persons as the Secretary of State considers appropriate, including—
- (a) persons active in the field of protection of data subjects' rights and freedoms with regard to the protection of their personal data,
- (b) children and parents,
- (c) children's rights organisations and other persons who appear to the Secretary of State to represent the interests of children,
- (d) child development experts, and
- (e) trade associations.
- (6) In this section—
- “*children's rights organisation*” means a body or other organisation which—is active in representing the interests of children, andhas objectives which are in the public interest;
- “*trade association*” includes a body representing controllers or processors;
- “*the United Nations Convention on the Rights of the Child*” means the Convention on the Rights of the Child adopted by the General Assembly of the United Nations on 20 November 1989 (including any Protocols to that Convention which are in force in relation to the United Kingdom), subject to any reservations, objections or interpretative declarations by the United Kingdom for the time being in force.
#### Post-review powers to make provision about representation of data subjects
##### 190
- (1) After the report under section 189(1) is laid before Parliament, the Secretary of State may by regulations—
- (a) exercise the powers under Article 80(2) of the GDPR in relation to England and Wales and Northern Ireland,
- (b) make provision enabling a body or other organisation which meets the conditions in Article 80(1) of the GDPR to exercise a data subject's rights under Article 82 of the GDPR in England and Wales and Northern Ireland without being authorised to do so by the data subject, and
- (a) exercise the powers under Article 80(2) of the UK GDPR in relation to England and Wales and Northern Ireland,
- (b) make provision enabling a body or other organisation which meets the conditions in Article 80(1) of the UK GDPR to exercise a data subject's rights under Article 82 of the UK GDPR in England and Wales and Northern Ireland without being authorised to do so by the data subject, and
- (c) make provision described in section 189(2)(e) in relation to the exercise in England and Wales and Northern Ireland of the rights of a data subject who is a child.
@@ -6002,17 +5964,17 @@
- “*data concerning health*” means personal data relating to the physical or mental health of an individual, including the provision of health care services, which reveals information about his or her health status;
- “*enactment*” includes—an enactment passed or made after this Act,an enactment comprised in subordinate legislation,an enactment comprised in, or in an instrument made under, a Measure or Act of the National Assembly for Wales,an enactment comprised in, or in an instrument made under, an Act of the Scottish Parliament, andan enactment comprised in, or in an instrument made under, Northern Ireland legislation;
- “*enactment*” includes—an enactment passed or made after this Act,an enactment comprised in subordinate legislation,an enactment comprised in, or in an instrument made under, a Measure or Act of the National Assembly for Wales,an enactment comprised in, or in an instrument made under, an Act of the Scottish Parliament, ...an enactment comprised in, or in an instrument made under, Northern Ireland legislation; andany retained direct EU legislation;
- “*genetic data*” means personal data relating to the inherited or acquired genetic characteristics of an individual which gives unique information about the physiology or the health of that individual and which results, in particular, from an analysis of a biological sample from the individual in question;
- “*government department*” includes �??the following (except in the expression “*United Kingdom government department*”)—a part of the Scottish Administration;a Northern Ireland department;the Welsh Government;a body or authority exercising statutory functions on behalf of the Crown;
- “*government department*” includes the following (except in the expression “*United Kingdom government department*”)—a part of the Scottish Administration;a Northern Ireland department;the Welsh Government;a body or authority exercising statutory functions on behalf of the Crown;
- “*health record*” means a record which—consists of data concerning health, andhas been made by or on behalf of a health professional in connection with the diagnosis, care or treatment of the individual to whom the data relates;
- “*inaccurate*”, in relation to personal data, means incorrect or misleading as to any matter of fact;
- “*international obligation of the United Kingdom*” includes—an EU obligation, andan obligation that arises under an international agreement or arrangement to which the United Kingdom is a party;
- “*international obligation of the United Kingdom*” includes—...an obligation that arises under an international agreement or arrangement to which the United Kingdom is a party;
- “*international organisation*” means an organisation and its subordinate bodies governed by international law, or any other body which is set up by, or on the basis of, an agreement between two or more countries;
@@ -6026,8 +5988,12 @@
- “*the Tribunal*”, in relation to an application or appeal under this Act, means—the Upper Tribunal, in any case where it is determined by or under Tribunal Procedure Rules that the Upper Tribunal is to hear the application or appeal, orthe First-tier Tribunal, in any other case.
- (1A) In this Act, references to a fundamental right or fundamental freedom (however expressed) are to a fundamental right or fundamental freedom which continues to form part of domestic law on and after IP completion day by virtue of section 4 of the European Union (Withdrawal) Act 2018, as the right or freedom is amended or otherwise modified by the law of the United Kingdom, or of a part of the United Kingdom, from time to time on or after IP completion day.
- (2) References in this Act to a period expressed in hours, days, weeks, months or years are to be interpreted in accordance with Article 3 of Regulation (EEC, Euratom) No. 1182/71 of the Council of 3 June 1971 determining the rules applicable to periods, dates and time limits, except in—
- (za) section 119A(10) and (11);
- (a) section 125(4), (7) and (8);
- (b) section 161(3), (5) and (6);
@@ -6054,9 +6020,17 @@
- (m) Schedule 15;
(and the references in section 5 to terms used in Chapter 2 or 3 of Part 2 do not include references to a period expressed in hours, days, weeks, months or years).
- (3) Section 3(14)(b) (interpretation of references to Chapter 2 of Part 2 in Parts 5 to 7) and the amendments in Schedule 19 which make equivalent provision are not to be treated as implying a contrary intention for the purposes of section 20(2) of the Interpretation Act 1978, or any similar provision in another enactment, as it applies to other references to, or to a provision of, Chapter 2 of Part 2 of this Act.
(and the references in section 5 to terms used in ... Part 2 do not include references to a period expressed in hours, days, weeks, months or years).
- (3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (4) In the definition of “the UK GDPR” in section 3(10)—
- (a) the reference to Regulation (EU) 2016/679 as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 is to be treated as a reference to that Regulation as modified by Schedule 1 to the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (“*the 2019 Regulations*”), but
- (b) nothing in the definition or in paragraph (a) determines whether, where Regulation (EU) 2016/679 is modified on or after IP completion day by the law of England and Wales, Scotland or Northern Ireland (other than by Schedule 1 to the 2019 Regulations), the reference to Regulation (EU) 2016/679 is then to be read as a reference to that Regulation as modified.
- (5) Subsection (4) is not to be read as implying anything about how other references to Regulation (EU) 2016/679 or references to other retained EU law are to be interpreted.
#### Index of defined expressions
@@ -6070,27 +6044,19 @@
##### 207
- (1) This Act applies only to processing of personal data described in subsections (2) and (3).
- (2) It applies to the processing of personal data in the context of the activities of an establishment of a controller or processor in the United Kingdom, whether or not the processing takes place in the United Kingdom.
- (3) It also applies to the processing of personal data to which Chapter 2 of Part 2 (the GDPR) applies where—
- (a) the processing is carried out in the context of the activities of an establishment of a controller or processor in a country or territory that is not a member State, whether or not the processing takes place in such a country or territory,
- (b) the personal data relates to a data subject who is in the United Kingdom when the processing takes place, and
- (c) the processing activities are related to—
- (i) the offering of goods or services to data subjects in the United Kingdom, whether or not for payment, or
- (ii) the monitoring of data subjects' behaviour in the United Kingdom.
- (4) Subsections (1) to (3) have effect subject to any provision in or made under section 120 providing for the Commissioner to carry out functions in relation to other processing of personal data.
- (1) This Act applies only to processing of personal data described in subsections (1A) and (2).
- (1A) In the case of the processing of personal data to which Part 2 (the UK GDPR) applies, it applies to the types of such processing to which the UK GDPR applies by virtue of Article 3 of the UK GDPR.
- (2) In the case of the processing of personal data to which Part 2 does not apply, it applies where such processing is carried out in the context of the activities of an establishment of a controller or processor in the United Kingdom, whether or not the processing takes place in the United Kingdom.
- (3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (4) Subsections (1), (1A) and (2) have effect subject to any provision in or made under section 120 providing for the Commissioner to carry out functions in relation to other processing of personal data.
- (5) Section 3(14)(c) does not apply to the reference to the processing of personal data in subsection (2).
- (6) The reference in subsection (3) to Chapter 2 of Part 2 (the GDPR) does not include that Chapter as applied by Chapter 3 of Part 2 (the applied GDPR).
- (6) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (7) In this section, references to a person who has an establishment in the United Kingdom include the following—
@@ -6102,7 +6068,7 @@
- (d) a person not within paragraph (a), (b) or (c) who maintains, and carries on activities through, an office, branch or agency or other stable arrangements in the United Kingdom,
and references to a person who has an establishment in another country or territory have a corresponding meaning.
....
### General
@@ -6126,11 +6092,11 @@
- (1) This Act binds the Crown.
- (2) For the purposes of the GDPR and this Act, each government department is to be treated as a person separate from the other government departments (to the extent that is not already the case).
- (3) Where government departments are not able to enter into contracts with each other, a provision of the GDPR or this Act that would require relations between them to be governed by a contract (or other binding legal act) in writing is to be treated as satisfied if the relations are the subject of a memorandum of understanding between them.
- (4) Where the purposes for which and the manner in which personal data is, or is to be, processed are determined by a person acting on behalf of the Royal Household, the Duchy of Lancaster or the Duchy of Cornwall, the controller in respect of that data for the purposes of the GDPR and this Act is—
- (2) For the purposes of the UK GDPR and this Act, each government department is to be treated as a person separate from the other government departments (to the extent that is not already the case).
- (3) Where government departments are not able to enter into contracts with each other, a provision of the UK GDPR or this Act that would require relations between them to be governed by a contract (or other binding legal act) in writing is to be treated as satisfied if the relations are the subject of a memorandum of understanding between them.
- (4) Where the purposes for which and the manner in which personal data is, or is to be, processed are determined by a person acting on behalf of the Royal Household, the Duchy of Lancaster or the Duchy of Cornwall, the controller in respect of that data for the purposes of the UK GDPR and this Act is—
- (a) in relation to the Royal Household, the Keeper of the Privy Purse,
@@ -6166,9 +6132,9 @@
- (1) Parts 1, 2 and 5 to 7 of this Act apply to the processing of personal data by or on behalf of either House of Parliament.
- (2) Where the purposes for which and the manner in which personal data is, or is to be, processed are determined by or on behalf of the House of Commons, the controller in respect of that data for the purposes of the GDPR and this Act is the Corporate Officer of that House.
- (3) Where the purposes for which and the manner in which personal data is, or is to be, processed are determined by or on behalf of the House of Lords, the controller in respect of that data for the purposes of the GDPR and this Act is the Corporate Officer of that House.
- (2) Where the purposes for which and the manner in which personal data is, or is to be, processed are determined by or on behalf of the House of Commons, the controller in respect of that data for the purposes of the UK GDPR and this Act is the Corporate Officer of that House.
- (3) Where the purposes for which and the manner in which personal data is, or is to be, processed are determined by or on behalf of the House of Lords, the controller in respect of that data for the purposes of the UK GDPR and this Act is the Corporate Officer of that House.
- (4) Subsections (2) and (3) do not apply where the purposes for which and the manner in which the personal data is, or is to be, processed are determined by or on behalf of the Intelligence and Security Committee of Parliament.
@@ -6268,10 +6234,12 @@
- (1) Schedule 20 contains transitional, transitory and saving provision.
- (2) The Secretary of State may by regulations make transitional, transitory or saving provision in connection with the coming into force of any provision of this Act or with the GDPR beginning to apply, including provision amending or repealing a provision of Schedule 20.
- (2) The Secretary of State may by regulations make transitional, transitory or saving provision in connection with the coming into force of any provision of this Act or with the EU GDPR beginning to apply, including provision amending or repealing a provision of Schedule 20.
- (3) Regulations under this section that amend or repeal a provision of Schedule 20 are subject to the negative resolution procedure.
- (4) Schedule 21 contains further transitional, transitory and saving provision made in connection with the amendment of this Act and the UK GDPR by regulations under section 8 of the European Union (Withdrawal) Act 2018.
#### Extent
##### 214
@@ -6320,9 +6288,9 @@
- (3) In this paragraph—
- “*social security*” includes any of the branches of social security listed in Article 3(1) of Regulation [(EC) No. 883/2004](https://www.legislation.gov.uk/european/regulation/2004/0883) of the European Parliament and of the Council on the co-ordination of social security systems (as amended from time to time);
- “*social protection*” includes an intervention described in Article 2(b) of Regulation [(EC) 458/2007](https://www.legislation.gov.uk/european/regulation/2007/0458) of the European Parliament and of the Council of 25 April 2007 on the European system of integrated social protection statistics (ESSPROS) (as amended from time to time).
- “*social security*” includes any of the branches of social security listed in Article 3(1) of Regulation [(EC) No. 883/2004](https://www.legislation.gov.uk/eur/2004/883) of the European Parliament and of the Council on the co-ordination of social security systems (as amended from time to time);
- “*social protection*” includes an intervention described in Article 2(b) of Regulation [(EC) 458/2007](https://www.legislation.gov.uk/eur/2007/458) of the European Parliament and of the Council of 25 April 2007 on the European system of integrated social protection statistics (ESSPROS) as it had effect in EU law immediately before exit day.
#### Health or social care purposes
@@ -6344,7 +6312,7 @@
- (f) the management of health care systems or services or social care systems or services.
- (3) See also the conditions and safeguards in Article 9(3) of the GDPR (obligations of secrecy) and section 11(1).
- (3) See also the conditions and safeguards in Article 9(3) of the UK GDPR (obligations of secrecy) and section 11(1).
#### Public health
@@ -6368,7 +6336,7 @@
- (a) is necessary for archiving purposes, scientific or historical research purposes or statistical purposes,
- (b) is carried out in accordance with Article 89(1) of the GDPR (as supplemented by section 19), and
- (b) is carried out in accordance with Article 89(1) of the UK GDPR (as supplemented by section 19), and
- (c) is in the public interest.
@@ -6883,7 +6851,7 @@
- (d) a member of the Northern Ireland Assembly;
- (e) a member of the European Parliament elected in the United Kingdom;
- (e) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (f) an elected member of a local authority within the meaning of section 270(1) of the Local Government Act 1972, namely—
@@ -7139,7 +7107,7 @@
The controller has an appropriate policy document in place in relation to the processing of personal data in reliance on a condition described in paragraph 38 if the controller has produced a document which—
- (a) explains the controller's procedures for securing compliance with the principles in Article 5 of the GDPR (principles relating to processing of personal data) in connection with the processing of personal data in reliance on the condition in question, and
- (a) explains the controller's procedures for securing compliance with the principles in Article 5 of the UK GDPR (principles relating to processing of personal data) in connection with the processing of personal data in reliance on the condition in question, and
- (b) explains the controller's policies as regards the retention and erasure of personal data processed in reliance on the condition, giving an indication of how long such personal data is likely to be retained.
@@ -7165,17 +7133,17 @@
##### 41
A record maintained by the controller, or the controller's representative, under Article 30 of the GDPR in respect of the processing of personal data in reliance on a condition described in paragraph 38 must include the following information—
A record maintained by the controller, or the controller's representative, under Article 30 of the UK GDPR in respect of the processing of personal data in reliance on a condition described in paragraph 38 must include the following information—
- (a) which condition is relied on,
- (b) how the processing satisfies Article 6 of the GDPR (lawfulness of processing), and
- (b) how the processing satisfies Article 6 of the UK GDPR (lawfulness of processing), and
- (c) whether the personal data is retained and erased in accordance with the policies described in paragraph 39(b) and, if it is not, the reasons for not following those policies.
## SCHEDULE 2
## PART 1 — Adaptations and restrictions based on Articles 6(3) and 23(1)
## PART 1 — Adaptations and restrictions as described in Articles 6(3) and 23(1)
#### GDPR provisions to be adapted or restricted: “the listed GDPR provisions”
@@ -7183,7 +7151,7 @@
In this Part of this Schedule, “*the listed GDPR provisions*” means—
- (a) the following provisions of the GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the GDPR)—
- (a) the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR)—
- (i) Article 13(1) to (3) (personal data collected from data subject: information to be provided);
@@ -7205,7 +7173,7 @@
- (x) Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (i) to (ix); and
- (b) the following provisions of the GDPR (the application of which may be adapted by virtue of Article 6(3) of the GDPR)—
- (b) the following provisions of the UK GDPR (the application of which may be adapted by virtue of Article 6(3) of the UK GDPR)—
- (i) Article 5(1)(a) (lawful, fair and transparent processing), other than the lawfulness requirements set out in Article 6;
@@ -7215,7 +7183,7 @@
##### 2
- (1) The listed GDPR provisions and Article 34(1) and (4) of the GDPR (communication of personal data breach to the data subject) do not apply to personal data processed for any of the following purposes—
- (1) The listed GDPR provisions and Article 34(1) and (4) of the UK GDPR (communication of personal data breach to the data subject) do not apply to personal data processed for any of the following purposes—
- (a) the prevention or detection of crime,
@@ -7231,7 +7199,7 @@
- (b) another person (“Controller 2”) obtains the data from Controller 1 for the purpose of discharging statutory functions and processes it for the purpose of discharging statutory functions.
- (3) Controller 2 is exempt from the obligations in the following provisions of the GDPR—
- (3) Controller 2 is exempt from the obligations in the following provisions of the UK GDPR—
- (a) Article 13(1) to (3) (personal data collected from data subject: information to be provided),
@@ -7247,7 +7215,7 @@
##### 3
- (1) The GDPR provisions listed in sub-paragraph (3) do not apply to personal data which consists of a classification applied to the data subject as part of a risk assessment system falling within sub-paragraph (2) to the extent that the application of those provisions would prevent the system from operating effectively.
- (1) The UK GDPR provisions listed in sub-paragraph (3) do not apply to personal data which consists of a classification applied to the data subject as part of a risk assessment system falling within sub-paragraph (2) to the extent that the application of those provisions would prevent the system from operating effectively.
- (2) A risk assessment system falls within this sub-paragraph if—
@@ -7259,7 +7227,7 @@
- (ii) the prevention or detection of crime or apprehension or prosecution of offenders, where the offence concerned involves the unlawful use of public money or an unlawful claim for payment out of public money.
- (3) The GDPR provisions referred to in sub-paragraph (1) are the following provisions of the GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the GDPR)—
- (3) The UK GDPR provisions referred to in sub-paragraph (1) are the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR)—
- (a) Article 13(1) to (3) (personal data collected from data subject: information to be provided);
@@ -7273,7 +7241,7 @@
##### 4
- (1) The GDPR provisions listed in sub-paragraph (2) do not apply to personal data processed for any of the following purposes—
- (1) The UK GDPR provisions listed in sub-paragraph (2) do not apply to personal data processed for any of the following purposes—
- (a) the maintenance of effective immigration control, or
@@ -7281,7 +7249,7 @@
to the extent that the application of those provisions would be likely to prejudice any of the matters mentioned in paragraphs (a) and (b).
- (2) The GDPR provisions referred to in sub-paragraph (1) are the following provisions of the GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the GDPR)—
- (2) The UK GDPR provisions referred to in sub-paragraph (1) are the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR)—
- (a) Article 13(1) to (3) (personal data collected from data subject: information to be provided);
@@ -7305,7 +7273,7 @@
- (b) another person (“Controller 2”) obtains the data from Controller 1 for any of the purposes mentioned in sub-paragraph (1)(a) and (b) and processes it for any of those purposes.
- (4) Controller 1 is exempt from the obligations in the following provisions of the GDPR—
- (4) Controller 1 is exempt from the obligations in the following provisions of the UK GDPR—
- (a) Article 13(1) to (3) (personal data collected from data subject: information to be provided),
@@ -7335,13 +7303,13 @@
to the extent that the application of those provisions would prevent the controller from making the disclosure.
## PART 2 — Restrictions based on Article 23(1): restrictions of rules in Articles 13 to 21 and 34
## PART 2 — Restrictions as described in Article 23(1): restrictions of rules in Articles 13 to 21 and 34
#### GDPR provisions to be restricted: “the listed GDPR provisions”
##### 6
In this Part of this Schedule, “*the listed GDPR provisions*” means the following provisions of the GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the GDPR)—
In this Part of this Schedule, “*the listed GDPR provisions*” means the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR)—
- (a) Article 13(1) to (3) (personal data collected from data subject: information to be provided);
@@ -7445,9 +7413,9 @@
In the Table in paragraph 11—
- “*consumer protection enforcer*” has the same meaning as “*CPC enforcer*” in section 213(5A) of the Enterprise Act 2002;
- the “*CPC Regulation*” has the meaning given in section 235A of the Enterprise Act 2002;
- ...
- ...
- the “*Financial Ombudsman*” means the scheme operator within the meaning of Part 16 of the Financial Services and Markets Act 2000 (see section 225 of that Act);
@@ -7461,7 +7429,7 @@
##### 13
The listed GDPR provisions and Article 34(1) and (4) of the GDPR (communication of personal data breach to the data subject) do not apply to personal data where this is required for the purpose of avoiding an infringement of the privileges of either House of Parliament.
The listed GDPR provisions and Article 34(1) and (4) of the UK GDPR (communication of personal data breach to the data subject) do not apply to personal data where this is required for the purpose of avoiding an infringement of the privileges of either House of Parliament.
#### Judicial appointments, judicial independence and judicial proceedings
@@ -7511,13 +7479,13 @@
- (4) Regulations under sub-paragraph (3) are subject to the affirmative resolution procedure.
## PART 3 — Restriction based on Article 23(1): protection of rights of others
## PART 3 — Restriction for the protection of rights of others
#### Protection of the rights of others: general
##### 16
- (1) Article 15(1) to (3) of the GDPR (confirmation of processing, access to data and safeguards for third country transfers), and Article 5 of the GDPR so far as its provisions correspond to the rights and obligations provided for in Article 15(1) to (3), do not oblige a controller to disclose information to the data subject to the extent that doing so would involve disclosing information relating to another individual who can be identified from the information.
- (1) Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers), and Article 5 of the UK GDPR so far as its provisions correspond to the rights and obligations provided for in Article 15(1) to (3), do not oblige a controller to disclose information to the data subject to the extent that doing so would involve disclosing information relating to another individual who can be identified from the information.
- (2) Sub-paragraph (1) does not remove the controller's obligation where—
@@ -7599,13 +7567,13 @@
- “*relevant social services functions*” means functions specified in paragraph 8(1)(a), (b), (c) or (d) of Schedule 3.
## PART 4 — Restrictions based on Article 23(1): restrictions of rules in Articles 13 to 15
## PART 4 — Restrictions as described in Article 23(1): restrictions of rules in Articles 13 to 15
#### GDPR provisions to be restricted: “the listed GDPR provisions”
##### 18
In this Part of this Schedule, “*the listed GDPR provisions*” means the following provisions of the GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the GDPR)—
In this Part of this Schedule, “*the listed GDPR provisions*” means the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR)—
- (a) Article 13(1) to (3) (personal data collected from data subject: information to be provided);
@@ -7641,7 +7609,7 @@
- (d) Article 10 of the Perjury (Northern Ireland) Order 1979 (S.I. 1979/1714 (N.I. 19)) (false statutory declarations and other false unsworn statements).
- (3) Information disclosed by any person in compliance with Article 15 of the GDPR is not admissible against the person in proceedings for an offence under this Act.
- (3) Information disclosed by any person in compliance with Article 15 of the UK GDPR is not admissible against the person in proceedings for an offence under this Act.
#### Corporate finance
@@ -7711,9 +7679,9 @@
- (b) in consequence of the determination of the results of an exam,
the duty in Article 12(3) or (4) of the GDPR for the controller to provide information requested by the data subject within a certain time period, as it applies to Article 15 of the GDPR (confirmation of processing, access to data and safeguards for third country transfers), is modified as set out in sub-paragraph (3).
- (3) Where a question arises as to whether the controller is obliged by Article 15 of the GDPR to disclose personal data, and the question arises before the day on which the exam results are announced, the controller must provide the information mentioned in Article 12(3) or (4)—
the duty in Article 12(3) or (4) of the UK GDPR for the controller to provide information requested by the data subject within a certain time period, as it applies to Article 15 of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers), is modified as set out in sub-paragraph (3).
- (3) Where a question arises as to whether the controller is obliged by Article 15 of the UK GDPR to disclose personal data, and the question arises before the day on which the exam results are announced, the controller must provide the information mentioned in Article 12(3) or (4)—
- (a) before the end of the period of 5 months beginning when the question arises, or
@@ -7723,7 +7691,7 @@
- (5) For the purposes of this paragraph, the results of an exam are treated as announced when they are first published or, if not published, first communicated to the candidate.
## PART 5 — Exemptions etc based on Article 85(2) for reasons of freedom of expression and information
## PART 5 — Exemptions etc ... for reasons of freedom of expression and information
#### Journalistic, academic, artistic and literary purposes
@@ -7763,9 +7731,9 @@
- (8) Regulations under sub-paragraph (7) are subject to the affirmative resolution procedure.
- (9) For the purposes of this paragraph, the listed GDPR provisions are the following provisions of the GDPR (which may be exempted or derogated from by virtue of Article 85(2) of the GDPR)—
- (a) in Chapter II of the GDPR (principles)—
- (9) For the purposes of this paragraph, the listed GDPR provisions are the following provisions of the UK GDPR (which may be exempted or derogated from by virtue of Article 85(2) of the UK GDPR)—
- (a) in Chapter II of the UK GDPR (principles)—
- (i) Article 5(1)(a) to (e) (principles relating to processing);
@@ -7781,7 +7749,7 @@
- (vii) Article 11(2) (processing not requiring identification);
- (b) in Chapter III of the GDPR (rights of the data subject)—
- (b) in Chapter III of the UK GDPR (rights of the data subject)—
- (i) Article 13(1) to (3) (personal data collected from data subject: information to be provided);
@@ -7801,21 +7769,17 @@
- (ix) Article 21(1) (objections to processing);
- (c) in Chapter IV of the GDPR (controller and processor)—
- (c) in Chapter IV of the UK GDPR (controller and processor)—
- (i) Article 34(1) and (4) (communication of personal data breach to the data subject);
- (ii) Article 36 (requirement for controller to consult Commissioner prior to high risk processing);
- (d) in Chapter V of the GDPR (transfers of data to third countries etc), Article 44 (general principles for transfers);
- (e) in Chapter VII of the GDPR (co-operation and consistency)—
- (i) Articles 60 to 62 (co-operation);
- (ii) Articles 63 to 67 (consistency).
## PART 6 — Derogations etc based on Article 89 for research, statistics and archiving
- (d) in Chapter V of the UK GDPR (transfers of data to third countries etc), Article 44 (general principles for transfers);
- (e) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
## PART 6 — Derogations etc ... for research, statistics and archiving
#### Research and statistics
@@ -7829,9 +7793,9 @@
to the extent that the application of those provisions would prevent or seriously impair the achievement of the purposes in question.
This is subject to sub-paragraph (3).
- (2) For the purposes of this paragraph, the listed GDPR provisions are the following provisions of the GDPR (the rights in which may be derogated from by virtue of Article 89(2) of the GDPR)—
This is subject to sub-paragraphs (3) and (4).
- (2) For the purposes of this paragraph, the listed GDPR provisions are the following provisions of the UK GDPR—
- (a) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);
@@ -7843,19 +7807,21 @@
- (3) The exemption in sub-paragraph (1) is available only where—
- (a) the personal data is processed in accordance with Article 89(1) of the GDPR (as supplemented by section 19), and
- (a) the personal data is processed in accordance with Article 89(1) of the UK GDPR (as supplemented by section 19), and
- (b) as regards the disapplication of Article 15(1) to (3), the results of the research or any resulting statistics are not made available in a form which identifies a data subject.
- (4) Where processing for a purpose described in sub-paragraph (1) serves at the same time another purpose, the exemption in sub-paragraph (1) is available only where the personal data is processed for a purpose referred to in that sub-paragraph.
#### Archiving in the public interest
##### 28
- (1) The listed GDPR provisions do not apply to personal data processed for archiving purposes in the public interest to the extent that the application of those provisions would prevent or seriously impair the achievement of those purposes.
This is subject to sub-paragraph (3).
- (2) For the purposes of this paragraph, the listed GDPR provisions are the following provisions of the GDPR (the rights in which may be derogated from by virtue of Article 89(3) of the GDPR)—
This is subject to sub-paragraphs (3) and (4).
- (2) For the purposes of this paragraph, the listed GDPR provisions are the following provisions of the UK GDPR—
- (a) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);
@@ -7869,15 +7835,17 @@
- (f) Article 21(1) (objections to processing).
- (3) The exemption in sub-paragraph (1) is available only where the personal data is processed in accordance with Article 89(1) of the GDPR (as supplemented by section 19).
- (3) The exemption in sub-paragraph (1) is available only where the personal data is processed in accordance with Article 89(1) of the UK GDPR (as supplemented by section 19).
- (4) Where processing for a purpose described in sub-paragraph (1) serves at the same time another purpose, the exemption in sub-paragraph (1) is available only where the personal data is processed for a purpose referred to in that sub-paragraph.
## SCHEDULE 3
## PART 1 — GDPR provisions to be restricted
## PART 1 — UK GDPR provisions to be restricted
##### 1
In this Schedule “*the listed GDPR provisions*” means the following provisions of the GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the GDPR)—
In this Schedule “*the listed GDPR provisions*” means the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR)—
- (a) Article 13(1) to (3) (personal data collected from data subject: information to be provided);
@@ -7909,7 +7877,7 @@
- “*war pension*” has the same meaning as in section 25 of the Social Security Act 1989 (establishment and functions of war pensions committees).
- (2) For the purposes of this Part of this Schedule, the “serious harm test” is met with respect to data concerning health if the application of Article 15 of the GDPR to the data would be likely to cause serious harm to the physical or mental health of the data subject or another individual.
- (2) For the purposes of this Part of this Schedule, the “serious harm test” is met with respect to data concerning health if the application of Article 15 of the UK GDPR to the data would be likely to cause serious harm to the physical or mental health of the data subject or another individual.
#### Exemption from the listed GDPR provisions: data processed by a court
@@ -7967,7 +7935,7 @@
##### 5
- (1) Article 15(1) to (3) of the GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not apply to data concerning health to the extent that the serious harm test is met with respect to the data.
- (1) Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not apply to data concerning health to the extent that the serious harm test is met with respect to the data.
- (2) A controller who is not a health professional may not rely on sub-paragraph (1) to withhold data concerning health unless the controller has obtained an opinion from the person who appears to the controller to be the appropriate health professional to the effect that the serious harm test is met with respect to the data.
@@ -7983,7 +7951,7 @@
##### 6
- (1) Article 15(1) to (3) of the GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not permit the disclosure of data concerning health by a controller who is not a health professional unless the controller has obtained an opinion from the person who appears to the controller to be the appropriate health professional to the effect that the serious harm test is not met with respect to the data.
- (1) Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not permit the disclosure of data concerning health by a controller who is not a health professional unless the controller has obtained an opinion from the person who appears to the controller to be the appropriate health professional to the effect that the serious harm test is not met with respect to the data.
- (2) Sub-paragraph (1) does not apply to the extent that the controller is satisfied that the data concerning health has already been seen by, or is within the knowledge of, the data subject.
@@ -8011,7 +7979,7 @@
- “*social work data*” means personal data which—is data to which paragraph 8 applies, butis not education data or data concerning health.
- (2) For the purposes of this Part of this Schedule, the “serious harm test” is met with respect to social work data if the application of Article 15 of the GDPR to the data would be likely to prejudice carrying out social work, because it would be likely to cause serious harm to the physical or mental health of the data subject or another individual.
- (2) For the purposes of this Part of this Schedule, the “serious harm test” is met with respect to social work data if the application of Article 15 of the UK GDPR to the data would be likely to prejudice carrying out social work, because it would be likely to cause serious harm to the physical or mental health of the data subject or another individual.
- (3) In sub-paragraph (2), “carrying out social work” is to be taken to include doing any of the following—
@@ -8181,7 +8149,7 @@
##### 11
Article 15(1) to (3) of the GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not apply to social work data to the extent that the serious harm test is met with respect to the data.
Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not apply to social work data to the extent that the serious harm test is met with respect to the data.
#### Restriction of Article 15 of the GDPR: prior opinion of Principal Reporter
@@ -8189,7 +8157,7 @@
- (1) This paragraph applies where—
- (a) a question arises as to whether a controller who is a social work authority is obliged by Article 15(1) to (3) of the GDPR (confirmation of processing, access to data and safeguards for third country transfers) to disclose social work data, and
- (a) a question arises as to whether a controller who is a social work authority is obliged by Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) to disclose social work data, and
- (b) the data—
@@ -8199,7 +8167,7 @@
- (2) The controller must inform the Principal Reporter of the fact that the question has arisen before the end of the period of 14 days beginning when the question arises.
- (3) Article 15(1) to (3) of the GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not permit the controller to disclose the data to the data subject unless the Principal Reporter has informed the controller that, in the opinion of the Principal Reporter, the serious harm test is not met with respect to the data.
- (3) Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not permit the controller to disclose the data to the data subject unless the Principal Reporter has informed the controller that, in the opinion of the Principal Reporter, the serious harm test is not met with respect to the data.
- (4) In this paragraph “*social work authority*” means a local authority for the purposes of the Social Work (Scotland) Act 1968.
@@ -8335,7 +8303,7 @@
- “*teacher*” includes—in Great Britain, head teacher, andin Northern Ireland, the principal of a school.
- (2) For the purposes of this Part of this Schedule, the “serious harm test” is met with respect to education data if the application of Article 15 of the GDPR to the data would be likely to cause serious harm to the physical or mental health of the data subject or another individual.
- (2) For the purposes of this Part of this Schedule, the “serious harm test” is met with respect to education data if the application of Article 15 of the UK GDPR to the data would be likely to cause serious harm to the physical or mental health of the data subject or another individual.
#### Exemption from the listed GDPR provisions: data processed by a court
@@ -8371,7 +8339,7 @@
##### 19
Article 15(1) to (3) of the GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not apply to education data to the extent that the serious harm test is met with respect to the data.
Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not apply to education data to the extent that the serious harm test is met with respect to the data.
#### Restriction of Article 15 of the GDPR: prior opinion of Principal Reporter
@@ -8379,7 +8347,7 @@
- (1) This paragraph applies where—
- (a) a question arises as to whether a controller who is an education authority is obliged by Article 15(1) to (3) of the GDPR (confirmation of processing, access to data and safeguards for third country transfers) to disclose education data, and
- (a) a question arises as to whether a controller who is an education authority is obliged by Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) to disclose education data, and
- (b) the controller believes that the data—
@@ -8389,7 +8357,7 @@
- (2) The controller must inform the Principal Reporter of the fact that the question has arisen before the end of the period of 14 days beginning when the question arises.
- (3) Article 15(1) to (3) of the GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not permit the controller to disclose the data to the data subject unless the Principal Reporter has informed the controller that, in the opinion of the Principal Reporter, the serious harm test is not met with respect to the data.
- (3) Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not permit the controller to disclose the data to the data subject unless the Principal Reporter has informed the controller that, in the opinion of the Principal Reporter, the serious harm test is not met with respect to the data.
## PART 5 — Child abuse data
@@ -8403,7 +8371,7 @@
- (b) the data subject is incapable of managing his or her own affairs and the person making the request has been appointed by a court to manage those affairs.
- (2) Article 15(1) to (3) of the GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not apply to child abuse data to the extent that the application of that provision would not be in the best interests of the data subject.
- (2) Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not apply to child abuse data to the extent that the application of that provision would not be in the best interests of the data subject.
- (3) “Child abuse data” is personal data consisting of information as to whether the data subject is or has been the subject of, or may be at risk of, child abuse.
@@ -8417,7 +8385,7 @@
##### 1
In this Schedule “*the listed GDPR provisions*” means the following provisions of the GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the GDPR)—
In this Schedule “*the listed GDPR provisions*” means the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR)—
- (a) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);
@@ -8559,9 +8527,9 @@
- (2) In this Schedule—
- “*accreditation authority*” means—the Commissioner, orthe national accreditation body;
- “*certification provider*” and “*national accreditation body*” have the same meaning as in section 17.
- “*accreditation authority*” means—the Commissioner, orthe UK national accreditation body;
- “*certification provider*” and “*UK national accreditation body*” have the same meaning as in section 17.
#### Review
@@ -8617,7 +8585,7 @@
- (b) subject to paragraph (a), the Commissioner must appoint the members of the appeal panel.
- (4) Where the request relates to a decision of the national accreditation body—
- (4) Where the request relates to a decision of the UK national accreditation body—
- (a) the Secretary of State—
@@ -8625,7 +8593,7 @@
- (ii) may direct the Commissioner to appoint one person to be a member of the appeal panel other than the chair, and
- (b) subject to paragraph (a), the chair of the national accreditation body must appoint the members of the appeal panel.
- (b) subject to paragraph (a), the chair of the UK national accreditation body must appoint the members of the appeal panel.
- (5) A person may not be a member of an appeal panel if the person—
@@ -8671,7 +8639,7 @@
- (b) give a copy of the decision to the applicant.
- (4) Where the accreditation authority is the national accreditation body, the recommendation must be given to, and the final decision must be made by, the chief executive of that body.
- (4) Where the accreditation authority is the UK national accreditation body, the recommendation must be given to, and the final decision must be made by, the chief executive of that body.
#### Meaning of “working day”
@@ -8693,659 +8661,291 @@
##### 1
In its application by virtue of section 22(1), the GDPR has effect as if it were modified as follows.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### References to the GDPR and its provisions
##### 2
- (1) References to “this Regulation” and to provisions of the GDPR have effect as references to the applied GDPR and to the provisions of the applied GDPR.
- (2) But sub-paragraph (1) does not have effect—
- (a) in the case of the references which are modified or inserted by paragraphs 9(f)(ii), 15(b), 16(a)(ii), 35, 36(a) and (e)(ii) and 38(a)(i);
- (b) in relation to the references in points (a) and (b) of paragraph 2 of Article 61, as inserted by paragraph 49.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### References to Union law and Member State law
##### 3
- (1) References to “Union law”, “Member State law”, “the law of a Member State” and “Union or Member State law” have effect as references to domestic law.
- (2) Sub-paragraph (1) is subject to the specific modifications made in this Part of this Schedule.
- (3) In this paragraph, “*domestic law*” means the law of the United Kingdom, or of a part of the United Kingdom, and includes law in the form of an enactment, an instrument made under Her Majesty's prerogative or a rule of law.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### References to the Union and to Member States
##### 4
- (1) References to “the Union”, “a Member State” and “Member States” have effect as references to the United Kingdom.
- (2) Sub-paragraph (1) is subject to the specific modifications made in this Part of this Schedule (including paragraph 3(1)).
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### References to supervisory authorities
##### 5
- (1) References to a “supervisory authority”, a “competent supervisory authority” or “supervisory authorities”, however expressed, have effect as references to the Commissioner.
- (2) Sub-paragraph (1) does not apply to the references in—
- (a) Article 4(21) as modified by paragraph 9(f);
- (b) Article 57(1)(h);
- (c) Article 61(1) inserted by paragraph 49.
- (3) Sub-paragraph (1) is also subject to the specific modifications made in this Part of this Schedule.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### References to the national parliament
##### 6
References to “the national parliament” have effect as references to both Houses of Parliament.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### Chapter I of the GDPR (general provisions)
##### 7
For Article 2 (material scope) substitute—
> (2) This Regulation applies to the processing of personal data to which Chapter 3 of Part 2 of the 2018 Act applies (see section 21 of that Act).
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 8
For Article 3 substitute—
> Subsections (1), (2) and (7) of section 207 of the 2018 Act have effect for the purposes of this Regulation as they have effect for the purposes of that Act but as if the following were omitted—
> (a) in subsection (1), the reference to subsection (3), and
> (b) in subsection (7), the words following paragraph (d).
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 9
In Article 4 (definitions)—
- (a) in paragraph (7) (meaning of “controller”), for “; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law” substitute “ , subject to section 6 of the 2018 Act (meaning of “controller”) ”;
- (b) after paragraph (7) insert—
> (7A) “*the 2018 Act*” means the Data Protection Act 2018 as applied by section 22 of that Act and further modified by section 3 of that Act.
;
- (c) omit paragraph (16) (meaning of “main establishment”);
- (d) omit paragraph (17) (meaning of “representative”);
- (e) in paragraph (20) (meaning of “binding corporate rules”), for “on the territory of a Member State” substitute “ in the United Kingdom ”;
- (f) in paragraph (21) (meaning of “supervisory authority”)—
- (i) after “a Member State” insert “ (other than the United Kingdom) ”;
- (ii) for “Article 51” substitute “ Article 51 of the GDPR ”;
- (g) after paragraph (21) insert—
> (21A) “*the Commissioner*” means the Information Commissioner (see section 114 of the 2018 Act);
;
- (h) omit paragraph (22) (meaning of “supervisory authority concerned”);
- (i) omit paragraph (23) (meaning of “cross-border processing”);
- (j) omit paragraph (24) (meaning of “relevant and reasoned objection”);
- (k) after paragraph (26) insert—
> (27) “*the GDPR*” has the meaning given in section 3(10) of the 2018 Act.
> (28) “*domestic law*” has the meaning given in paragraph 3(3) of Schedule 6 to the 2018 Act.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### Chapter II of the GDPR (principles)
##### 10
In Article 6 (lawfulness of processing)—
- (a) omit paragraph 2;
- (b) in paragraph 3, for the first subparagraph substitute—
> In addition to the provision made in section 15 of and Part 1 of Schedule 2 to the 2018 Act, a legal basis for the processing referred to in point (c) and (e) of paragraph 1 may be laid down by the Secretary of State in regulations (see section 16 of the 2018 Act).
;
- (c) in paragraph 3, in the second subparagraph, for “The Union or the Member State law shall” substitute “ The regulations must ”.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 11
In Article 8 (conditions applicable to child's consent in relation to information society services)—
- (a) in paragraph 1, for the second subparagraph substitute—
> This paragraph is subject to section 9 of the 2018 Act.
;
- (b) in paragraph 3, for “the general contract law of Member States” substitute “ the general law of contract as it operates in domestic law ”.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 12
In Article 9 (processing of special categories of personal data)—
- (a) in paragraph 2(a), omit “, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject”;
- (b) in paragraph 2(b), for “Union or Member State law” substitute “ domestic law (see section 10 of the 2018 Act) ”;
- (c) in paragraph 2, for point (g) substitute—
> (g) processing is necessary for reasons of substantial public interest and is authorised by domestic law (see section 10 of the 2018 Act);
;
- (d) in paragraph 2(h), for “Union or Member State law” substitute “ domestic law (see section 10 of the 2018 Act) ”;
- (e) in paragraph 2(i), for “Union or Member State law” insert “ domestic law (see section 10 of the 2018 Act); ”;
- (f) in paragraph 2, for point (j) substitute—
> (j) processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) (as supplemented by section 19 of the 2018 Act) and is authorised by domestic law (see section 10 of that Act).
;
- (g) in paragraph 3, for “national competent bodies”, in both places, substitute “ a national competent body of the United Kingdom ”;
- (h) omit paragraph 4.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 13
In Article 10 (processing of personal data relating to criminal convictions and offences), in the first sentence, for “Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects” substitute “ domestic law (see section 10 of the 2018 Act) ”.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### Section 1 of Chapter III of the GDPR (rights of the data subject: transparency and modalities)
##### 14
In Article 12 (transparent information etc for the exercise of the rights of the data subject), omit paragraph 8.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### Section 2 of Chapter III of the GDPR (rights of the data subject: information and access to personal data)
##### 15
In Article 13 (personal data collected from data subject: information to be provided), in paragraph 1—
- (a) in point (a), omit “and, where applicable, of the controller's representative”;
- (b) in point (f), after “the Commission” insert “ pursuant to Article 45(3) of the GDPR ”.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 16
In Article 14 (personal data collected other than from data subject: information to be provided)—
- (a) in paragraph 1—
- (i) in point (a), omit “and, where applicable, of the controller's representative”;
- (ii) in point (f), after “the Commission” insert “ pursuant to Article 45(3) of the GDPR ”;
- (b) in paragraph 5(c), for “Union or Member State law to which the controller is subject” substitute “ a rule of domestic law ”.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### Section 3 of Chapter III of the GDPR (rights of the data subject: rectification and erasure)
##### 17
In Article 17 (right to erasure (‘right to be forgotten’))—
- (a) in paragraph 1(e), for “in Union or Member State law to which the controller is subject” substitute “ under domestic law ”;
- (b) in paragraph 3(b), for “by Union or Member State law to which the controller is subject” substitute “ under domestic law ”.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 18
In Article 18 (right to restriction of processing), in paragraph 2, for “of the Union or of a Member State” substitute “ of the United Kingdom ”.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### Section 4 of Chapter III of the GDPR (rights of the data subject: right to object and automated individual decision-making)
##### 19
In Article 21 (right to object), in paragraph 5, omit “, and notwithstanding Directive [2002/58/EC](https://www.legislation.gov.uk/european/directive/2002/0058),”.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 20
In Article 22 (automated individual decision-making, including profiling), for paragraph 2(b) substitute—
> (b) is a qualifying significant decision for the purposes of section 14 of the 2018 Act; or
.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### Section 5 of Chapter III of the GDPR (rights of the data subject: restrictions)
##### 21
In Article 23 (restrictions), in paragraph 1—
- (a) for “Union or Member State law to which the data controller or processor is subject” substitute “ In addition to the provision made by section 15 of and Schedules 2, 3 and 4 to the 2018 Act, the Secretary of State ”;
- (b) in point (e), for “of the Union or of a Member State”, in both places, substitute “ of the United Kingdom ”;
- (c) after point (j) insert—
> See section 16 of the 2018 Act.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### Section 1 of Chapter IV of the GDPR (controller and processor: general obligations)
##### 22
In Article 26 (joint controllers), in paragraph 1, for “Union or Member State law to which the controllers are subject” substitute “ domestic law ”.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 23
Omit Article 27 (representatives of controllers or processors not established in the Union).
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 24
In Article 28 (processor)—
- (a) in paragraph 3, in point (a), for “Union or Member State law to which the processor is subject” substitute “ domestic law ”;
- (b) in paragraph 3, in the second subparagraph, for “other Union or Member State data protection provisions” substitute “ any other rule of domestic law relating to data protection ”;
- (c) in paragraph 6, for “paragraphs 7 and 8” substitute “ paragraph 8 ”;
- (d) omit paragraph 7;
- (e) in paragraph 8, omit “and in accordance with the consistency mechanism referred to in Article 63”.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 25
In Article 30 (records of processing activities)—
- (a) in paragraph 1, in the first sentence, omit “and, where applicable, the controller's representative,”;
- (b) in paragraph 1, in point (a), omit “, the controller's representative”;
- (c) in paragraph 1, in point (g), after “32(1)” insert “ or section 28(3) of the 2018 Act ”;
- (d) in paragraph 2, in the first sentence, omit “and, where applicable, the processor's representative”;
- (e) in paragraph 2, in point (a), omit “the controller's or the processor's representative, and”;
- (f) in paragraph 2, in point (d), after “32(1)” insert “ or section 28(3) of the 2018 Act ”;
- (g) in paragraph 4, omit “and, where applicable, the controller's or the processor's representative,”.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 26
In Article 31 (co-operation with the supervisory authority), omit “and, where applicable, their representatives,”.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### Section 3 of Chapter IV of the GDPR (controller and processor: data protection impact assessment and prior consultation)
##### 27
In Article 35 (data protection impact assessment), omit paragraphs 4, 5, 6 and 10.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 28
In Article 36 (prior consultation)—
- (a) for paragraph 4 substitute—
> (4) The Secretary of State must consult the Commissioner during the preparation of any proposal for a legislative measure which relates to processing.
;
- (b) omit paragraph 5.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### Section 4 of Chapter IV of the GDPR (controller and processor: data protection officer)
##### 29
In Article 37 (designation of data protection officers), omit paragraph 4.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 30
In Article 39 (tasks of the data protection officer), in paragraph 1(a) and (b), for “other Union or Member State data protection provisions” substitute “ other rules of domestic law relating to data protection ”.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### Section 5 of Chapter IV of the GDPR (controller and processor: codes of conduct and certification)
##### 31
In Article 40 (codes of conduct)—
- (a) in paragraph 1, for “The Member States, the supervisory authorities, the Board and the Commission shall” substitute “ The Commissioner must ”;
- (b) omit paragraph 3;
- (c) in paragraph 6, omit “, and where the code of conduct concerned does not relate to processing activities in several Member States”;
- (d) omit paragraphs 7 to 11.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 32
In Article 41 (monitoring of approved codes of conduct), omit paragraph 3.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 33
In Article 42 (certification)—
- (a) in paragraph 1—
- (i) for “The Member States, the supervisory authorities, the Board and the Commission” substitute “ The Commissioner ”;
- (ii) omit “, in particular at Union level,”;
- (b) omit paragraph 2;
- (c) in paragraph 5, omit “or by the Board pursuant to Article 63. Where the criteria are approved by the Board, this may result in a common certification, the European Data Protection Seal”;
- (d) omit paragraph 8.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 34
In Article 43 (certification bodies)—
- (a) in paragraph 1, in the second sentence, for “Member States shall ensure that those certification bodies are” substitute “ Those certification bodies must be ”;
- (b) in paragraph 2, in point (b), omit “or by the Board pursuant to Article 63”;
- (c) in paragraph 3, omit “or by the Board pursuant to Article 63”;
- (d) in paragraph 6, omit the second and third sentences;
- (e) omit paragraphs 8 and 9.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### Chapter V of the GDPR (transfers of data to third countries or international organisations)
##### 35
In Article 45 (transfers on the basis of an adequacy decision)—
- (a) in paragraph 1, after “decided” insert “ in accordance with Article 45 of the GDPR ”;
- (b) after paragraph 1 insert—
> (1A) But a transfer of personal data to a third country or international organisation must not take place under paragraph 1, if the Commission's decision in relation to the third country (including a territory or sector within it) or the international organisation—
> (a) is suspended,
> (b) has been amended, or
> (c) has been repealed,
> by the Commission under Article 45(5) of the GDPR.
;
- (c) omit paragraphs 2 to 8;
- (d) in paragraph 9, for “of this Article” substitute “ of Article 45 of the GDPR ”.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 36
In Article 46 (transfers subject to appropriate safeguards)—
- (a) in paragraph 1, for “Article 45(3)” substitute “ Article 45(3) of the GDPR ”;
- (b) in paragraph 2, omit point (c);
- (c) in paragraph 2, in point (d), omit “and approved by the Commission pursuant to the examination procedure referred to in Article 93(2)”;
- (d) omit paragraph 4;
- (e) in paragraph 5—
- (i) in the first sentence, for “a Member State or supervisory authority” substitute “ the Commissioner ”;
- (ii) in the second sentence, for “this Article” substitute “ Article 46 of the GDPR ”.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 37
In Article 47 (binding corporate rules)—
- (a) in paragraph 1, in the first sentence, omit “in accordance with the consistency mechanism set out in Article 63”;
- (b) in paragraph 2, in point (e), for “the competent courts of the Member States” substitute “ a court ”;
- (c) in paragraph 2, in point (f), for “on the territory of a Member State” substitute “ in the United Kingdom ”;
- (d) omit paragraph 3.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 38
In Article 49 (derogations for specific situations)—
- (a) in paragraph 1, in the first sentence—
- (i) for “Article 45(3)” substitute “ Article 45(3) of the GDPR ”;
- (ii) for “Article 46” substitute “ Article 46 of this Regulation ”;
- (b) in paragraph 4, for “Union law or in the law of the Member State to which the controller is subject” substitute “ domestic law (see section 18 of the 2018 Act which makes certain provision about the public interest) ”;
- (c) for paragraph 5 substitute—
> (5) Paragraph 1 is subject to any regulations made under section 18(2) of the 2018 Act.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 39
In Article 50 (international co-operation for the protection of personal data), omit “the Commission and”.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### Section 1 of Chapter VI of the GDPR (independent supervisory authorities: independent status)
##### 40
In Article 51 (supervisory authority)—
- (a) in paragraph 1—
- (i) for “Each Member State shall provide for one or more independent public authorities to be” substitute “ The Commissioner is ”;
- (ii) omit “and to facilitate the free flow of personal data within the Union (‘supervisory authority’)”;
- (b) omit paragraphs 2 to 4.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 41
In Article 52 (independence)—
- (a) in paragraph 2—
- (i) for “The member or members of each supervisory authority” substitute “ The Commissioner ”;
- (ii) for “their”, in both places, substitute “the Commissioner's”;
- (b) in paragraph 3—
- (i) for “Member or members of each supervisory authority” substitute “ The Commissioner ”;
- (ii) for “their”, in both places, substitute “the Commissioner's”;
- (c) omit paragraphs 4 to 6.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 42
Omit Article 53 (general conditions for the members of the supervisory authority).
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 43
Omit Article 54 (rules on the establishment of the supervisory authority).
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### Section 2 of Chapter VI of the GDPR (independent supervisory authorities: competence, tasks and powers)
##### 44
In Article 55 (competence)—
- (a) in paragraph 1, omit “on the territory of its own Member State”;
- (b) omit paragraph 2.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 45
Omit Article 56 (competence of the lead supervisory authority).
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 46
In Article 57 (tasks)—
- (a) in paragraph 1, in the first sentence, for “each supervisory authority shall on its territory” substitute “ the Commissioner is to ”;
- (b) in paragraph 1, in point (e), omit “and, if appropriate, cooperate with the supervisory authorities in other Member States to that end”;
- (c) in paragraph 1, in point (f), omit “or coordination with another supervisory authority”;
- (d) in paragraph 1, omit points (g), (k) and (t);
- (e) after paragraph 1 insert—
> (1A) In this Article and Article 58, references to “this Regulation” have effect as references to this Regulation and section 28(3) of the 2018 Act.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 47
In Article 58 (powers)—
- (a) in paragraph 1, in point (a), omit “, and, where applicable, the controller's or the processor's representative”;
- (b) in paragraph 1, in point (f), for “Union or Member State procedural law” substitute “ domestic law ”;
- (c) in paragraph 3, in point (b), for “the Member State government” substitute “ the Secretary of State ”;
- (d) in paragraph 3, omit point (c);
- (e) omit paragraphs 4 to 6.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 48
In Article 59 (activity reports)—
- (a) for “, the government and other authorities as designated by Member State law” substitute “ and the Secretary of State ”;
- (b) omit “, to the Commission and to the Board”.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### Chapter VII of the GDPR (co-operation and consistency)
##### 49
For Articles 60 to 76 substitute—
> (1) The Commissioner may, in connection with carrying out the Commissioner's functions under this Regulation—
> (a) co-operate with, provide assistance to and seek assistance from other supervisory authorities;
> (b) conduct joint operations with other supervisory authorities, including joint investigations and joint enforcement measures.
> (2) The Commissioner must, in carrying out the Commissioner's functions under this Regulation, have regard to—
> (a) decisions, advice, guidelines, recommendations and best practices issued by the European Data Protection Board established under Article 68 of the GDPR;
> (b) any implementing acts adopted by the Commission under Article 67 of the GDPR (exchange of information).
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### Chapter VIII of the GDPR (remedies, liability and penalties)
##### 50
In Article 77 (right to lodge a complaint with a supervisory authority)—
- (a) in paragraph 1, omit “in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement”;
- (b) in paragraph 2, for “The supervisory authority with which the complaint has been lodged” substitute “ The Commissioner ”.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 51
In Article 78 (right to an effective judicial remedy against a supervisory authority)—
- (a) omit paragraph 2;
- (b) for paragraph 3 substitute—
> (3) Proceedings against the Commissioner are to be brought before a court in the United Kingdom.
;
- (c) omit paragraph 4.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 52
In Article 79 (right to an effective judicial remedy against a controller or processor), for paragraph 2 substitute—
> (2) Proceedings against a controller or a processor are to be brought before a court (see section 180 of the 2018 Act).
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 53
In Article 80 (representation of data subjects)—
- (a) in paragraph 1, omit “where provided for by Member State law”;
- (b) in paragraph 2, for “Member States” substitute “ The Secretary of State ”;
- (c) after that paragraph insert—
> (3) The power under paragraph 2 may only be exercised by making regulations under section 190 of the 2018 Act.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 54
Omit Article 81 (suspension of proceedings).
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 55
In Article 82 (right to compensation and liability), for paragraph 6 substitute—
> (6) Proceedings for exercising the right to receive compensation are to be brought before a court (see section 180 of the 2018 Act).
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 56
In Article 83 (general conditions for imposing administrative fines)—
- (a) in paragraph 5, in point (d), for “pursuant to Member State law adopted under Chapter IX” substitute “ under Part 5 or 6 of Schedule 2 to the 2018 Act or under regulations made under section 16 of that Act ”;
- (b) in paragraph 7—
- (i) for “each Member State” substitute “ the Secretary of State ”;
- (ii) for “that Member State” substitute “ the United Kingdom ”;
- (c) for paragraph 8 substitute—
> (8) Section 115(9) of the 2018 Act makes provision about the exercise of the Commissioner's powers under this Article.
;
- (d) omit paragraph 9.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 57
In Article 84 (penalties)—
- (a) for paragraph 1 substitute—
> (1) The rules on other penalties applicable to infringements of this Regulation are set out in the 2018 Act (see in particular Part 6 (enforcement)).
;
- (b) omit paragraph 2.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### Chapter IX of the GDPR (provisions relating to specific processing situations)
##### 58
In Article 85 (processing and freedom of expression and information)—
- (a) omit paragraph 1;
- (b) in paragraph 2, for “Member States shall” substitute “ the Secretary of State, in addition to the relevant provisions, may by way of regulations (see section 16 of the 2018 Act), ”;
- (c) in paragraph 2, at the end insert—
> In this paragraph, “*the relevant provisions*” means section 15 of and Part 5 of Schedule 2 to the 2018 Act.
;
- (d) omit paragraph 3.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 59
In Article 86 (processing and public access to official documents), for “Union or Member State law to which the public authority or body is subject” substitute “ domestic law ”.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 60
Omit Article 87 (processing of national identification number).
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 61
Omit Article 88 (processing in the context of employment).
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 62
@@ -9353,47 +8953,47 @@
##### 63
Omit Article 90 (obligations of secrecy).
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 64
Omit Article 91 (existing data protection rules of churches and religious associations).
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### Chapter X of the GDPR (delegated acts and implementing acts)
##### 65
Omit Article 92 (exercise of the delegation).
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 66
Omit Article 93 (committee procedure).
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### Chapter XI of the GDPR (final provisions)
##### 67
Omit Article 94 (repeal of Directive [95/46/EC](https://www.legislation.gov.uk/european/directive/1995/0046)).
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 68
Omit Article 95 (relationship with Directive [2002/58/EC](https://www.legislation.gov.uk/european/directive/2002/0058)).
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 69
In Article 96 (relationship with previously concluded Agreements), for “by Member States” substitute “ by the United Kingdom or the Commissioner ”.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 70
Omit Article 97 (Commission reports).
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 71
Omit Article 98 (Commission reviews).
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 72
Omit Article 99 (entry into force and application).
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
## PART 2 — Modifications to Chapter 2 of Part 2
@@ -9401,23 +9001,19 @@
##### 73
In its application by virtue of section 22(2), Chapter 2 of Part 2 has effect as if it were modified as follows.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### General modifications
##### 74
- (1) References to Chapter 2 of Part 2 and the provisions of that Chapter have effect as references to the applied Chapter 2 and the provisions of the applied Chapter 2 .
- (2) References to the GDPR and to the provisions of the GDPR have effect as references to the applied GDPR and to the provisions of the applied GDPR, except in section 18(2)(a).
- (3) References to the processing of personal data to which Chapter 2 applies have effect as references to the processing of personal data to which Chapter 3 applies.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### Exemptions
##### 75
In section 16 (power to make further exemptions etc by regulations), in subsection (1)(a), for “Member State law” substitute “ the Secretary of State ”.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
## SCHEDULE 7
@@ -10295,15 +9891,15 @@
- (d) promote the awareness of controllers and processors of their obligations under Parts 3 and 4 of this Act;
- (e) on request, provide information to a data subject concerning the exercise of the data subject's rights under Parts 3 and 4 of this Act and, if appropriate, co-operate with LED supervisory authorities and foreign designated authorities to provide such information;
- (f) co-operate with LED supervisory authorities and foreign designated authorities with a view to ensuring the consistency of application and enforcement of the Law Enforcement Directive and the Data Protection Convention, including by sharing information and providing mutual assistance;
- (g) conduct investigations on the application of Parts 3 and 4 of this Act, including on the basis of information received from an LED supervisory authority, a foreign designated authority or another public authority;
- (e) on request, provide information to a data subject concerning the exercise of the data subject's rights under Parts 3 and 4 of this Act and, if appropriate, co-operate with ... foreign designated authorities to provide such information;
- (f) co-operate with ... foreign designated authorities with a view to ensuring the consistency of application and enforcement of ... the Data Protection Convention, including by sharing information and providing mutual assistance;
- (g) conduct investigations on the application of Parts 3 and 4 of this Act, including on the basis of information received from ... a foreign designated authority or another public authority;
- (h) monitor relevant developments to the extent that they have an impact on the protection of personal data, including the development of information and communication technologies;
- (i) contribute to the activities of the European Data Protection Board established by the GDPR in connection with the processing of personal data to which the Law Enforcement Directive applies.
- (i) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (2) Section 3(14)(c) does not apply to the reference to personal data in sub-paragraph (1)(h).
@@ -10329,7 +9925,7 @@
- “*foreign designated authority*” means an authority designated for the purposes of Article 13 of the Data Protection Convention by a party, other than the United Kingdom, which is bound by that Convention;
- “*LED supervisory authority*” means a supervisory authority for the purposes of Article 41 of the Law Enforcement Directive in a member State other than the United Kingdom.
- ...
## SCHEDULE 14
@@ -10339,57 +9935,31 @@
##### 1
- (1) The Commissioner may provide information or assistance to an LED supervisory authority to the extent that, in the opinion of the Commissioner, providing that information or assistance is necessary for the performance of the recipient's data protection functions.
- (2) The Commissioner may ask an LED supervisory authority to provide information or assistance which the Commissioner requires for the performance of the Commissioner's data protection functions.
- (3) In this paragraph, “*data protection functions*” means functions relating to the protection of individuals with respect to the processing of personal data.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### Requests for information and assistance from LED supervisory authorities
##### 2
- (1) This paragraph applies where the Commissioner receives a request from an LED supervisory authority for information or assistance referred to in Article 41 of the Law Enforcement Directive and the request—
- (a) explains the purpose of and reasons for the request, and
- (b) contains all other information necessary to enable the Commissioner to respond.
- (2) The Commissioner must—
- (a) take all appropriate measures required to reply to the request without undue delay and, in any event, before the end of the period of 1 month beginning with receipt of the request, and
- (b) inform the LED supervisory authority of the results or, as the case may be, of the progress of the measures taken in order to respond to the request.
- (3) The Commissioner must not refuse to comply with the request unless—
- (a) the Commissioner does not have power to do what is requested, or
- (b) complying with the request would infringe the Law Enforcement Directive, EU legislation or the law of the United Kingdom or a part of the United Kingdom.
- (4) If the Commissioner refuses to comply with a request from an LED supervisory authority, the Commissioner must inform the authority of the reasons for the refusal.
- (5) As a general rule, the Commissioner must provide information requested by LED supervisory authorities by electronic means using a standardised format.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### Fees
##### 3
- (1) Subject to sub-paragraph (2), any information or assistance that is required to be provided by this Part of this Schedule must be provided free of charge.
- (2) The Commissioner may enter into agreements with other LED supervisory authorities for the Commissioner and other authorities to indemnify each other for expenditure arising from the provision of assistance in exceptional circumstances.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### Restrictions on use of information
##### 4
Where the Commissioner receives information from an LED supervisory authority as a result of a request under paragraph 1(2), the Commissioner may use the information only for the purposes specified in the request.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### LED supervisory authority
##### 5
In this Part of this Schedule, “*LED supervisory authority*” means a supervisory authority for the purposes of Article 41 of the Law Enforcement Directive in a member State other than the United Kingdom.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
## PART 2 — Data Protection Convention
@@ -10957,7 +10527,7 @@
- (c) a relevant record relating to statutory functions (see paragraph 4).
- (2) A record is not a “relevant record” to the extent that it relates, or is to relate, only to personal data which falls within section 21(2) (manual unstructured personal data held by FOI public authorities).
- (2) A record is not a “relevant record” to the extent that it relates, or is to relate, only to personal data which falls within Article 2(1A) of the UK GDPR (manual unstructured personal data held by FOI public authorities).
#### Relevant health records
@@ -11025,6 +10595,8 @@
- (i) section 92 of the Powers of Criminal Courts (Sentencing) Act 2000,
- (ia) section 260 of the Sentencing Code,
- (ii) section 205(2) or 208 of the Criminal Procedure (Scotland) Act 1995, or
- (iii) Article 45 of the Criminal Justice (Children) (Northern Ireland) Order 1998 (S.I. 1998/1504 (N.I. 9));
@@ -11083,9 +10655,9 @@
In this Schedule, “*data subject access right*” means a right under—
- (a) Article 15 of the GDPR (right of access by the data subject);
- (b) Article 20 of the GDPR (right to data portability);
- (a) Article 15 of the UK GDPR (right of access by the data subject);
- (b) Article 20 of the UK GDPR (right to data portability);
- (c) section 45 of this Act (law enforcement processing: right of access by the data subject);
@@ -15820,7 +15392,7 @@
- (2) Other references to the Data Protection Act 1998 have effect as references to the data protection legislation.
- (3) References to disclosure, use or other processing of information that is prohibited or restricted by an enactment which include disclosure, use or other processing of information that is prohibited or restricted by the Data Protection Act 1998 have effect as if they included disclosure, use or other processing of information that is prohibited or restricted by the GDPR or the applied GDPR.
- (3) References to disclosure, use or other processing of information that is prohibited or restricted by an enactment which include disclosure, use or other processing of information that is prohibited or restricted by the Data Protection Act 1998 have effect as if they included disclosure, use or other processing of information that is prohibited or restricted by the UK GDPR.
#### Specific modification of references to terms used in the Data Protection Act 1998
@@ -15836,7 +15408,7 @@
- (5) References to the data protection principles set out in the Data Protection Act 1998 have effect as references to the principles set out in—
- (a) Article 5(1) of the GDPR and the applied GDPR, and
- (a) Article 5(1) of the UK GDPR, and
- (b) sections 34(1) and 85(1) of this Act.
@@ -15996,7 +15568,7 @@
In section 185 of this Act, references to a record obtained in the exercise of a data subject access right include a record obtained at any time in the exercise of a right under section 7 of the 1998 Act.
## PART 3 — The GDPR and Part 2 of this Act
## PART 3 — The UK GDPR and Part 2 of this Act
#### Exemptions from the GDPR: restrictions of rules in Articles 13 to 15 of the GDPR
@@ -16060,7 +15632,7 @@
- (a) it were a certificate issued under one or more of sections 27, 79 and 111 (as the case may be),
- (b) it provided protection in respect of that personal data in relation to the corresponding provisions of this Act or the applied GDPR, and
- (b) it provided protection in respect of that personal data in relation to the corresponding provisions of this Act or the UK GDPR, and
- (c) where it has effect as a certificate issued under section 79, it certified that each restriction in question is a necessary and proportionate measure to protect national security.
@@ -16080,10 +15652,12 @@
is a reference to the effect of the evidence that is provided by the certificate;
- (b) protection provided by a certificate under section 28(2) of the 1998 Act is to be regarded as corresponding to protection that could be provided by a certificate under section 27, 79 or 111 of this Act where, in respect of provision in the 1998 Act to which the certificate under section 28(2) relates, there is corresponding provision in this Act or the applied GDPR to which a certificate under section 27, 79 or 111 could relate.
- (b) protection provided by a certificate under section 28(2) of the 1998 Act is to be regarded as corresponding to protection that could be provided by a certificate under section 27, 79 or 111 of this Act where, in respect of provision in the 1998 Act to which the certificate under section 28(2) relates, there is corresponding provision in this Act or the UK GDPR to which a certificate under section 27, 79 or 111 could relate.
- (7) In this paragraph, “*the relevant time*” means the time when the repeal of section 28 of the 1998 Act comes into force.
- (8) In this paragraph, references to the UK GDPR do not include the EU GDPR as it was directly applicable to the United Kingdom before IP completion day (see paragraph 2 of Schedule 21).
## PART 6 — The Information Commissioner
#### Appointment etc
@@ -16544,7 +16118,7 @@
##### 50
In section 159(1)(a) of the Consumer Credit Act 1974 (correction of wrong information) (as amended by Schedule 19 to this Act), the reference to information given under Article 15(1) to (3) of the GDPR includes information given at any time under section 7 of the 1998 Act.
In section 159(1)(a) of the Consumer Credit Act 1974 (correction of wrong information) (as amended by Schedule 19 to this Act), the reference to information given under Article 15(1) to (3) of the UK GDPR includes information given at any time under section 7 of the 1998 Act.
#### Freedom of Information Act 2000
@@ -16676,2950 +16250,4208 @@
- “*the relevant time*” means the time when the amendments of the 2004 Regulations in Schedule 19 to this Act come into force.
#### Overview
#### Protection of personal data
#### Processing to which this Part applies
#### Special categories of personal data etc: supplementary
#### Processing to which this Part applies
#### Meaning of “controller” and “processor”
#### Regulations and consultation
#### Regulations and consultation
#### Index of defined expressions
### Employment, social security and social protection
### Health or social care purposes
### Public health
### Research etc
### Requirement for an appropriate policy document when relying on conditions in this Part
### Statutory etc and government purposes
### Administration of justice and parliamentary purposes
### Equality of opportunity or treatment
### Racial and ethnic diversity at senior levels of organisations
### Preventing or detecting unlawful acts
### Protecting the public against dishonesty etc
### Regulatory requirements relating to unlawful acts and dishonesty etc
### Journalism etc in connection with unlawful acts and dishonesty etc
### Preventing fraud
### Suspicion of terrorist financing or money laundering
### Support for individuals with a particular disability or medical condition
### Counselling etc
### Safeguarding of children and of individuals at risk
### Safeguarding of economic well-being of certain individuals
### Insurance
### Occupational pensions
### Political parties
### Elected representatives responding to requests
### Disclosure to elected representatives
### Informing elected representatives about prisoners
### Publication of legal judgments
### Anti-doping in sport
### Standards of behaviour in sport
### Consent
### Protecting individual's vital interests
### Processing by not-for-profit bodies
### Personal data in the public domain
### Legal claims
### Judicial acts
### Administration of accounts used in commission of indecency offences involving children
### Extension of conditions in Part 2 of this Schedule referring to substantial public interest
### Extension of insurance conditions
### Application of this Part of this Schedule
### Requirement to have an appropriate policy document in place
### Additional safeguard: retention of appropriate policy document
### Additional safeguard: record of processing
### UK GDPR provisions to be adapted or restricted: “the listed GDPR provisions”
### Crime and taxation: general
### Crime and taxation: risk assessment systems
### Immigration
### Information required to be disclosed by law etc or in connection with legal proceedings
### UK GDPR provisions to be restricted: “the listed GDPR provisions”
### Functions designed to protect the public etc
### Audit functions
### Functions of the Bank of England
### Regulatory functions relating to legal services, the health service and children's services
### Regulatory functions of certain other persons
### Parliamentary privilege
### Judicial appointments, judicial independence and judicial proceedings
### Crown honours, dignities and appointments
### Protection of the rights of others: general
### Assumption of reasonableness for health workers, social workers and education workers
### UK GDPR provisions to be restricted: “the listed GDPR provisions”
### Legal professional privilege
### Self incrimination
### Corporate finance
### Management forecasts
### Negotiations
### Confidential references
### Exam scripts and exam marks
### Journalistic, academic, artistic and literary purposes
### Research and statistics
### Archiving in the public interest
### Definitions
### Exemption from the listed GDPR provisions: data processed by a court
### Exemption from the listed GDPR provisions: data subject's expectations and wishes
### Exemption from Article 15 of the UK GDPR: serious harm
### Restriction of Article 15 of the UK GDPR: prior opinion of appropriate health professional
### Definitions
### Exemption from the listed GDPR provisions: data processed by a court
### Exemption from the listed GDPR provisions: data subject's expectations and wishes
### Exemption from Article 15 of the UK GDPR: serious harm
### Restriction of Article 15 of the UK GDPR: prior opinion of Principal Reporter
### Educational records
### Other definitions
### Exemption from the listed GDPR provisions: data processed by a court
### Exemption from Article 15 of the UK GDPR: serious harm
### Restriction of Article 15 of the UK GDPR: prior opinion of Principal Reporter
### Exemption from Article 15 of the UK GDPR: child abuse data
### UK GDPR provisions to be restricted: “the listed GDPR provisions”
### Human fertilisation and embryology information
### Adoption records and reports
### Statements of special educational needs
### Parental order records and reports
### Information provided by Principal Reporter for children's hearing
### Introduction
### Review
### Right to appeal
### Appeal panel
### Hearing
### Decision following referral to appeal panel
### Meaning of “working day”
### Introductory
### References to the GDPR and its provisions
### References to Union law and Member State law
### References to the Union and to Member States
### References to supervisory authorities
### References to the national parliament
### Chapter I of the GDPR (general provisions)
### Chapter II of the GDPR (principles)
### Section 1 of Chapter III of the GDPR (rights of the data subject: transparency and modalities)
### Section 2 of Chapter III of the GDPR (rights of the data subject: information and access to personal data)
### Section 3 of Chapter III of the GDPR (rights of the data subject: rectification and erasure)
### Section 4 of Chapter III of the GDPR (rights of the data subject: right to object and automated individual decision-making)
### Section 5 of Chapter III of the GDPR (rights of the data subject: restrictions)
### Section 1 of Chapter IV of the GDPR (controller and processor: general obligations)
### Section 3 of Chapter IV of the GDPR (controller and processor: data protection impact assessment and prior consultation)
### Section 4 of Chapter IV of the GDPR (controller and processor: data protection officer)
### Section 5 of Chapter IV of the GDPR (controller and processor: codes of conduct and certification)
### Chapter V of the GDPR (transfers of data to third countries or international organisations)
### Section 1 of Chapter VI of the GDPR (independent supervisory authorities: independent status)
### Section 2 of Chapter VI of the GDPR (independent supervisory authorities: competence, tasks and powers)
### Chapter VII of the GDPR (co-operation and consistency)
### Chapter VIII of the GDPR (remedies, liability and penalties)
### Chapter IX of the GDPR (provisions relating to specific processing situations)
### Chapter X of the GDPR (delegated acts and implementing acts)
### Chapter XI of the GDPR (final provisions)
### Introductory
### General modifications
### Exemptions
### Chief officers of police and other policing bodies
### Other authorities with investigatory functions
### Authorities with functions relating to offender management
### Other authorities
### Statutory etc purposes
### Administration of justice
### Protecting individual's vital interests
### Safeguarding of children and of individuals at risk
### Personal data already in the public domain
### Legal claims
### Judicial acts
### Preventing fraud
### Archiving etc
### Consent to particular processing
### Right or obligation relating to employment
### Vital interests of a person
### Safeguarding of children and of individuals at risk
### Data already published by data subject
### Legal proceedings etc
### Administration of justice, parliamentary, statutory etc and government purposes
### Medical purposes
### Equality
### Preliminary
### Crime
### Information required to be disclosed by law etc or in connection with legal proceedings
### Parliamentary privilege
### Judicial proceedings
### Crown honours and dignities
### Armed forces
### Economic well-being
### Legal professional privilege
### Negotiations
### Confidential references given by the controller
### Exam scripts and marks
### Research and statistics
### Archiving in the public interest
### Status and capacity
### Appointment
### Resignation and removal
### Salary etc
### Officers and staff
### Carrying out of the Commissioner's functions by officers and staff
### Authentication of the seal of the Commissioner
### Presumption of authenticity of documents issued by the Commissioner
### Money
### Fees etc and other sums
### Accounts
### Scotland
### General tasks
### General powers
### Definitions
### Co-operation
### Requests for information and assistance from LED supervisory authorities
### Fees
### Restrictions on use of information
### LED supervisory authority
### Co-operation between the Commissioner and foreign designated authorities
### Assisting persons resident outside the UK with requests under Article 14 of the Convention
### Assisting UK residents with requests under Article 8 of the Convention
### Restrictions on use of information
### Foreign designated authority
### Issue of warrants in connection with non-compliance and offences
### Issue of warrants in connection with assessment notices
### Restrictions on issuing warrants: processing for the special purposes
### Restrictions on issuing warrants: procedural requirements
### Content of warrants
### Copies of warrants
### Execution of warrants: reasonable force
### Execution of warrants: time when executed
### Execution of warrants: occupier of premises
### Execution of warrants: seizure of documents etc
### Matters exempt from inspection and seizure: privileged communications
### Matters exempt from inspection and seizure: Parliamentary privilege
### Partially exempt material
### Return of warrants
### Offences
### Self-incrimination
### Vessels, vehicles etc
### Scotland
### Northern Ireland
### Meaning of “penalty”
### Notice of intent to impose penalty
### Contents of notice of intent
### Giving a penalty notice
### Contents of penalty notice
### Period for payment of penalty
### Variation of penalty
### Cancellation of penalty
### Enforcement of payment
### Interpretation
### Information notices
### Assessment notices
### Applications in respect of urgent notices
### Relevant records
### Relevant health records
### Relevant records relating to a conviction or caution
### Relevant records relating to statutory functions
### Data subject access right
### Records stating that personal data is not processed
### Power to amend
### Registration Service Act 1953 (c. 37)
### Veterinary Surgeons Act 1966 (c. 36)
### Parliamentary Commissioner Act 1967 (c. 13)
### Local Government Act 1974 (c. 7)
### Consumer Credit Act 1974 (c. 39)
### Pharmacy (Northern Ireland) Order 1976 (S.I. 1976/1213 (N.I. 22))
### Representation of the People Act 1983 (c. 2)
### Medical Act 1983 (c. 54)
### Dentists Act 1984 (c. 24)
### Companies Act 1985 (c. 6)
### Access to Medical Reports Act 1988 (c. 28)
### Opticians Act 1989 (c. 44)
### Access to Health Records Act 1990 (c. 23)
### Human Fertilisation and Embryology Act 1990 (c. 37)
### Trade Union and Labour Relations (Consolidation) Act 1992 (c. 52)
### Tribunals and Inquiries Act 1992 (c. 53)
### Industrial Relations (Northern Ireland) Order 1992 (S.I. 1992/807 (N.I. 5))
### Health Service Commissioners Act 1993 (c. 46)
### Data Protection Act 1998 (c. 29)
### Crime and Disorder Act 1998 (c. 37)
### Food Standards Act 1999 (c. 28)
### Immigration and Asylum Act 1999 (c. 33)
### Financial Services and Markets Act 2000 (c. 8)
### Terrorism Act 2000 (c. 11)
### Freedom of Information Act 2000 (c. 36)
### Political Parties, Elections and Referendums Act 2000 (c. 41)
### Public Finance and Accountability (Scotland) Act 2000 (asp 1)
### Criminal Justice and Police Act 2001 (c. 16)
### Anti-terrorism, Crime and Security Act 2001 (c.24)
### Health and Personal Social Services Act (Northern Ireland) 2001 (c. 3 (N.I.))
### Justice (Northern Ireland) Act 2002 (c. 26)
### Proceeds of Crime Act 2002 (c. 29)
### Enterprise Act 2002 (c. 40)
### Scottish Public Services Ombudsman Act 2002 (asp 11)
### Freedom of Information (Scotland) Act 2002 (asp 13)
### Courts Act 2003 (c. 39)
### Sexual Offences Act 2003 (c. 42)
### Criminal Justice Act 2003 (c. 44)
### Mental Health (Care and Treatment) (Scotland) Act 2003 (asp 13)
### Public Audit (Wales) Act 2004 (c. 23)
### Companies (Audit, Investigations and Community Enterprise) Act 2004 (c. 27)
### Domestic Violence, Crime and Victims Act 2004 (c. 28)
### Children Act 2004 (c. 31)
### Constitutional Reform Act 2005 (c. 4)
### Mental Capacity Act 2005 (c. 9)
### Public Services Ombudsman (Wales) Act 2005 (c. 10)
### Commissioners for Revenue and Customs Act 2005 (c. 11)
### Gambling Act 2005 (c. 19)
### Commissioner for Older People (Wales) Act 2006 (c. 30)
### National Health Service Act 2006 (c. 41)
### National Health Service (Wales) Act 2006 (c. 42)
### Companies Act 2006 (c. 46)
### Tribunals, Courts and Enforcement Act 2007 (c. 15)
### Statistics and Registration Service Act 2007 (c. 18)
### Serious Crime Act 2007 (c. 27)
### Legal Services Act 2007 (c. 29)
### Adoption and Children (Scotland) Act 2007 (asp 4)
### Criminal Justice and Immigration Act 2008 (c. 4)
### Regulatory Enforcement and Sanctions Act 2008 (c. 13)
### Health and Social Care Act 2008 (c. 14)
### Counter-Terrorism Act 2008 (c. 28)
### Public Health etc. (Scotland) Act 2008 (asp 5)
### Banking Act 2009 (c. 1)
### Borders, Citizenship and Immigration Act 2009 (c. 11)
### Marine and Coastal Access Act 2009 (c. 23)
### Coroners and Justice Act 2009 (c. 25)
### Broads Authority Act 2009 (c. i)
### Health and Social Care (Reform) Act (Northern Ireland) 2009 (c. 1 (N.I.))
### Terrorist Asset-Freezing etc. Act 2010 (c. 38)
### Marine (Scotland) Act 2010 (asp 5)
### Charities Act 2011 (c. 25)
### Welsh Language (Wales) Measure 2011 (nawm 1)
### Safeguarding Board Act (Northern Ireland) 2011 (c. 7 (N.I))
### Health and Social Care Act 2012 (c. 7)
### Protection of Freedoms Act 2012 (c. 9)
### HGV Road User Levy Act 2013 (c. 7)
### Crime and Courts Act 2013 (c. 22)
### Marine Act (Northern Ireland) 2013 (c. 10 (N.I.))
### Local Audit and Accountability Act 2014 (c. 2)
### Anti-social Behaviour, Crime and Policing Act 2014 (c. 12)
### Immigration Act 2014 (c. 22)
### Care Act 2014 (c. 23)
### Social Services and Well-being (Wales) Act 2014 (anaw 4)
### Counter-Terrorism and Security Act 2015 (c. 6)
### Small Business, Enterprise and Employment Act 2015 (c. 26)
### Modern Slavery Act 2015 (c. 30)
### Human Trafficking and Exploitation (Criminal Justice and Support for Victims) Act (Northern Ireland) 2015 (c. 2 (N.I.))
### Justice Act (Northern Ireland) 2015 (c. 9 (N.I.))
### Immigration Act 2016 (c. 19)
### Investigatory Powers Act 2016 (c. 25)
### Public Services Ombudsman Act (Northern Ireland) 2016 (c. 4 (N.I.))
### Health and Social Care (Control of Data Processing) Act (Northern Ireland) 2016 (c. 12 (N.I.))
### Mental Capacity Act (Northern Ireland) 2016 (c. 18 (N.I.))
### Justice Act (Northern Ireland) 2016 (c. 21 (N.I.))
### Policing and Crime Act 2017 (c. 3)
### Children and Social Work Act 2017 (c. 12)
### Higher Education and Research Act 2017 (c. 29)
### Digital Economy Act 2017 (c. 30)
### Landfill Disposals Tax (Wales) Act 2017 (anaw 3)
### Additional Learning Needs and Educational Tribunal (Wales) Act 2018 (anaw 2)
### This Act
### Estate Agents (Specified Offences) (No. 2) Order 1991 (S.I. 1991/1091)
### Channel Tunnel (International Arrangements) Order 1993 (S.I. 1993/1813)
### Access to Health Records (Northern Ireland) Order 1993 (S.I. 1993/1250 (N.I. 4))
### Channel Tunnel (Miscellaneous Provisions) Order 1994 (S.I. 1994/1405)
### European Primary and Specialist Dental Qualifications Regulations 1998 (S.I. 1998/811)
### Scottish Parliamentary Corporate Body (Crown Status) Order 1999 (S.I. 1999/677)
### Northern Ireland Assembly Commission (Crown Status) Order 1999 (S.I. 1999/3145)
### Data Protection (Corporate Finance Exemption) Order 2000 (S.I. 2000/184)
### Data Protection (Conditions under Paragraph 3 of Part II of Schedule 1) Order 2000 (S.I. 2000/185)
### Data Protection (Functions of Designated Authority) Order 2000 (S.I. 2000/186)
### Data Protection (International Co-operation) Order 2000 (S.I. 2000/190)
### Data Protection (Subject Access) (Fees and Miscellaneous Provisions) Regulations 2000 (S.I. 2000/191)
### Consumer Credit (Credit Reference Agency) Regulations 2000 (S.I. 2000/290)
### Data Protection (Subject Access Modification) (Health) Order 2000 (S.I. 2000/413)
### Data Protection (Subject Access Modification) (Education) Order 2000 (S.I. 2000/414)
### Data Protection (Subject Access Modification) (Social Work) Order 2000 (S.I. 2000/415)
### Data Protection (Crown Appointments) Order 2000 (S.I. 2000/416)
### Data Protection (Processing of Sensitive Personal Data) Order 2000 (S.I. 2000/417)
### Data Protection (Miscellaneous Subject Access Exemptions) Order 2000 (S.I. 2000/419)
### Data Protection (Designated Codes of Practice) (No. 2) Order 2000 (S.I. 2000/1864)
### Representation of the People (England and Wales) Regulations 2001 (S.I. 2001/341)
### Representation of the People (Scotland) Regulations 2001 (S.I. 2001/497)
### Financial Services and Markets Act 2000 (Disclosure of Confidential Information) Regulations 2001 (S.I. 2001/2188)
### Nursing and Midwifery Order 2001 (S.I. 2002/253)
### Electronic Commerce (EC Directive) Regulations 2002 (S.I. 2002/2013)
### Data Protection (Processing of Sensitive Personal Data) (Elected Representatives) Order 2002 (S.I. 2002/2905)
### Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426)
### Nationality, Immigration and Asylum Act 2002 (Juxtaposed Controls) Order 2003 (S.I. 2003/2818)
### Pupils' Educational Records (Scotland) Regulations 2003 (S.S.I. 2003/581)
### European Parliamentary Elections (Northern Ireland) Regulations 2004 (S.I. 2004/1267)
### Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004 (S.I. 2004/3244)
### Environmental Information Regulations 2004 (S.I. 2004/3391)
### Environmental Information (Scotland) Regulations 2004 (S.S.I. 2004/520)
### Licensing Act 2003 (Personal Licences) Regulations 2005 (S.I. 2005/41)
### Education (Pupil Information) (England) Regulations 2005 (S.I. 2005/1437)
### Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005 (S.I. 2005/2042)
### Register of Judgments, Orders and Fines Regulations 2005 (S.I. 2005/3595)
### Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005 (S.S.I. 2005/494)
### Data Protection (Processing of Sensitive Personal Data) Order 2006 (S.I. 2006/2068)
### National Assembly for Wales (Representation of the People) Order 2007 (S.I. 2007/236)
### Mental Capacity Act 2005 (Loss of Capacity during Research Project) (England) Regulations 2007 (S.I. 2007/679)
### National Assembly for Wales Commission (Crown Status) Order 2007 (S.I. 2007/1118)
### Mental Capacity Act 2005 (Loss of Capacity during Research Project) (Wales) Regulations 2007 (S.I. 2007/837 (W.72))
### Representation of the People (Absent Voting at Local Elections) (Scotland) Regulations 2007 (S.S.I. 2007/170)
### Representation of the People (Post-Local Government Elections Supply and Inspection of Documents) (Scotland) Regulations 2007 (S.S.I. 2007/264)
### Education (Pupil Records and Reporting) (Transitional) Regulations (Northern Ireland) 2007 (S.R. (N.I.) 2007 No. 43)
### Representation of the People (Northern Ireland) Regulations 2008 (S.I. 2008/1741)
### Companies Act 2006 (Extension of Takeover Panel Provisions) (Isle of Man) Order 2008 (S.I. 2008/3122)
### Controlled Drugs (Supervision of Management and Use) (Wales) Regulations 2008 (S.I. 2008/3239 (W.286))
### Energy Order 2003 (Supply of Information) Regulations (Northern Ireland) 2008 (S.R. (N.I.) 2008 No. 3)
### Companies (Disclosure of Address) Regulations 2009 (S.I. 2009/214)
### Overseas Companies Regulations 2009 (S.I. 2009/1801)
### Data Protection (Processing of Sensitive Personal Data) Order 2009 (S.I. 2009/1811)
### Provision of Services Regulations 2009 (S.I. 2009/2999)
### INSPIRE Regulations 2009 (S.I. 2009/3157)
### INSPIRE (Scotland) Regulations 2009 (S.S.I. 2009/440)
### Controlled Drugs (Supervision of Management and Use) Regulations (Northern Ireland) 2009 (S.R (N.I.) 2009 No. 225)
### Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010 (S.I. 2010/31)
### Pharmacy Order 2010 (S.I. 2010/231)
### Data Protection (Monetary Penalties) Order 2010 (S.I. 2010/910)
### National Employment Savings Trust Order 2010 (S.I. 2010/917)
### Local Elections (Northern Ireland) Order 2010 (S.I. 2010/2977)
### Pupil Information (Wales) Regulations 2011 (S.I. 2011/1942 (W.209))
### Debt Arrangement Scheme (Scotland) Regulations 2011 (S.S.I. 2011/141)
### Police and Crime Commissioner Elections Order 2012 (S.I. 2012/1917)
### Data Protection (Processing of Sensitive Personal Data) Order 2012 (S.I. 2012/1978)
### Neighbourhood Planning (Referendums) Regulations 2012 (S.I. 2012/2031)
### Controlled Drugs (Supervision of Management and Use) Regulations 2013 (S.I. 2013/373)
### Communications Act 2003 (Disclosure of Information) Order 2014 (S.I. 2014/1825)
### Criminal Justice and Data Protection (Protocol No. 36) Regulations 2014 (S.I. 2014/3141)
### Data Protection (Assessment Notices) (Designation of National Health Service Bodies) Order 2014 (S.I. 2014/3282)
### The Control of Explosives Precursors etc Regulations (Northern Ireland) 2014 (S.R. (N.I.) 2014 No. 224)
### Control of Poisons and Explosives Precursors Regulations 2015 (S.I. 2015/966)
### Companies (Disclosure of Date of Birth Information) Regulations 2015 (S.I. 2015/1694)
### Small and Medium Sized Business (Credit Information) Regulations 2015 (S.I. 2015/1945)
### European Union (Recognition of Professional Qualifications) Regulations 2015 (S.I. 2015/2059)
### Scottish Parliament (Elections etc) Order 2015 (S.S.I. 2015/425)
### Recall of MPs Act 2015 (Recall Petition) Regulations 2016 (S.I. 2016/295)
### Register of People with Significant Control Regulations 2016 (S.I. 2016/339)
### Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 (S.I. 2016/696)
### Court Files Privileged Access Rules (Northern Ireland) 2016 (S.R. (N.I.) 2016 No. 123)
### Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (S.I. 2017/692)
### Scottish Partnerships (Register of People with Significant Control) Regulations 2017 (S.I. 2017/694)
### Data Protection (Charges and Information) Regulations 2018 (S.I. 2018/480)
### National Health Service (General Medical Services Contracts) (Scotland) Regulations 2018 (S.S.I. 2018/66)
### National Health Service (Primary Medical Services Section 17C Agreements) (Scotland) Regulations 2018 (S.S.I. 2018/67)
### Introduction
### General modifications
### Specific modification of references to terms used in the Data Protection Act 1998
### Definitions
### Provision inserted in subordinate legislation by this Schedule
### Interpretation
### Right of access to personal data under the 1998 Act
### Right to prevent processing likely to cause damage or distress under the 1998 Act
### Right to prevent processing for purposes of direct marketing under the 1998 Act
### Automated processing under the 1998 Act
### Compensation for contravention of the 1998 Act or Part 4 of the 2014 Regulations
### Rectification, blocking, erasure and destruction under the 1998 Act
### Jurisdiction and procedure under the 1998 Act
### Exemptions under the 1998 Act
### Prohibition by this Act of requirement to produce relevant records
### Avoidance under this Act of certain contractual terms relating to health records
### Exemptions from the GDPR: restrictions of rules in Articles 13 to 15 of the GDPR
### Manual unstructured data held by FOI public authorities
### Logging
### Regulation 50 of the 2014 Regulations (disapplication of the 1998 Act)
### Maximum fee for data subject access requests to intelligence services
### National security certificates: processing of personal data under the 1998 Act
### National security certificates: processing of personal data under the 2018 Act
### Appointment etc
### Accounts
### Annual report
### Fees etc received by the Commissioner
### Functions in connection with the Data Protection Convention
### Co-operation with the European Commission: transfers of personal data outside the EEA
### Charges payable to the Commissioner by controllers
### Requests for assessment
### Codes of practice
### Interpretation of this Part
### Information notices
### Special information notices
### Assessment notices
### Enforcement notices
### Determination by Commissioner as to the special purposes
### Restriction on enforcement in case of processing for the special purposes
### Offences
### Powers of entry
### Monetary penalties
### Appeals
### Exemptions
### Tribunal Procedure Rules
### Obstruction etc
### Enforcement etc under the 2014 Regulations
### Information notices
### Powers of entry
### Tribunal Procedure Rules
### Powers to disclose information to the Commissioner
### Codes etc required to be consistent with the Commissioner's data-sharing code
### Consumer Credit Act 1974
### Freedom of Information Act 2000
### Freedom of Information (Scotland) Act 2002
### Access to Health Records (Northern Ireland) Order 1993 (S.I. 1993/1250 (N.I. 4))
### Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2450)
### Health and Personal Social Services (Quality, Improvement and Regulation) (Northern Ireland) Order 2003 (S.I. 2003/431 (N.I. 9))
### Environmental Information Regulations 2004 (S.I. 2004/3391)
### Environmental Information (Scotland) Regulations 2004 (S.S.I. 2004/520)
## Editorial notes
[^c23266291]: S. 7 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23266301]: S. 10 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23266331]: S. 12 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23266351]: S. 14 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23266361]: S. 16 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23266371]: S. 18 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23266381]: S. 19 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23266401]: S. 24 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23266411]: S. 30 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23266421]: [S. 35](https://www.legislation.gov.uk/ukpga/2018/12/section/35) in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23266431]: S. 50 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23266471]: S. 53 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23268021]: S. 54 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23268891]: [S. 86](https://www.legislation.gov.uk/ukpga/2018/12/section/86) in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23268981]: S. 94 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23269021]: S. 113 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23269091]: S. 128 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23269101]: S. 137 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23269111]: S. 138 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23269131]: S. 149 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23269141]: S. 155 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23269151]: S. 159 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23269161]: S. 183 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23269171]: S. 188 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23269181]: S. 190 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23269191]: S. 191 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23269201]: S. 203 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23269211]: S. 211 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23269221]: S. 213(2) in force and s. 213(3) in force for specified purposes at Royal Assent, see [s. 212(2)(e)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/e/f)
[^c23269231]: Sch. 2 para. 26 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23269241]: Sch. 18 para. 7 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23269251]: [Sch. 19 para. 60](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/60) in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23269261]: [Sch. 19 para. 434](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/434) in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23270721]: Sch. 2 para. 15 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23287301]: S. 125 not in force at Royal Assent; s. 125 in force at 23.7.2018 for specified purposes, see [s. 212(3)(b)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/3/b)
[^c23287311]: S. 126 not in force at Royal Assent; s. 126 in force at 23.7.2018 for specified purposes, see [s. 212(3)(b)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/3/b)
[^c23287321]: S. 127 not in force at Royal Assent; s. 127 in force at 23.7.2018 for specified purposes, see [s. 212(3)(b)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/3/b)
[^key-00432701eea2cde637ac5d287f4837c8]: [Sch. 19 para. 333](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/333) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-00c31acc0526af8b197626c45f603186]: S. 103 in force at 16.9.2019 by [S.I. 2019/1188](https://www.legislation.gov.uk/uksi/2019/1188), [reg. 2(c)](https://www.legislation.gov.uk/uksi/2019/1188/regulation/2/c)
[^key-019c61443b227cfc431617e576673df8]: [Sch. 19 para. 368](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/368) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-01e0b7c056d90098dda06c025884a600]: Sch. 1 para. 40 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-020bbab2a3937097fe87c235aa9d2876]: Words in Sch. 2 Pt. 6 heading omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(22)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/22) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-0228d23a866d3b67264125f2ef6b7ee5]: Words in s. 26(2)(c) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 34(3)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/34/3/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-0261d887a09ac80ed5671762eabc2d89]: Words in s. 17(7) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 22(5)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/22/5/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-0275322d4c3e9338c7982248c59afa08]: [Sch. 19 para. 26](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/26) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-028cd06e6f950f4558cd72890b7ed743]: [Sch. 19 para. 257](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/257) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-02c9392ccbfe5d518f4e56dba15b087b]: [Sch. 19 para. 139](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/139) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-03a41268b1f986aee847dad7f0702a19]: Words in Sch. 2 para. 26(9)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(21)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/21/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-03be80b9d01d85e387feb8f4beaf6d2f]: [Sch. 19 para. 32](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/32) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-03d2f3e7999eedf91b3cf7abed68d4f9]: [Sch. 19 para. 289](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/289) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-043f7bc14d22fdcbfb448881e634bb29]: [Sch. 14 para. 9](https://www.legislation.gov.uk/ukpga/2018/12/schedule/14/paragraph/9) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-0447af8ae299a204a2630922dc53e872]: [Sch. 19 para. 270](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/270) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-044a7ac5d319a0ffb7c00ed7636fa913]: S. 3(9)(b) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 4(3)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/4/3/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-048713be6754b1e793f21b40269622d9]: Sch. 1 para. 29 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-04a116e5e2b279f99e07bb7fc9c120bd]: [Sch. 19 para. 69](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/69) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-04deb533ed57e15add641215ed3efabf]: Sch. 20 para. 46 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-055760fc82e5e2786df333ac02e415f3]: [Sch. 19 para. 297](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/297) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-058ceb009e6f2263b728c5df73cb3576]: Words in s. 187(2)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 81(5)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/81/5/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-068079f0d354b65a415f2cdd6d742510]: Word in s. 165(5)(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 66(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/66/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-06e85acf6fae37d9f442573e440e4c13]: Words in s. 24(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 32(2)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/32/2/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-07090df3ca4a1ef9932cc47e618dc305]: Words in s. 149(2)(e) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 61](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/61) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-071d1dd7492c1a08829b1e12514d44f6]: [Sch. 19 para. 393](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/393) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-073279dc56c10b95d4fc1174d2bb9002]: [Sch. 19 para. 344](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/344) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-075130ba76e3c3f27cf76df70ec522b8]: [Sch. 19 para. 204](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/204) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-075c9a035c809ff241232418d14ceeff]: Words in s. 190(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 84](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/84) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-078834edf1fff161c9e6fa81ce234817]: Words in s. 183(2)(d) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 78(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/78/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-07e5424a1ee2d09e154dd4e8255595ea]: Words in s. 73(3)(c) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 40(3)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/40/3/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-084b887a076ea35667f44af638a1383c]: Words in s. 3(9)(e) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 4(3)(c)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/4/3/c) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-0876256c5ad3d60e361b782c4058e808]: [Sch. 19 para. 224](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/224) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-08a66ca2af7b4b1ea6d3d87306a370f7]: Words in Sch. 2 para. 1(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(5)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/5/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-08b293e3fde48c9b8dd1f1ec574b10ea]: S. 205(3) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 85(6)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/85/6) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-08f0dc8ee77a2e679c674a1653b65e89]: [Sch. 19 para. 44](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/44) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-0980e055af9390b4571e201b8f8aafaa]: Words in s. 1(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 2(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/2/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-09ad4c27f1d1f5107104ceb3233831b0]: [Sch. 19 para. 104](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/104) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-09da2f0bffbc26c05b2dc87ab4d3cd36]: Words in [s. 6(2)](https://www.legislation.gov.uk/ukpga/2018/12/section/6/2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 9](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/9) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-09fdc01e4022553e41255db6f7e74f0f]: Words in [Sch. 2 Pt. 3](https://www.legislation.gov.uk/ukpga/2018/12/schedule/2/part/3) heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(13)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/13) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-0a47f233acc9d54f244d68e5e7b97287]: [Sch. 7 para. 7](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/7) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-0a802107ab2c08fc27b1ddde01f85aa8]: Words in Sch. 4 para. 1 substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 94(4)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/94/4) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-0a86b7ac7f6cd28ad8594499bf962105]: [Sch. 12 para. 4](https://www.legislation.gov.uk/ukpga/2018/12/schedule/12/paragraph/4) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-0ad994e390ded3737e0cf452dcb87c1c]: [Sch. 19 para. 88](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/88) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-0b089b6e1c9a68b042bfb7d6decabe4a]: Sch. 20 para. 48 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-0b10f6281c849fb152ebfa1af8d2f949]: Words in [s. 115(5)](https://www.legislation.gov.uk/ukpga/2018/12/section/115/5) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 47(6)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/47/6) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-0bfd00907b511398d0520d55dda1857c]: [Sch. 19 para. 140](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/140) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-0c2efecad359220e6a37b89dba30fb47]: [Sch. 19 para. 334](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/334) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-0c64f94808e62ce8c06e20ffbc5b1116]: [Sch. 16 para. 4](https://www.legislation.gov.uk/ukpga/2018/12/schedule/16/paragraph/4) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-0c925c155f884ff322d1f06c0cf09a74]: [Sch. 19 para. 239](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/239) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-0ca2154432d523e9349716a80c0650a7]: [Sch. 19 para. 222](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/222) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-0cd28f0f5d93804597b7bab43c86f5e2]: [Sch. 19 para. 401](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/401) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-0d0f728e9f8b4a55db8deb669c342540]: [Sch. 7 para. 13](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/13) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-0d271530c429f861f97bd026d99487d6]: [Sch. 19 para. 48](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/48) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-0d28ce61d602ad2e767e31293c260e43]: [Sch. 16](https://www.legislation.gov.uk/ukpga/2018/12/schedule/16) applied (with modifications) by [S.I. 2016/696](https://www.legislation.gov.uk/uksi/2016/696), [Sch. 2](https://www.legislation.gov.uk/uksi/2016/696/schedule/2) (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 406](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/406) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g) (with [reg. 4](https://www.legislation.gov.uk/uksi/2018/625/regulation/4)))
[^key-0d4b111311777831fdffba581e848ea6]: [Sch. 9 para. 5](https://www.legislation.gov.uk/ukpga/2018/12/schedule/9/paragraph/5) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-0d717e014e2ac42d02e0b61cef256e2c]: [Sch. 10 para. 5](https://www.legislation.gov.uk/ukpga/2018/12/schedule/10/paragraph/5) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-0e1a221ed43e81a753b0777427765028]: S. 176 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-0e22a095e41e8693fa7318f4c45ed9e9]: [Sch. 19 para. 19](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/19) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-0e87ceeaeb473d5c9e0fc5a4ea92b025]: Sch. 20 para. 28 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-0ebeabb9baa1c3270129deaf8098cef1]: Sch. 20 para. 37 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-0ec738b14348d17f3e62b70513465a13]: [Sch. 19 para. 55](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/55) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-0ec85b5201d6c46e5fab22ab4e896d43]: Words in s. 78(5)(a) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 45(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/45/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-0ee3310713d1629ddd39380fe64cbd00]: [Sch. 19 para. 42](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/42) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-10250dcd0017993ac3d096de2e88503b]: Words in s. 15(2)(e) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 19(7)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/19/7/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-104c707c6a01b69f5d71d71da7c75c6d]: [Sch. 19 para. 101](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/101) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-1051e17c49a81d00262c51a04b7fce43]: [Sch. 19 para. 127](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/127) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-111e5ef955c0f9aedabdb8e61940d711]: Sch. 1 para. 23(3)(e) repealed (31.12.2020) by [The European Parliamentary Elections Etc. (Repeal, Revocation, Amendment and Saving Provisions) (United Kingdom and Gibraltar) (EU Exit) Regulations 2018 (S.I. 2018/1310)](https://www.legislation.gov.uk/uksi/2018/1310), [reg. 1](https://www.legislation.gov.uk/uksi/2018/1310/regulation/1), [Sch. 1 Pt. 1](https://www.legislation.gov.uk/uksi/2018/1310/schedule/1/part/1) (as amended by [S.I. 2019/1389](https://www.legislation.gov.uk/uksi/2019/1389), [regs. 1](https://www.legislation.gov.uk/uksi/2019/1389/regulation/1), [2(2)](https://www.legislation.gov.uk/uksi/2019/1389/regulation/2/2))
[^key-111f1a1c71e0256436529fc90b060e72]: [Sch. 7 para. 26](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/26) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-1148dc6616b45f92ec3191558e2d7f41]: [Sch. 19 para. 353](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/353) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-1184aae7611f8dceba09b9e679d2f54c]: Sch. 1 para. 34 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-11c07ee11f2167bbb1763bd246448e85]: [Sch. 19 para. 217](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/217) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-11ce3e1bdc55c65611f28c3a935d263d]: [Sch. 19 para. 95](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/95) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-11e7c66b8939b2e6758255eed50c6b54]: [Sch. 19 para. 305](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/305) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-122e04060480ebe585560440bf984c41]: Words in s. 171(8)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 72](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/72) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-12685902bd117eecdf41483cba453640]: Words in Sch. 3 para. 20(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(19)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/19) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-12f86fac951fc73c0140d571a31e9292]: [Sch. 19 para. 210](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/210) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-134fd5e04dd25c969baf7cb8da305ebf]: [Sch. 11 para. 10](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/10) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-1366acd7f95a9c1e06161794880e0719]: Sch. 20 para. 35 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-145f005fd8042c51b0664ff136e39957]: [Sch. 7 para. 18](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/18) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-14aa686d4a0f1f82327479d58921ab37]: [Sch. 19 para. 331](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/331) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-14ad0fde7b800982b4c427e3cb39df35]: Sch. 1 para. 6 modified by [S.I. 1999/677](https://www.legislation.gov.uk/uksi/1999/677), [art. 7(1)(2)](https://www.legislation.gov.uk/uksi/1999/677/article/7/1/2) (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 237](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/237) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g))
[^key-15470efb9363c5548c4b065c183e0df8]: [Sch. 19 para. 214](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/214) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-15749221f368fbb105364a1b67ee891c]: [Sch. 19 para. 38](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/38) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-1590f8dd0e2f25840803266b0a89f970]: Words in s. 189(4)(c) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 83(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/83/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-1595a2a030d641505cc5c2b290d675b1]: Words in [s. 115(10)](https://www.legislation.gov.uk/ukpga/2018/12/section/115/10) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 47(10)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/47/10) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-1622e2e636a8697beaac52d8c441e4ac]: Sch. 1 para. 20 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-16bde097283134ad53e67bc7eced6507]: [Sch. 9 para. 2](https://www.legislation.gov.uk/ukpga/2018/12/schedule/9/paragraph/2) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-16c6bec2c0f932b75e6e897d0d0214e1]: [Sch. 19 para. 300](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/300) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-17124b67fbec472842be06ef4430da1f]: [Sch. 19 para. 416](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/416) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-1751702947b03f5d997effe7d3559e00]: [Sch. 19 para. 59](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/59) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-17a7230647a2583246524911d5578f98]: [Sch. 19 para. 403](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/403) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-18239a18e3bd9a603de2281708e6151d]: [Sch. 19 para. 241](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/241) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-187011edc25500f0e9ac9f2a1b42e1b3]: [Sch. 19 para. 180](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/180) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-187293003be44c5bcbbaa54a11235709]: [Sch. 8 para. 1](https://www.legislation.gov.uk/ukpga/2018/12/schedule/8/paragraph/1) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-1891a577bed40a948968a85d66637a93]: [Sch. 7 para. 11](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/11) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-18a50fc05df7fa3cf98132d81799b519]: [Sch. 19 para. 196](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/196) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-18c04c183259e8b8dda524fe72d1db0a]: [Sch. 19 para. 328](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/328) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-18c493f49d96ae6ccb3c8cced0fddc5d]: [Sch. 19 para. 421](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/421) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-18f5225df519ce6258d663cbb0e9a035]: [Sch. 7 para. 42](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/42) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-192a1bf9519afe99b825d17615dfc26e]: Sch. 5 para. 7 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-192b65f20b37cd2b1425d8b8099bd30c]: [Sch. 19 para. 427](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/427) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-1a7305813bab945662593ecbbd86a3cc]: [Sch. 19 para. 267](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/267) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-1a7fa63e5530837c3583f0e5c7220882]: Words in s. 5(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 6(2)(c)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/6/2/c) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-1aeb023a0722a101af167f5207dc0988]: [Sch. 20 para. 1](https://www.legislation.gov.uk/ukpga/2018/12/schedule/20/paragraph/1) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-1b3210620a45e848232ab9e47619a0b4]: [Sch. 19 para. 134](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/134) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-1b4ccf50fa29ed8677a8eda0173f00f9]: [Sch. 19 para. 349](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/349) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-1bc27c21cc548d92bc3de596a7cdbe0e]: Words in s. 213(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 90(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/90/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-1be29581136bd4c18ff6bb98bfbee461]: [Sch. 7 para. 28](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/28) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-1be9e273ac0b64d03506cf32210c1a57]: Sch. 3 para. 18 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-1c030dd28010faaf2bbe31a050893ce4]: Words in s. 26(2)(f) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 34(3)(c)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/34/3/c) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-1c131e673e4b114091bed8a61ac7815e]: [Sch. 9 para. 3](https://www.legislation.gov.uk/ukpga/2018/12/schedule/9/paragraph/3) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-1cc22440a757c75d6a761e14e8508d42]: Sch. 20 para. 18(8) inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 101(4)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/101/4/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)) (as amended by [S.I. 2020/1586](https://www.legislation.gov.uk/uksi/2020/1586), [regs. 1(2)](https://www.legislation.gov.uk/uksi/2020/1586/regulation/1/2), [5(3)](https://www.legislation.gov.uk/uksi/2020/1586/regulation/5/3)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-1ccd56afc99d98d997ea26936d814e5e]: [Sch. 7 para. 35](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/35) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-1d0aacbc6a3f57fb9614a5fc01346883]: Words in s. 15(2)(c) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 19(5)(c)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/19/5/c) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-1d18615dcf9a20c1820111b3a81f31c2]: [Sch. 19 para. 302](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/302) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-1d193e02860f55c99db471219ec3f06e]: [Sch. 7 para. 47](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/47) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-1d55fa5fc856a1be58b2f58fd5d98059]: S. 165(6) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 66(4)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/66/4) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-1e29eba27e76c7408aaff2905df122df]: [Sch. 19 para. 313](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/313) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-1e4185b59d1be365db23794ea0ee1651]: Words in s. 16(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 20(2)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/20/2/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-1e98d97332c9829fa200bf50f75866b5]: [Sch. 19 para. 63](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/63) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-1ee41f387acdf11b0ee41fecc521ae98]: Words in [s. 115(4)](https://www.legislation.gov.uk/ukpga/2018/12/section/115/4) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 47(5)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/47/5) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-1ee641f3c321f91dfed1e82cc0461f56]: [Sch. 19 para. 135](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/135) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-1f749532a8740f1e9eda4d0128a2a075]: Words in s. 142(9) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 59(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/59/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-1f896c19e41b1006ed860e9969942795]: S. 182(3)(a) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 77](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/77) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-1fb38bce83de1fe5b681b8cdde5ff129]: [Sch. 19 para. 111](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/111) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-1fef7e66182de00ab308293cffb72a92]: Sch. 13 para. 2 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-2041ee869046f0555101f3c828389214]: [Sch. 12 para. 12](https://www.legislation.gov.uk/ukpga/2018/12/schedule/12/paragraph/12) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-20637b6951bd30d789aabe29602a4eb2]: [Sch. 19 para. 97](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/97) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-2100b3196361a95d8557db2f9b70e820]: [Sch. 19 para. 381](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/381) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-211221de3dc056053a4c24f48f61a5c6]: [Sch. 19 para. 110](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/110) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-213b489d8cd0817f932abf8b31c43adb]: [Sch. 19 para. 2](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/2) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-21b9303a7f71f231674bf2d10ba2e078]: Words in Sch. 3 para. 6(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(9)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/9) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-21cd06c381ae74c2c93a120a10d0d395]: Sch. 20 para. 2 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-21f4d7f3e477eb190524128d785be4e6]: Words in s. 15(2)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 19(3)(c)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/19/3/c) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-21fced2ab0bcbddc5fc58b17d5e47dcf]: [Sch. 19 para. 287](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/287) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-224603786e8386f2203555d1040fa06f]: [Sch. 7 para. 2](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/2) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-224beca082638e8b5e55543343cc38ac]: [S. 158](https://www.legislation.gov.uk/ukpga/2018/12/section/158) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-22a9c9e8dbf86322bdf3b841fb939851]: [Sch. 19 para. 122](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/122) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-22c9cb2cd2037b308003142aeeee5b32]: Words in s. 5(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 6(3)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/6/3/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-22d803690c292d06381ab7cc715f03f9]: [Sch. 15 para. 6](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/6) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-22e89107ecf415c850b5a6f0b9b59302]: [Sch. 19 para. 232](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/232) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-23171ba5132253c85a145de87e1054c5]: [Sch. 19 para. 207](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/207) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-235e6b33584803340fe72ec9d6854d43]: [Sch. 16 para. 3](https://www.legislation.gov.uk/ukpga/2018/12/schedule/16/paragraph/3) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-2363f203a486d42fce7735a05b0e351b]: Words in Sch. 5 para. 4(4) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 95(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/95/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-236e24c6f934d419e363944d3a1f36fa]: Words in s. 24(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 32(4)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/32/4/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-239c68a5d49bddfad7b7c6cbedee418b]: [Sch. 7 para. 6](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/6) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-23f48e53190001650ee581d5ea78c872]: [Sch. 19 para. 304](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/304) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-2434c3fb6c8b5ee17896e645120e0c61]: Sch. 2 para. 27 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-24b3bbdc5e59d705d0210a6f74674451]: [Sch. 19 para. 33](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/33) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-24c67fb416c38423b577d923c55b3ec9]: Words in s. 26(2)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 34(3)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/34/3/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-24f952f7070198136c58ea4ed6a49950]: S. 205(2)(za) inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 85(5)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/85/5/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-25346aaf6bc9db597d7da83585c8bc2f]: [Sch. 19 para. 118](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/118) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-25d3635823d956cf15b550afd13d4e98]: Words in s. 206 Table inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 86(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/86/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-2626514eaa370e042778c491444aee9c]: [Sch. 19 para. 11](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/11) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-26277b73a6ec8bb86d52ca4da18c621d]: [Sch. 19 para. 149](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/149) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-262a153ed6a3f20ecbab0d2e9c49834e]: [Sch. 19 para. 405](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/405) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-265015252b5915c275c3cce0e5a160d7]: [Sch. 15](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15) applied (with modifications) by [S.I. 2016/696](https://www.legislation.gov.uk/uksi/2016/696), [Sch. 2](https://www.legislation.gov.uk/uksi/2016/696/schedule/2) (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 406](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/406) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g) (with [reg. 4](https://www.legislation.gov.uk/uksi/2018/625/regulation/4)))
[^key-265056c26b76a20e1dbc856fb69e9468]: [Sch. 19 para. 121](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/121) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-26ded41f68d1f732b3865cc93e8d88fd]: Sch. 2 para. 19 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-26e02e31432cdbfaad7525568f904f96]: [Sch. 19 para. 280](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/280) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-26e53c4365c637973f201bac1a9d893e]: Words in s. 26(2)(g)(ii) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 34(3)(e)(i)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/34/3/e/i) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-274e371213d21f8c518714836a7fd931]: [Sch. 8 para. 2](https://www.legislation.gov.uk/ukpga/2018/12/schedule/8/paragraph/2) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-278bdb819fea7c369510f10a29ffbc41]: Sch. 1 para. 24 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-279763c8e56d8c1e5cf0701b35542316]: [Sch. 19 para. 78](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/78) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-27acdc78f2593bdf3b923e0a174dcec0]: [Sch. 19 para. 106](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/106) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-27e1ea602a2a134d5052b4c1e8e3440c]: [Sch. 19 para. 413](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/413) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-281d4e6540db13c15fe85d6b8cfcaa7f]: [Sch. 19 para. 205](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/205) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-2889cf5caada78513e3eb57b96eea5cc]: S. 112 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-28d4daa78be4e5d33285e5535b47873d]: [Sch. 10 para. 6](https://www.legislation.gov.uk/ukpga/2018/12/schedule/10/paragraph/6) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-28eb7957e80be04910aa9b6ac58baaf7]: [Sch. 19 para. 141](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/141) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-28f473b60938488229022a08cd48e4ad]: S. 110 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-290821ace42a16c497f396db54e9f858]: S. 4(3) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 5(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/5/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-291309ec0bfa295d73c7089ca1b91dd5]: Pt. 2 Ch. 3 heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 27](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/27) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-294f9f790bda664a2188b1b513ce0b8a]: [Sch. 9 para. 1](https://www.legislation.gov.uk/ukpga/2018/12/schedule/9/paragraph/1) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-296a24e4c876580d5b86d4ca2becc824]: [Sch. 19 para. 151](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/151) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-29a7c98ef1e800734a584e99822ec2b2]: Words in Sch. 2 para. 26(9) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(21)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/21/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-29cfe17814242f806ba3aeb1d9e9afd6]: Words in Sch. 3 para. 19 substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(17)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/17) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-29e112b63328c8a746536836db1c3966]: Words in s. 1(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 2(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/2/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-29e6a8adebc12062d8e7bbdbb4f20243]: [Sch. 15 para. 2](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/2) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-2a00008589acb6f36983567b9fc6e820]: [Sch. 19 para. 120](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/120) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-2a10ec67b795dad031d7e434ef582e79]: Words in s. 2(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 3](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-2a3a6de533c8c12b0494351998aa1271]: Sch. 20 para. 24 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-2acdeca126a2ebe1ce6a4586947c1173]: [Sch. 19 para. 306](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/306) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-2b2224275f44680ddca2bfd57fbc2416]: [Sch. 19 para. 250](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/250) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-2b9674d7bfd3049679cc97dc1b298995]: S. 161 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-2b9b3d8589286b3b26ca6b92d1868c01]: [Sch. 19 para. 404](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/404) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-2bae9f70ba5cbd2b51246898aabb15e1]: [Sch. 19 para. 376](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/376) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-2c18515dd4765f9f04330a4672395f59]: Words in s. 14(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 17(2)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/17/2/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-2c7e00ac1f688e12ca2bcc445e3ef4a8]: [Sch. 19 para. 192](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/192) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-2ca4732bc3269bd15c7a1977be4e7b34]: Words in s. 20 substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 26(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/26/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-2d48534b027b25a30a2b80c2a510dd6b]: [Sch. 19 para. 243](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/243) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-2d89ded5d2f38b02918f66bf72aa9a67]: [Sch. 19 para. 34](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/34) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-2df4d20a1557bfe80bf3be5e338ab1e3]: [Sch. 19 para. 87](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/87) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-2e0041ef43a73fe0769dd148a0a2f935]: [Sch. 19 para. 411](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/411) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-2e016290a3bce07321b5932b8b9442cb]: [Sch. 19 para. 10](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/10) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-2e19ecb9205e26fabcbb68559b8159f5]: Words in s. 24(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 32(2)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/32/2/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-2f0e9d2ad7758b3d8eeaabe264498df0]: [Sch. 15 para. 11](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/11) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-2f2b6b8a9c341182dd7aa56637785a0a]: Words in Sch. 2 para. 1(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(5)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/5/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-2f908b9fefb61f6ccda52c5f821ade6a]: S. 154 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-2fbe32aca2b996b3d860ba43d5ed4d2a]: Words in s. 5(1) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 6(2)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/6/2/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-2fdc0f7c7c058ffa2465d97115f722c5]: [Sch. 19 para. 286](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/286) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-305ad8039b1a46c5f9ea78fe8a6b5ff7]: [S. 183(2A)](https://www.legislation.gov.uk/ukpga/2018/12/section/183/2A) inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 78(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/78/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-30d4dac90018730975d3332a90aa59d7]: Words in s. 24(5)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 32(5)(d)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/32/5/d) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-30f8f37f3351a58e02d6f5b4850e8f6a]: [Sch. 19 para. 299](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/299) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-3119209adeaef6a1df5147b527a4b2b7]: Words in s. 77(8) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 44](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/44) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-31302a37f9c6f4ae81079d8a479c0dc1]: [Sch. 19 para. 169](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/169) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-3133faf8febe41406d2f9f821f7ee0d1]: [Sch. 19 para. 143](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/143) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-31415131204b8cc0dde6edf55660411f]: [Sch. 19 para. 46](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/46) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-3168771c0476757a85e3db057f143c5a]: Words in Sch. 18 para. 1(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 99(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/99/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-3180f2fd1280321b20ee6e24d5d513cc]: Sch. 1 para. 9 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-31dcfda5dcd4e66221acf33abd97bf04]: Sch. 20 para. 23 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-324729d85d46bf435833df74eab03372]: Words in s. 26(2)(e) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 34(3)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/34/3/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-32de75b19001af6b4273053c3b092e07]: [Sch. 11 para. 7](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/7) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-32f6f942b277dbd276b96d5b0984e118]: [Sch. 19 para. 157](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/157) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-33106c6218135aa1517b7c246074feb9]: [Sch. 19 para. 6](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/6) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-3322ebf4c927f1806b05df81f4e0343f]: Words in Sch. 4 para. 1 cross-heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 94(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/94/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-3327a481d30c9bdff556a8b76ded69cb]: [Sch. 19 para. 123](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/123) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-334055490339c13a3065b12d15d14412]: [S. 163](https://www.legislation.gov.uk/ukpga/2018/12/section/163) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-3369d46a2dc6feb2b919520a08308048]: [Sch. 19 para. 103](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/103) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-3381b8ddd4ef0abf6790266e0cb8ac00]: [Sch. 19 para. 228](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/228) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-33844decc2c84b21970a5264085c1f39]: [Sch. 7 para. 27](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/27) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-33edea286b09352abf016a9e1f3354e0]: [S. 120(2A)](https://www.legislation.gov.uk/ukpga/2018/12/section/120/2A) inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 52(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/52/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-34cd2e6cbe01eabb3d06225a7efe69b9]: Words in s. 205(2) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 85(5)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/85/5/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-34d8058ca9b991f37fca48403aab4b4a]: Words in s. 25(2)(a) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 33(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/33/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-34e9a827a167dace4af311fb2cd2994a]: Words in [s. 115(2)(a)](https://www.legislation.gov.uk/ukpga/2018/12/section/115/2/a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 47(4)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/47/4/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-34f65a9d3e96f8d7ff571af361392340]: Words in Sch. 2 Pt. 1 heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-34fe6f107e4f7bc7983506ee6a91cf35]: [Sch. 19 para. 434](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/434) in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-351ec702d4e1f2a9e1b9458310accfc5]: [Sch. 7 para. 46](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/46) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-35344b59ed8359babcc5cd6308a3eb8d]: [Sch. 19 para. 66](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/66) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-35558747b8c46c8ff03f147f0a7482a4]: [Sch. 19 para. 341](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/341) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-3560e5cacbfff2ce849e5488c234c4c9]: Words in [s. 115(3)](https://www.legislation.gov.uk/ukpga/2018/12/section/115/3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 47(5)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/47/5) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-357515c65e8f9ab1a677364595663442]: [Sch. 19 para. 395](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/395) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-358700da09bd3b3db589d842d7dd9ab7]: Words in s. 17(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 22(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/22/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-35c840436ea427bbc6b05f90d6e943f1]: [Sch. 19 para. 131](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/131) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-35db6d3245ae82a21c0141b79278945a]: Words in s. 25(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 33(2)(c)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/33/2/c) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-35f6fa2fbc924bdd78dd22662e1d4e70]: Words in s. 169(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 70](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/70) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-36402eee3cdb8da6d3cb1e50ca39070b]: [Sch. 19 para. 310](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/310) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-36599635eca521fc080bdf0f265f7284]: [Sch. 12 para. 10](https://www.legislation.gov.uk/ukpga/2018/12/schedule/12/paragraph/10) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-36a3e256a527d89c5a740d38dbd8973e]: Words in s. 26(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 34(2)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/34/2/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-36b37c6d1c4d4736d1dab263576fcebd]: S. 125 in force at 23.7.2018 for specified purposes by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 3(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/3/b)
[^key-372630a73b4028cf109f79d1f0665678]: Words in s. 187(5) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 81(6)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/81/6) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-377a1b0604cd68d461b2246e995e46e0]: [Sch. 7 para. 17](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/17) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-37cacf20bf249c74413aada2c52be2c5]: [Sch. 19 para. 325](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/325) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-37cead3703128bdbe14f9449c15cb01c]: Words in [s. 115(2)](https://www.legislation.gov.uk/ukpga/2018/12/section/115/2) inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 47(4)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/47/4/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-3813ee8247c9e3239d38238f596aab7f]: Words in [s. 120(6)](https://www.legislation.gov.uk/ukpga/2018/12/section/120/6) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 52(4)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/52/4) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-38b76457e1736087523fe425b9baf70a]: [Sch. 19 para. 371](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/371) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-38c99db18cd5c194cee9495ce48403e8]: [Sch. 19 para. 223](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/223) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-38f52a9e32414b17494731e4cbb18039]: Words in [Sch. 2 Pt. 4](https://www.legislation.gov.uk/ukpga/2018/12/schedule/2/part/4) heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(15)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/15) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-391aec4a4ec0685cabdd1aa28a8ba785]: Words in s. 15(2)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 19(3)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/19/3/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-394e213ab391d7a2301095c644dcd821]: Sum in s. 157(6) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 64(5)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/64/5) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-394f7b7301975b7000579ddf95606947]: [Sch. 7 para. 10](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/10) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-398509b660879f90723134aa1a29ea11]: Sch. 20 para. 45 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-39a16e9f2a37e4b260ddb9752a4bc3ad]: [Sch. 19 para. 363](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/363) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-39a195e0216d6cbc9ebfe1cdd1c18fcd]: Words in s. 3(10) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 4(4)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/4/4/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-39b8862f2d1f7dfd1e97471a115f8bff]: S. 3(14)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 4(7)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/4/7/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-39e0ce1bd3a8467f4ceae07a33f920c5]: [Sch. 7 para. 5](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/5) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-39f87c03dd19737cd940c5d9992de450]: Words in [Sch. 2 Pt. 2](https://www.legislation.gov.uk/ukpga/2018/12/schedule/2/part/2) heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(9)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/9) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-39fe8a9769c33999f0f1fbca041c1c1b]: [Sch. 19 para. 27](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/27) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-3a36915e800b4ada4429b4c079cdc070]: Words in s. 80(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 46(3)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/46/3/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-3a7394d89afbce22809a39b409bbe6c4]: Words in Sch. 1 para. 39(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 91(4)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/91/4) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-3a7f17dddd435cdc7527fdbd1c2a1015]: [Sch. 19 para. 215](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/215) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-3a9c148245671edfca7949b3fa2966cd]: Words in Sch. 2 para. 4(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(8)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/8/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-3ab92aa41a35b7fca7dfb7bb9e94ab09]: [Sch. 19 para. 176](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/176) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-3b189075aee602d5dd61a066dc8f918f]: [Sch. 19 para. 43](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/43) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-3c0bda84559a635149b77d2604f5e78b]: [Sch. 19 para. 308](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/308) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-3c2c46a40b01364a2f55ced34f0da62b]: Sch. 2 para. 17 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-3c2ca8b8a39fe6a1c43d2d0d0aa52508]: Words in s. 17(6) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 22(4)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/22/4/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-3c4a6e119bfcb1724fbbe043ea85c3d1]: Words in Sch. 13 para. 1(1)(g) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 97(2)(c)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/97/2/c) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-3c842d85c1197ff1b42f60c711f26783]: S. 15(4A) inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 19(11)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/19/11) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-3c9f258002e16325ad02c0bb9c1494d2]: S. 48(8) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 38](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/38) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-3cd4b21c486fb333c4f69a8f7f6ab0fa]: Sch. 1 para. 27 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-3d084b212bc615dd082bd37fe99059b7]: Words in s. 19(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 25](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/25) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-3d17c501d2052e26fccb827029f0a864]: Word in s. 16(2)(a)(ii) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 20(3)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/20/3/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-3d3c389152b7c8322a41c76aa2f421da]: Sch. 1 para. 15 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-3d4bdf3729cdaf65278d4e8242b8c0e8]: [Sch. 19 para. 76](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/76) omitted (29.3.2019) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(3)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/3), [Sch. 4 para. 3](https://www.legislation.gov.uk/uksi/2019/419/schedule/4/paragraph/3)
[^key-3e188053ee3dc28fc28c56ca4e8c9040]: Words in s. 185(4)(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 79](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/79) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-3e6824e9fac1395ac56538683f7c074b]: S. 123 in force at 23.7.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 3(a)](https://www.legislation.gov.uk/uksi/2018/625/regulation/3/a)
[^key-3e93ab39b36e0906482aa2864196a302]: Sch. 1 para. 6 modified by [S.I. 2007/1118](https://www.legislation.gov.uk/uksi/2007/1118), [art. 5(1)(2)](https://www.legislation.gov.uk/uksi/2007/1118/article/5/1/2) (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 324](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/324) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g))
[^key-3ea752fe762439ea500ec02ee2749c5a]: Words in s. 15(2)(d) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 19(6)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/19/6/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-3eb4d6aaf025a6d26ecf486d178f137f]: Words in [s. 115(2)(b)](https://www.legislation.gov.uk/ukpga/2018/12/section/115/2/b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 47(4)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/47/4/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-3ef88b0e811cc1444359e5e0cb768e95]: Words in s. 28(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 36(3)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/36/3/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-3f625eda300a4caa4b2537beb0425bcb]: Sch. 20 para. 13 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-3f969b23e46516434ae2e89ddc69df68]: Words in s. 15(4) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 19(10)(c)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/19/10/c) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-3f98c0a7a2654c2ef537f15b5f7eb22f]: [Sch. 19 para. 423](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/423) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-40291df4906d4cc34785699c69e47b83]: Sch. 2 para. 28(4) inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(24)(d)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/24/d) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-403f2e7140850b3e5a4883ebe1dfba4a]: [Sch. 19 para. 40](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/40) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4066d18d7abda68a6bfb1fb3a9c5d7f0]: [Sch. 19 para. 406](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/406) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g) (with [reg. 4](https://www.legislation.gov.uk/uksi/2018/625/regulation/4))
[^key-4095aaa2b37901eb26e6c02f6c373ef3]: Sch. 20 para. 59 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-40ea538764fb252a2c1885eea6cf2028]: [Sch. 19 para. 290](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/290) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-411bc56475ba755c5cf8ff8876e096ba]: Sch. 20 para. 38 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-411ec4dab5ca54d4b44cf574e5fc47d3]: Sch. 20 para. 20 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-413d7a05865475abd36b30f3fc486102]: [Sch. 19 para. 45](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/45) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4166d151c2161e3cfa1baed97addc41e]: Words in s. 5(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 6(3)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/6/3/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-41f1fed7dde177dcbd4959f74da05f9b]: Word in s. 16(1)(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 20(2)(c)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/20/2/c) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-4216612a3b459824a4e163c8d4af1a07]: Words in s. 7(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 10(2)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/10/2/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-422675a4f99ccd66679390d411532525]: [Sch. 19 para. 102](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/102) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-427e92f73b3e719ad3cf5a1214730481]: Words in s. 187(1)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 81(3)(c)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/81/3/c) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-43046246cf3f27e7ff102d3f13a65766]: [Sch. 19 para. 252](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/252) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4306e68c9bcde53b4480e1f50d20f060]: Sch. 2 para. 5 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-431929efc48cfd1c7e9f739cdd057f77]: [Sch. 10 para. 4](https://www.legislation.gov.uk/ukpga/2018/12/schedule/10/paragraph/4) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-43399f72f3c3d874b4165535c7568a5d]: S. 127 in force at 23.7.2018 for specified purposes by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 3(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/3/d)
[^key-435242e13aafe834143b8d1833684521]: [Sch. 19 para. 425](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/425) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-43793f9ce196b4380bba69ea0333c340]: Sch. 1 para. 21 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-43bc0992bbfa072aa58b065a6a0dbcb2]: [Sch. 8 para. 7](https://www.legislation.gov.uk/ukpga/2018/12/schedule/8/paragraph/7) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-440e3de22d9a2fac78e668ed17f56a46]: [Sch. 10 para. 7](https://www.legislation.gov.uk/ukpga/2018/12/schedule/10/paragraph/7) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-445f17fb666df6c1f9cf69c559a379b6]: [Sch. 19 para. 230](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/230) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-449c1a7ed7588ac58e65dadd14c1c1b4]: [Sch. 7 para. 30](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/30) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-450c7b25512dedb58adb3ea87cb6ba20]: [Pt. 2 Ch. 2](https://www.legislation.gov.uk/ukpga/2018/12/part/2/chapter/2) heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 7](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/7) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-45472bbd00a393b549f1e72fd153ac3f]: [Sch. 19 para. 119](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/119) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-456760319c42feac9a7898e5f44b1b19]: [Sch. 19 para. 12](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/12) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-459def90d3d948fe23eed3889127cc51]: Words in s. 207(4) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 87(6)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/87/6) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-462113f09780c8525a56db11ffee2460]: Words in s. 24(2)(c) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 32(3)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/32/3/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-4670484b4cf22739c3b6dc134a6750aa]: Words and comma in s. 117 omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 49(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/49/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-46a72a966d1ff585bedf865cca8cec16]: Words in s. 14(5) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 17(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/17/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-46dee059f9cbf1fe5d1cc11477168436]: Words in s. 73(3)(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 40(3)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/40/3/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-476957a259953895973b48488fd85773]: Sch. 1 para. 6 modified by S.I. 1999/3145, art. 9(1)(2) (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 238](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/238) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g))
[^key-479c0bc37322fff5ab05a964ed5802b3]: [Sch. 19 para. 162](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/162) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-48556573bb2ddc6e999946cea4c7d1d1]: Words in [Sch. 2](https://www.legislation.gov.uk/ukpga/2018/12/schedule/2) heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-48eaeef4a832b970bc428de9cf37c88d]: [S. 175](https://www.legislation.gov.uk/ukpga/2018/12/section/175) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-493b6699ab43b773b99b03d2551ed8b8]: Words in s. 15(2)(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 19(4)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/19/4/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-4974e4683c63a2295b4c8e367be9b4bd]: [Sch. 19 para. 384](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/384) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-49b5b8891d09db8683757e7b32a72562]: [Sch. 19 para. 1](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/1) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-49c6c21a8f1c4f4ca1ccfff6d70d38c9]: [Sch. 19 para. 184](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/184) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4a697ea4ae028d646b23790db24f4bf7]: Words in Sch. 3 para. 11 substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(12)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/12) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-4ac91bf85ec11b5b09d2cffc0834e330]: [Sch. 11 para. 3](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/3) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-4ade17abe3f68bf256bff4f2dbb59e3d]: Sch. 20 para. 53 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4b9e6d497580985481a70ac53ffb3760]: [Sch. 19 para. 71](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/71) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4bf0023fc0abe3a6fe28e97ae0db6c8a]: [Sch. 19 para. 96](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/96) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4c20a14917f2c9b020b67a5f513a0f57]: S. 3(11) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 4(6)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/4/6) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-4c80cd42315c6365ff023e85a763c2e5]: Words in s. 18 heading inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 24(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/24/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-4cb750ea4557f2baffcc01c9e44b677f]: [Sch. 7 para. 50](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/50) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-4cdb09090293d26d78397375ceeeef64]: Word in s. 205(1) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 85(2)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/85/2/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-4cf3e7d466f11b7e40ea1d651a44da91]: [Sch. 19 para. 277](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/277) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4d10128808e45c569543c313b90f3f68]: Words in s. 5(7) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 6(6)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/6/6/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-4d5bceecca89ad72be32168252e30a12]: Sch. 1 para. 18 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-4d6b908812e073f2b90981ecb1756d66]: Words in s. 16(1)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 20(2)(b)(ii)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/20/2/b/ii) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-4d91ae4f070d013ae3a148fca0b63010]: Sch. 20 para. 47 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4d956270edecbf7135abf8cbbd045529]: [Sch. 19 para. 399](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/399) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4dd14d64a5ac75aa8ddd3bd00ead5989]: [Sch. 15 para. 9](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/9) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-4e053f303d63b7b74a499c4480735616]: [Sch. 19 para. 409](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/409) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4e06da20a4ee2b31f0f19b9c470f9b8d]: Words in Sch. 1 para. 2(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 91(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/91/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-4ea9d291c5c49ed73079c73322821531]: [Sch. 20 para. 14](https://www.legislation.gov.uk/ukpga/2018/12/schedule/20/paragraph/14) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4ebd65ab97e317d6c230a09c8743e730]: [Sch. 19 para. 226](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/226) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4ed31dd55586adedeb9b02282604b867]: [Sch. 19 para. 93](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/93) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4ef43de1fd3d22fa65d544c29721ca53]: Sch. 20 para. 54 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4fabde886f7f8ff4ffdec98db5a5a329]: [Sch. 19 para. 317](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/317) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4fdda46f1a69130f122c5704602c094d]: [Sch. 19 para. 379](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/379) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-504da48b89f74e638a6616a94f7d03e2]: Words in [Sch. 19 para. 431(3)](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/431/3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 100(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/100/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-50685db8378599c3d063ffd01618c754]: Words in s. 155(2)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 63](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/63) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-51071121f70681b71cab6d579e3ad89a]: [Sch. 19 para. 61](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/61) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5161df839eddc2224f1ac8381d920e73]: [Sch. 19 para. 294](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/294) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-518f0c230d07941d0b60ba6ea8afffc9]: Words in s. 28(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 36(3)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/36/3/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-51e5c70be67119667b759e829b6ec310]: [Sch. 19 para. 342](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/342) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-522cc2ffd4fbefd6bc331626b37d8649]: Words in s. 159(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 65](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/65) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-524d29be7a87de3454a3657a29965b20]: Words in Sch. 2 para. 27(3)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(23)(c)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/23/c) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-5277e76770029ad12ef38864a40b6300]: Sch. 20 para. 31 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5294d6d9aa82b0309648f5ec4d8160db]: [Sch. 19 para. 346](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/346) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-52ed2b8cb72fb84acd6e2db1c86a4a19]: Words in s. 15(2)(e) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 19(7)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/19/7/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-536ca137c3e35cd31b66970c3841bf62]: [Sch. 19 para. 392](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/392) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-537ddaa4e08f232eeb349cab5d9e3a51]: [Sch. 19 para. 91](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/91) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-53926fd489411a896de84bf3547618a6]: S. 16(2)(c) and word inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 20(3)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/20/3/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-53d1de31240f0295cb3039470bdb3395]: Words in [s. 139(2)](https://www.legislation.gov.uk/ukpga/2018/12/section/139/2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 58](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/58) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-5408ef8b4fef9b4413225ee38a7c8a5d]: Words in s. 165(7) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 66(5)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/66/5) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-541c32cbb194df275a3b189f928f6db1]: [Sch. 19 para. 21](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/21) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-542d243b9191f7169b7009b1177f80e5]: S. 3(9)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 4(3)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/4/3/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-547275c503d1622ed745a1844aa3c05c]: [Sch. 19 para. 231](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/231) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-54ccbd5063e3754088932793be4ce0f9]: [Sch. 19 para. 264](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/264) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-54e1cebd08694edba883c6e04419824d]: Words in s. 13(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 16](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/16) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-54ed69a52979c0101f95691b880e8d86]: [Sch. 19 para. 114](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/114) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-551a5acb36329559fb8567a347c30867]: [Sch. 10 para. 8](https://www.legislation.gov.uk/ukpga/2018/12/schedule/10/paragraph/8) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-5596802d5ca5ee15d01f2a0e77ed94e9]: [Sch. 19 para. 236](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/236) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-55d404a9f5a64d1bf721098163e73e8c]: Words in s. 185(4)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 79](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/79) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-55f19b5dfeae5274c86b20d257ee5abf]: [Sch. 19 para. 324](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/324) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5614b756eac3d8dc2bdaf822684cd82d]: Sch. 3 para. 15 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-562d08cd2dcb5be04009f471b7f9552f]: [Sch. 19 para. 200](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/200) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5652c80df7fd4845a3ee74d7a2a77128]: Sch. 20 para. 58 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-56536b33263227125ad45c4609bbea48]: [Sch. 7 para. 33](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/33) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-5657721de3c458b0710026de5d0b03c1]: [Sch. 7 para. 16](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/16) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-568094f95eb275005492dc053906fd96]: Words in Sch. 2 para. 18 substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(17)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/17) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-56a85299b8061657d3e11b677b355c71]: [Sch. 9 para. 6](https://www.legislation.gov.uk/ukpga/2018/12/schedule/9/paragraph/6) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-5719f4546efdf9f702b40b2a5e775b53]: [Sch. 15 para. 16](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/16) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-57812c32673391de107302cc043c6950]: [Sch. 7 para. 19](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/19) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-579c3cd911e92166215a70e270b7943b]: S. 190 in force at 23.7.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 3(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/3/g)
[^key-57bc77e64fe7acec0922ea3c97dedc76]: Words in s. 16(1)(a) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 20(2)(b)(i)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/20/2/b/i) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-57ceaf6d57e9fed63f3260667888e89b]: [Sch. 19 para. 429](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/429) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5800b6be778d654fa3ae9164633a9dee]: [Sch. 19 para. 36](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/36) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-580c2e8451662cbcb05f7efdbd413557]: [Sch. 19 para. 311](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/311) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5829e244b13303dc32dd37fe39fd0076]: Words in Sch. 2 para. 28(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(24)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/24/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-589147da4c3b8f7f70ca38a2aad7a017]: Words in s. 78(4) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 45(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/45/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-5923789b39f2f85486d93c43d008a53e]: Sch. 1 para. 14 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-592385c2bfb47df43a31d621a3e907ca]: [Sch. 19 para. 253](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/253) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5936aeb81208d327b09b5d2cf83f1a01]: Words in s. 7(4) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 10(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/10/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-59a0badca91ad9baca06c67733e4b029]: [Sch. 12 para. 1](https://www.legislation.gov.uk/ukpga/2018/12/schedule/12/paragraph/1) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-59b565f9ed686b63dd17fb78a246be4b]: [S. 148](https://www.legislation.gov.uk/ukpga/2018/12/section/148) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-59da614434458460aa757b305cd350e7]: Sch. 1 para. 30 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-5a1bc9d2d4360d96ed3a6474b2d979fe]: Words in s. 14(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 17(2)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/17/2/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-5a317a18af189f11ef752bf8e9909bfd]: Words in s. 115 heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 47(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/47/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-5a464370d8822b40169ec522a8d773a6]: Words in s. 13(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 16](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/16) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-5a993e31296f76eedd2958f4cd0fda2d]: Sch. 20 para. 41 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5aa83acfda81d5aca3a7d879d20c8168]: Words in s. 206 Table omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 86(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/86/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-5ae2292fa42aa74f4748479a28697330]: [Sch. 7 para. 40](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/40) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-5b04cba0ff9c2386ec587ee807185e0e]: Words in s. 20 substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 26(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/26/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-5b3acd4e0294355b8e9efe356efa7aa4]: [Sch. 19 para. 272](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/272) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5bc0406a73661aa1415e2904b278ad74]: Words in s. 10(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 13(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/13/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-5c6ae5dec8a8b08bfa71e298026863d0]: S. 67(8) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 39](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/39) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-5c6f5e999affc8c51be9d4966b00278f]: Sch. 18 para. 4(3)(a)(ia) inserted (1.12.2020) by [Sentencing Act 2020 (c. 17)](https://www.legislation.gov.uk/ukpga/2020/17), [s. 416(1)](https://www.legislation.gov.uk/ukpga/2020/17/section/416/1), [Sch. 24 para. 297](https://www.legislation.gov.uk/ukpga/2020/17/schedule/24/paragraph/297) (with [Sch. 27](https://www.legislation.gov.uk/ukpga/2020/17/schedule/27)); [S.I. 2020/1236](https://www.legislation.gov.uk/uksi/2020/1236), [reg. 2](https://www.legislation.gov.uk/uksi/2020/1236/regulation/2)
[^key-5c7d608ae586742eec373d2bcdb6a748]: Words in Sch. 13 para. 1(1)(f) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 97(2)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/97/2/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-5caab894dc42fb6245859f88114c6ccf]: [Sch. 19 para. 60](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/60) in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5cc8c98ed927a29271aa9009a37c3a98]: Words in Sch. 3 para. 7(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(10)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/10) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-5cee107d2b615bc782c1b451bf02a558]: [Sch. 3 para. 8(1)(o)](https://www.legislation.gov.uk/ukpga/2018/12/schedule/3/paragraph/8/1/o) modified by S.I. 1999/3145, art. 9(1)(2) (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 238](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/238) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g))
[^key-5cf186d286be79919630c38ec0789919]: Words in Sch. 2 para. 28(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(24)(c)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/24/c) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-5d060454d3ffbec772dcf30d85306332]: [Sch. 19 para. 82](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/82) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5d2229549ab7a2313028e02954440336]: Sch. 20 para. 5 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5db10dd62a7df7a33ae32851a6f9dec0]: Words in Sch. 5 para. 6(4) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 95(c)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/95/c) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-5e45ce56358543510889bcd1e8168c6a]: [Sch. 19 para. 67](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/67) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5ebc40ae0ba03aa3d9abb7a5c47c27a0]: Words in Sch. 4 heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 94(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/94/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-5f09a0ec7fe4d04e41a74ebc4ea7a57a]: [Sch. 19 para. 288](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/288) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5f188da75fed9d0a5af86af0820ced84]: Words in s. 168(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 69(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/69/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-5f231bc059b057c3be3a8b858c1237d0]: [Sch. 19 para. 293](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/293) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5f28dceb83a8870e7b45bbab2176be18]: [Sch. 19 para. 254](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/254) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5f4247df5bc97fcbb47d705dd5c5d78d]: [Sch. 19 para. 295](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/295) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5f4bbbf26f6f9ab8b15592d2c6938ac4]: Words in s. 166(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 67](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/67) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-5fa4e1b4e3138284c1e0c09af0505f2a]: Words in s. 8 substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 11](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/11) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-5fb747b583c0fc376438a9ab6fbe24d2]: Sch. 21 inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 102](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/102) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5), [Sch. 3 para. 111(6)](https://www.legislation.gov.uk/uksi/2019/419/schedule/3/paragraph/111/6)) (as amended by [S.I. 2020/1586](https://www.legislation.gov.uk/uksi/2020/1586), [regs. 1(2)](https://www.legislation.gov.uk/uksi/2020/1586/regulation/1/2), [5(4)](https://www.legislation.gov.uk/uksi/2020/1586/regulation/5/4)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-5fc36683a14c05bd90165c9828617de2]: Sch. 18 para. 6 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5fdefaa38a586680a2225de272d78a95]: [Sch. 19 para. 164](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/164) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-60550e37697dee518cebbbb73d3af841]: Words in s. 24(2)(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 32(3)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/32/3/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-608496013faabf13fc8e487e17bf3a73]: Words in s. 24(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 32(2)(c)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/32/2/c) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-608b2f9cf0fe71bd575fc86bce176a4f]: [Sch. 19 para. 361](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/361) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-60c010d25f11f1914bccbc6d06e219b9]: [Sch. 19 para. 359](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/359) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-60e4a152cf94a583f140fc84ff119a86]: [Sch. 7 para. 12](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/12) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-61187dd7a3e1c1e7fb0580816d8b4c9d]: Sch. 5 para. 5 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-6119956a88aea2b8d3d486d7acad1a04]: Words in s. 26(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 34(2)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/34/2/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-619fd5f08f26b2ca35135ceac03355dc]: [Sch. 19 para. 197](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/197) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-61adeb92f11f45e0ec84df45e73f76e0]: [Sch. 19 para. 126](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/126) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-624b7f167b9be0eda00270c5e40aba6b]: Words in s. 15(4) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 19(10)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/19/10/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-624e37c2f534f473861144715410cd20]: Words in s. 33(7) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 37](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/37) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-6251e3f8b043005c1b3af9c93785fec4]: [S. 144](https://www.legislation.gov.uk/ukpga/2018/12/section/144) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-6269a01b7e8cea25418c69a3a415f3c2]: Words in Sch. 2 para. 3(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(7)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/7/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-62bbcd16a8bad5ae9f248e8cf72a3217]: Words in [s. 115(8)(b)](https://www.legislation.gov.uk/ukpga/2018/12/section/115/8/b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 47(9)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/47/9) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-63001065089a95390c38d674f45299f3]: S. 22 and cross-heading omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 30](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/30) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-6301e98c2aa45525d7a62b4737ed9b86]: [Sch. 15 para. 5](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/5) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-63210b57744fbf08d2edb285a0cd5902]: [Sch. 19 para. 415](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/415) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-63477ad6b0f04b0dec5c0e7403800ffa]: [Sch. 19 para. 108](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/108) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-63549367591b91b245c18fd99b767a4c]: [Sch. 7 para. 9](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/9) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-6419b8d564dad36243ede4ccbdddf886]: [Sch. 19 para. 301](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/301) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-6428f542028b4356211b4b2be7c0f045]: [Sch. 19 para. 18](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/18) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-642964559e6e98411f41113d5d311b98]: [Sch. 16 para. 6](https://www.legislation.gov.uk/ukpga/2018/12/schedule/16/paragraph/6) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-64534ca8115b4440f659353e7c70f148]: [Sch. 19 para. 391](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/391) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-64637fee59d742a478540e692712562e]: Words in [s. 115(8)(a)](https://www.legislation.gov.uk/ukpga/2018/12/section/115/8/a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 47(9)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/47/9) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-64bc08d1985519824ec0dd32abbcec66]: [Sch. 12 para. 7](https://www.legislation.gov.uk/ukpga/2018/12/schedule/12/paragraph/7) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-652e061bb56fb9b4f220ffae3d0a3b7c]: [Sch. 19 para. 259](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/259) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-6545233b44f61feb3cdd2c63700b450b]: [Sch. 19 para. 388](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/388) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-654ef76458b17b962e7470b23278c518]: Words in s. 24(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 32(4)(c)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/32/4/c) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-657aa7e5daf80d8036e29c3d486e1c59]: Words in s. 10(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 13(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/13/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-65db54d1863afa51736d7484ad25641f]: Words in s. 10(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 13(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/13/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-65f6cf7df6085a9cdaea6d8c8baf70c3]: [Sch. 19 para. 420](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/420) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-664583bd72ffa43f978cc1b9b28ad53d]: [Sch. 12 para. 5](https://www.legislation.gov.uk/ukpga/2018/12/schedule/12/paragraph/5) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-664f0d0fd099ec05107c1fc9f6ba7bbc]: Words in s. 15(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 19(9)(c)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/19/9/c) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-6685d554b3e7ed58b3b529c29432b778]: [Sch. 19 para. 128](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/128) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-66ab9d1de4957bbacf62b04943c91e47]: [Sch. 12 para. 8](https://www.legislation.gov.uk/ukpga/2018/12/schedule/12/paragraph/8) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-66b40fbe2726cd954a7c535fce560656]: [Sch. 19 para. 408](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/408) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-66e980b327ff78ef6a0ce646dae209c8]: Words in s. 165(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 66(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/66/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-67033137501744360fc87bf558c6ef23]: S. 80(5)(6)(7) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 46(5)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/46/5) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-6758384614c1ad6fc83cce92f7ba1fb5]: [Sch. 19 para. 370](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/370) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-676fe1a8b2a4417d85acd7eaa0cb4560]: Words in s. 205(1) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 85(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/85/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-6770db32f81e36acabebbe3e140fc8b9]: [Sch. 19 para. 15](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/15) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-678a3382174b5eef118f049a8e0135a3]: [Sch. 19 para. 154](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/154) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-67c2d07c6b756193ae777321980fbada]: Sch. 5 para. 3 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-67f8177fb9af4ad26bb4c77960155a96]: Sch. 2 para. 21 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-68468e63dc949bef1473171d5c80732e]: [Sch. 15 para. 14](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/14) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-6888ac65f30f092ac6490e4894483c5f]: [Sch. 11 para. 6](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/6) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-68c26f2b2ec74cc15e867e9b451f50ae]: Words in s. 25(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 33(2)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/33/2/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-68ecc63089a9afe9300dcfcff0d33f46]: Words in s. 14(3)(c) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 17(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/17/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-68f53a767f04f663ce23ebba7b9a8622]: Words in s. 73(1)(b) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 40(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/40/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-690c58c64b417a3b6f1d897287ce2cc0]: Word in s. 157(2)(a) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 64(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/64/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-691fa57eec6836b5b51677125f451067]: Words in s. 3(6) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 4(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/4/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-692a388eef2538c711e9de2ed9af16bc]: [Sch. 19 para. 152](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/152) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-69b650c8b8cd0a9f9c00303439bac5ac]: [Sch. 19 para. 377](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/377) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-69f1f4e3df8cba86080a11e581cacbc7]: Sch. 1 para. 32 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-69f9a7a9d26266ca1b42b20f77139add]: [Sch. 7 para. 36](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/36) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-69fb4ce7e6a859ec749bbbf85915a53f]: Sch. 20 para. 29 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-6a4270838a15ea82cab691dc84af38d8]: [Sch. 19 para. 348](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/348) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-6abc13cd18a213064aef213a2eae3a9e]: Words in [Sch. 2 Pt. 5](https://www.legislation.gov.uk/ukpga/2018/12/schedule/2/part/5) heading omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(20)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/20) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-6b3dd5366b8aa656104793ad8fbda6d1]: [Sch. 19 para. 178](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/178) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-6b42cc6bc33aa71da55b1f1394b715ff]: Sch. 20 para. 33 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-6b4626506e6293d1de08b9da8fc15ff8]: Words in s. 12(1)(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 15](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/15) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-6b73746ba6f7dc8aef1c83cf22349b69]: [Sch. 7 para. 31](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/31) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-6b973a6a6c7ca62745d334f519a01218]: [Sch. 7 para. 55](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/55) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-6c11b02f4cf2412155ba5dd487de5f5d]: [Sch. 19 para. 271](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/271) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-6c12a28a9f47155604b92c5ded987ee4]: Sch. 2 para. 26(9)(e) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(21)(c)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/21/c) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-6c3e1b90198089fd750919397b5d5f31]: Words in Sch. 2 para. 25(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(19)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/19/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-6c97145e9bea286f39b3cebee1e809b4]: [Sch. 19 para. 138](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/138) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-6d2b09b7c66ecf1a2e1d1430a2abf217]: [Sch. 19 para. 158](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/158) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-6d40880f4046ed50e5f12cfbeea87fa1]: S. 204(2)(a) substituted (2.12.2019 at 00:01) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 227(3)](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/227/3) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2019/1434](https://www.legislation.gov.uk/uksi/2019/1434), [reg. 2(b)](https://www.legislation.gov.uk/uksi/2019/1434/regulation/2/b)
[^key-6d4f96ed12c59e68bdff321d38d2d21f]: [Sch. 19 para. 90](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/90) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-6d54424c74ebcfa6482c38a597b6f8cd]: [Sch. 19 para. 417](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/417) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-6db365e85b52911a728021f65ea4c98a]: [Sch. 11 para. 1](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/1) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-6e02174faaada0c35838f1398366cb37]: Sch. 3 para. 8 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-6e7cb2f6dc84974e7ac6a5e8816900a0]: Words in s. 167(4) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 68](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/68) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-6e84b69220cb50f38474940853f5034b]: Words in Sch. 3 para. 12(1)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(14)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/14) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-6edafa118087c70ee53b6f5cf47d4bbf]: Sch. 20 para. 51 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-6f0ff6b46e942e25d0e08ed709fd7174]: Words in Sch. 2 para. 12 omitted (31.12.2020) by virtue of [The Consumer Protection (Enforcement) (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/203)](https://www.legislation.gov.uk/uksi/2019/203), [regs. 1](https://www.legislation.gov.uk/uksi/2019/203/regulation/1), [5(b)](https://www.legislation.gov.uk/uksi/2019/203/regulation/5/b); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-6f4e482e390982774ce679e4f28783da]: Words in s. 187(1)(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 81(4)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/81/4/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-6fa02887b56cbb4386bbc62d8c2621c4]: Words in s. 117 inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 49(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/49/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-6fe4bc9b35fbbeee514f5574560f3e08]: [Sch. 19 para. 203](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/203) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-6ff2d0b34df3416330022d509ad57eb3]: [Sch. 19 para. 338](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/338) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-700cdd34340327bf52d7691ef5189d8f]: [Sch. 19 para. 22](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/22) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-703e2e342cfcb4603846990fa8e2b775]: [Sch. 15 para. 7](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/7) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-707883b75ea25f6b0172d7b5ee3087c2]: [Sch. 19 para. 414](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/414) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-70a01922df5cc62d22d2f08b0cbb9ff1]: Words in s. 210(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 89](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/89) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-70a8bfc934b51491b5e05c60a48c0fcd]: [Sch. 19 para. 124](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/124) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-710228ff8d8794d510393ca565e31582]: Sch. 1 para. 8 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-712146671e659734df04e3c276c8a6ec]: [Sch. 19 para. 175](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/175) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-71991999d3f30393eac1b24ed8828c51]: [Sch. 15 para. 12](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/12) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-71dea759dbffeefab580aeb644dc5c34]: Words in s. 187(1)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 81(3)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/81/3/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-7285958890d3383878df626a9c90418f]: [Sch. 19 para. 291](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/291) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-72cb372c18446331d54d7581b2844122]: [Sch. 19 para. 283](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/283) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-72d1e7bc8a1a8cdb24823c5c186808fa]: [Sch. 19 para. 364](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/364) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-72fc14e4074bc221cce83073cc6b4954]: Words in Sch. 2 para. 10(2)(c)(iv) inserted (E.W.) (23.7.2019) by [Public Services Ombudsman (Wales) Act 2019 (anaw 3)](https://www.legislation.gov.uk/anaw/2019/3), [s. 77(1)](https://www.legislation.gov.uk/anaw/2019/3/section/77/1), [Sch. 5 para. 28](https://www.legislation.gov.uk/anaw/2019/3/schedule/5/paragraph/28); [S.I. 2019/1096](https://www.legislation.gov.uk/wsi/2019/1096), [reg. 2](https://www.legislation.gov.uk/wsi/2019/1096/regulation/2)
[^key-72fef9ced678f05f26d9e69c3ad91d32]: Words in s. 14(6) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 17(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/17/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-730bc1c474fbdbd93f519027acff36fe]: [S. 146](https://www.legislation.gov.uk/ukpga/2018/12/section/146) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-73831303993667d8f859b9488103ac73]: Words in s. 151(8)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 62](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/62) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-7391cf8e2ee42e601b02ca8e23000688]: Words in s. 168 heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 69(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/69/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-73a5bdb2a7cc14d028614db4749623ee]: Words in s. 204(1)(g) omitted (2.12.2019 at 00:01) by virtue of [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 227(2)(b)](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/227/2/b) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2019/1434](https://www.legislation.gov.uk/uksi/2019/1434), [reg. 2(b)](https://www.legislation.gov.uk/uksi/2019/1434/regulation/2/b)
[^key-73e6fdaac8c2a2ceb6b3e1ac469fcfb7]: [Sch. 19 para. 245](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/245) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-742f3892a7615fbe038b411efd2afeab]: [Sch. 10 para. 2](https://www.legislation.gov.uk/ukpga/2018/12/schedule/10/paragraph/2) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-7439244a501d4ccda7b7ab1b68d56133]: Words in s. 143(9) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 60](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/60) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-7477a257b589b1a659d9da8bb1f814ee]: [Sch. 19 para. 260](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/260) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-748f9db9dd425e0dbebe2451c4618aa0]: Words in s. 189(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 83(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/83/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-74ae32c1534b7fb225df9f0b0a326da8]: S. 102 in force at 16.9.2019 by [S.I. 2019/1188](https://www.legislation.gov.uk/uksi/2019/1188), [reg. 2(b)](https://www.legislation.gov.uk/uksi/2019/1188/regulation/2/b)
[^key-752abb171027a20f86431c530a4f4ac7]: Words in s. 209(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 88](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/88) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-753f1687fbeaa53726164aa1e83b0e09]: [Sch. 14 para. 7](https://www.legislation.gov.uk/ukpga/2018/12/schedule/14/paragraph/7) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-75438dcd3d6caeec4575bd25fb3b15df]: Words in Sch. 2 para. 2(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(6)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/6/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-759e72068bf5cf175f5d6b8e09afd019]: [Sch. 19 para. 62](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/62) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-75e47e526bd371fad97da14f5ce0b720]: [Sch. 19 para. 426](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/426) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-75fa556cead4d7860cebbae93d9ce5ea]: [Sch. 20 para. 43](https://www.legislation.gov.uk/ukpga/2018/12/schedule/20/paragraph/43) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-764b5a189b5ddc8f21ff15d3aadd46f8]: Words in s. 7(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 10(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/10/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-76d8987f83cd23085268f88605eab012]: Sch. 2 para. 8 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-7716f17e15cfe1f6e1c380c980402f84]: Words in s. 16(1)(c) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 20(2)(d)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/20/2/d) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-773e7ccae10930819162576c11ead096]: Sch. 18 para. 3 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-774f89899f61e3fd5faa9f3af3ea0924]: Words in Sch. 3 para. 1 substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(4)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/4) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-7790bea0d0dc4a0926d24673942c24b3]: Words in s. 15(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 19(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/19/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-77ee27866c6c95ed5687861f463894f2]: [Sch. 19 para. 366](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/366) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-782907df884cc218df28335e04f9b6bc]: [Sch. 7 para. 4](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/4) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-783664aa6922d312a1494de208ee446e]: [Sch. 19 para. 57](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/57) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-78821949ef2cd79dbfb3b1bc8aedb9e2]: [Sch. 19 para. 17](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/17) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-78db76102146a4973fbe100f48e3ab2d]: [Sch. 19 para. 422](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/422) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-79e7068c8e4cd6fd22e23d24f813e766]: Words in [s. 6(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/6/1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 9](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/9) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-7a5a1fef2d738d7c657db0fb599f1871]: [Sch. 10 para. 1](https://www.legislation.gov.uk/ukpga/2018/12/schedule/10/paragraph/1) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-7a8fc913f5df2ae9c65b684b305d36db]: Sch. 2 para. 22 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-7aac6a775a9db704483930b3b42f67b9]: Words in Sch. 2 para. 26(9)(c) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(21)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/21/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-7acebc72466e110599be1c7c05f2d8a7]: Words in s. 5(7) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 6(6)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/6/6/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-7b7a7abcbe377f85ee79df3619288d0c]: [Sch. 12 para. 3](https://www.legislation.gov.uk/ukpga/2018/12/schedule/12/paragraph/3) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-7bccbbbdba88ddb2e2eba7451840f2a4]: [Sch. 19 para. 386](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/386) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-7bf18aacb7021b4679ff9e76c5cec185]: Words in s. 15(2)(f) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 19(8)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/19/8/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-7bf8d12b13a9cff5b5baf9f27218e5d6]: Words in s. 188(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 82](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/82) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-7c6e6bf1f7eda1d129edeabdb0d2866a]: [Sch. 19 para. 316](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/316) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-7c87c5571d73717e0f69793bd63591ac]: [Sch. 19 para. 81](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/81) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-7ccfab7aba2fe39c0b4ff439f2977e25]: Sch. 2 para. 24 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-7ce231d6f630571ef964323847674614]: Words in s. 15(4) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 19(10)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/19/10/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-7d89094841f817acd1c11f3f6eb706bd]: [Sch. 19 para. 107](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/107) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-7d8b698fae1da1e113089210b4918385]: Words in s. 28(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 36(3)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/36/3/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-7d8bb035bbc8f61fa799d1e1688f3235]: [Sch. 19 para. 255](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/255) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-7d8cce3dcb21f22fda7befab54189f3b]: [Sch. 19 para. 309](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/309) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-7d998ffaf214abab0fddc3208d040196]: Words in s. 149(2)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 61](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/61) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-7dd7220b049ee579447ab74a0155c8a7]: Words in Sch. 1 para. 41 substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 91(5)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/91/5) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-7e1a7fbb2a9c83863114daca737a02ce]: [Sch. 19 para. 133](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/133) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-7e5af03968fdea50821c2a9e04d4cb7f]: Sch. 18 para. 2 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-7e5daf372d0ee7c8c9274a054f9d68a4]: [Sch. 19 para. 229](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/229) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-7e8a96925239e5ff10b4c1f795f37f75]: Words in s. 5(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 6(2)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/6/2/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-7edbfe20fdfb17c08b5476ec862c2702]: [Sch. 14 para. 8](https://www.legislation.gov.uk/ukpga/2018/12/schedule/14/paragraph/8) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-7ef94efaaff0ee10936b4c95ef7a9bcb]: Words in s. 15(2)(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 19(4)(c)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/19/4/c) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-7efaa3da5db557e39ab7614ad5231e36]: Words in s. 149(2)(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 61](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/61) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-7f00e74cd3a9eb7a899739fc11c8d773]: Words in Sch. 20 para. 50 substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 101(5)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/101/5) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-7f611cef7c9785e78160c449fcd3cf59]: [Sch. 19 para. 166](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/166) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-7fb49ddb4c78e0617a283d46b8fd297a]: [Sch. 19 para. 360](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/360) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-7fcae51576d2c15f60236eee6cb91fa1]: [Sch. 7 para. 23](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/23) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-7fd06888fb048ef993ef93ef456b6b5a]: [Sch. 19 para. 186](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/186) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-8073dd715b8ba844756ab6ffb34393c2]: Words in s. 207(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 87(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/87/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-80aece53fcb0b6da0c128b207cec4326]: [Sch. 19 para. 51](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/51) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-81281ac0c84a46bf1301b64aa0388e21]: [S. 9](https://www.legislation.gov.uk/ukpga/2018/12/section/9) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 12](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/12) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-812f736d922e3056b472b473c1393f22]: Sch. 3 para. 16 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-813ee7d39f52ef91dc62338317d85979]: S. 207(1A) inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 87(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/87/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-814a1f152d26e451009dbffda902ef68]: Sch. 20 para. 44 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-814a6ce67a6a96c8ae4c9adc8a3d0941]: [Sch. 19 para. 242](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/242) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-8168051fc970431e296c2ac4b1ff2bab]: Words in Sch. 2 para. 13 substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(12)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/12) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-816d2aa6bc1c3851c4bfbfc17229dd0e]: Words in s. 26(2)(d) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 34(3)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/34/3/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-81deaf853b1516dd630825a728ac8038]: Sch. 1 para. 25 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-822383846c852126639e302c4f8d3d5e]: Words in s. 3(10) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 4(4)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/4/4/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-8293f14cb956099346b10c81f37389f6]: [Sch. 19 para. 206](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/206) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-82b2319cae98bf9d18d415b5900b1b8d]: [Sch. 19 para. 83](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/83) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-82e6d6ee170d0749ef39b3a4e333d6d6]: [Sch. 19 para. 235](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/235) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-83378423b48f16d54ba90d2ae9044d24]: [Sch. 19 para. 129](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/129) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-835ab8f4363d0fb83f0c4cf209c3a562]: Words in s. 17(7) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 22(5)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/22/5/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-8378189986c623d4592091758ed051d5]: [Sch. 19 para. 362](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/362) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-83a763dd81dbb8571ef5ab019fcdb125]: [Sch. 10 para. 3](https://www.legislation.gov.uk/ukpga/2018/12/schedule/10/paragraph/3) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-83b36e0f8528921cbbf895c351bf7713]: [S. 115(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/115/1) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 47(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/47/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-83b4b960f436c0a11f244dc3d71d2274]: Sch. 20 para. 60 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-83da7441fd879e24ad1e9bf9355724bc]: [Sch. 19 para. 189](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/189) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-83e7b4be5485db05a2217193e409052e]: Words in s. 15(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 19(9)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/19/9/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-847feaddc6148bc37c46c1a3e5b8905c]: Words in s. 17(1)(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 22(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/22/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-84eda6b71dbe3fa5e5686e74405328d3]: Words in [s. 129(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/129/1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 54](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/54) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-8536ab473caeb847327e2f5e6d40132d]: Sch. 20 para. 49 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-85568ff5ac8fb1d7859fa5d6150a01c8]: [Sch. 19 para. 327](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/327) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-8564aee4975abbac8de52f238041a422]: Words in s. 3(14)(c) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 4(7)(c)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/4/7/c) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-85d06a39ca0878ef9dbbbb42d71fbd78]: [Sch. 10 para. 9](https://www.legislation.gov.uk/ukpga/2018/12/schedule/10/paragraph/9) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-85e1aaebfff1e99eeab9dc20a359c058]: Words in s. 205(1) inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 85(2)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/85/2/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-8665babc9bd153c4dbd66185ba2f8336]: [Sch. 19 para. 372](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/372) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-86a457172ca3a7770aff39e9c0ad8ecb]: Words in s. 206 Table substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 86(5)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/86/5) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-86afa8b38318d38d9a1c0a277db14ba1]: [Sch. 19 para. 247](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/247) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-86c0f2e4ef516da39d4241866b656e32]: [Sch. 19 para. 65](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/65) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-8737925ef099c354b79a2dee4ef45379]: [Sch. 19 para. 144](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/144) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-88136afa0ef1df300a43059fe5b24e85]: [Sch. 14 para. 6](https://www.legislation.gov.uk/ukpga/2018/12/schedule/14/paragraph/6) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-888b5b35cd29f20bcaae1dbca8f16d61]: Words in s. 28 heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 36(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/36/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-88a3135321752bf6d4a55db7f2e0cf2f]: [Sch. 19 para. 352](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/352) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-88c6eca9edbc9735a9c60756508aaa04]: [Sch. 16 para. 9](https://www.legislation.gov.uk/ukpga/2018/12/schedule/16/paragraph/9) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-88ce0d1dbc7fe3a0c4496cb8423c1963]: [Sch. 8 para. 3](https://www.legislation.gov.uk/ukpga/2018/12/schedule/8/paragraph/3) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-89ae400598f2d597e634bb358b6bd862]: [Sch. 19 para. 53](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/53) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-8a054058020c4298c356c8dab6602b0b]: Words in Sch. 2 para. 11 table omitted (31.12.2020) by virtue of [The Consumer Protection (Enforcement) (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/203)](https://www.legislation.gov.uk/uksi/2019/203), [regs. 1](https://www.legislation.gov.uk/uksi/2019/203/regulation/1), [5(a)](https://www.legislation.gov.uk/uksi/2019/203/regulation/5/a); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-8a06802189467de7bfd2c3bce4fa1840]: S. 205(4)(5) inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 85(7)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/85/7) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)) (as amended by [S.I. 2020/1586](https://www.legislation.gov.uk/uksi/2020/1586), [regs. 1(2)](https://www.legislation.gov.uk/uksi/2020/1586/regulation/1/2), [5(2)](https://www.legislation.gov.uk/uksi/2020/1586/regulation/5/2)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-8a3b5bb5e99ea65efdafbe742d8645aa]: Words in s. 4(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 5(2)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/5/2/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-8aa8998b53e72cee3848ea89a3f8efcf]: Sch. 20 para. 27 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-8ad456033e37cf5339189b447f441ea7]: [Sch. 19 para. 238](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/238) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-8b31548a22fdf2062e26812b3f8a4cd8]: [Sch. 19 para. 261](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/261) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-8b51cd157e46935889ef5f9158b92e3a]: Words in [s. 6 cross-heading](https://www.legislation.gov.uk/ukpga/2018/12/part/2/chapter/2/crossheading/meaning-of-certain-terms-used-in-the-gdpr) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 8](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/8) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-8bd408574505811db2c82cae1b36a826]: [Sch. 19 para. 198](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/198) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-8bdf2f9115303fb799f509ce612d36e1]: [Sch. 7 para. 48](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/48) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-8be42a9b4ca72b465ef3e53b07fce39f]: [Sch. 19 para. 343](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/343) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-8c2497c1133310d316d82accef38e97a]: Words in s. 3(14)(d) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 4(7)(c)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/4/7/c) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-8c3774348306ed27397be307974b45b9]: [Sch. 7 para. 25](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/25) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-8c5ff1d9f832e281549b01d69284832a]: Words in Sch. 20 para. 18(6)(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 101(4)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/101/4/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-8cf9d6a275e743f533eb559dab94edde]: Words in s. 24(5) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 32(5)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/32/5/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-8cff94f874bcf79b507759af01a7f312]: S. 126 in force at 23.7.2018 for specified purposes by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 3(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/3/c)
[^key-8d0a6b8a209b4ce122af409aeeba27bd]: S. 15 cross-heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 18](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/18) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-8d9d7cdf97e575d2a5c03f8e3c76a63d]: [Sch. 15 para. 10](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/10) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-8ddd7db9cbd1f85a5d9da877704c4c39]: Words in s. 168(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 69(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/69/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-8deea6ad2e1ca2aa03a2df3af2489d28]: Sch. 20 para. 6 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-8e33d9698917e5f35b620ce7b474ccc1]: Words in s. 149(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 61](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/61) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-8e7dfedb656f3087cc752ddd2b3b4127]: Sch. 1 para. 5 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-8eacd628fdb59503091436d5cc4e3698]: [Sch. 19 para. 380](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/380) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-8eea3e6bdf7c7820f434b8c876de250f]: Words in s. 80(2) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 46(3)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/46/3/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-8f06068680301e2c3ed98acf8976fc95]: [Sch. 19 para. 167](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/167) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-8f1f87eac9c9e51e89136342ce6694ad]: [Sch. 19 para. 94](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/94) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-8f7fd51f2b17bc66f5766dfce21ff80d]: Words in s. 76(1)(c) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 43](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/43) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-8fbe292ba1de6fbf2a9d7d97a4bad919]: [Sch. 7 para. 29](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/29) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-8fee20a32a0c94dd1be0c59c92f7d22d]: [Sch. 19 para. 28](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/28) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-905f3924a8759d0b5e86546e2ec79c8f]: Words in Sch. 18 para. 5(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 99(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/99/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-908fd5d459d7a579cab7061f3e5f0f93]: S. 5(4)(5)(6) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 6(5)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/6/5) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-90adc6d9082b6906eaaeb77d1ce53b7f]: [Sch. 19 para. 142](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/142) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-90bc58b2418f34aa3e7689fce7c114d7]: Words in [Sch. 2 para. 6 cross-heading](https://www.legislation.gov.uk/ukpga/2018/12/schedule/2/part/2/crossheading/gdpr-provisions-to-be-restricted-the-listed-gdpr-provisions) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(10)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/10) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-90e3bcc87d1d97af47cc5209d5ca6b8e]: Words in s. 24(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 32(4)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/32/4/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-9135d5f0ba7a938b8e0908d3b822308e]: Sch. 20 para. 22 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9191ac97c4be79c02fb2a00b6516f9c4]: [Sch. 19 para. 356](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/356) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-91c2b0d1083a5749e792bb8cc09b84fd]: Words in Sch. 3 para. 12 cross-heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(13)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/13) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-91f7b5de6c9148c918065d61457bce4a]: [Sch. 19 para. 418](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/418) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-92602c48b03bd64557bffe924a7a3393]: [Sch. 7 para. 39](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/39) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-926294555a21e585ef6c49d64cb54163]: Words in s. 24(5) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 32(5)(c)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/32/5/c) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-92a1d6beec195a72e4c0ded237db7052]: [Sch. 19 para. 322](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/322) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-92a2fbba444a2180ed2d6977278c2304]: Sch. 20 para. 12 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-92d6e74f37be3e97e68bdee8fdc6cda3]: [Sch. 19 para. 319](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/319) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9327a9e51950d697f6ab1419608e7b34]: [Sch. 19 para. 351](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/351) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9415718b0fd9928accda1024defbb8f1]: [Sch. 19 para. 246](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/246) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-946d65c9a908a33d2a45bde886433013]: Words in Sch. 5 para. 1(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 95(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/95/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-9494a2ed2dae96290f9c0461356a1bd3]: Words in s. 149(2)(c) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 61](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/61) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-953b9df49e10ea57d7c67ec16df9d1c0]: Act excluded (30.9.2020) by [The Channel Tunnel (Arrangements with the Kingdom of the Netherlands) Order 2020 (S.I. 2020/916)](https://www.legislation.gov.uk/uksi/2020/916), [arts. 1(2)(b)](https://www.legislation.gov.uk/uksi/2020/916/article/1/2/b)[4(4)](https://www.legislation.gov.uk/uksi/2020/916/article/4/4)
[^key-9554afd386ff1a76b263966b60fc1907]: [Sch. 19 para. 132](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/132) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-956ddefbb071412616ffde4240a5ba73]: [S. 119A](https://www.legislation.gov.uk/ukpga/2018/12/section/119A) inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 51](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/51) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-95787e0b7f0ab5b7c704ec6bec9bc401]: Words in s. 149(4)(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 61](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/61) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-95ee23ccfabc5e4a2c7fa00670a15fe8]: Sch. 20 para. 8 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9667d028d4f7acb47a263b481d8f79bc]: Words in s. 206 Table omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 86(4)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/86/4) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-969f5ea1c155862f9d516708188b069a]: Words in Sch. 3 para. 21 cross-heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(20)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/20) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-96ae04ac2f2af44f8b1423f15c733f45]: S. 26(2)(fa) inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 34(3)(d)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/34/3/d) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-9702e78daee1441e8db8fb0bd641a1d1]: [S. 145](https://www.legislation.gov.uk/ukpga/2018/12/section/145) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-973b20ca86f76226ec3ba9a60c4213af]: S. 193 in force at 23.7.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 3(j)](https://www.legislation.gov.uk/uksi/2018/625/regulation/3/j)
[^key-9752e1069ab46baa7cce26833ac60d44]: [Sch. 19 para. 117](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/117) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-979aacc7d31ac8899ef8e697205ff797]: [Sch. 19 para. 382](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/382) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9807634b4b75f4054b7300d638b00f9f]: [Sch. 19 para. 323](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/323) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-98420a05a42f64a95594aefa455c12e3]: Words in Sch. 2 para. 20(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(18)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/18) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-984b46e4d04043311d1864dca246bc02]: [Sch. 19 para. 150](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/150) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-98672c153973b4c37fe47a5be90b157b]: Sch. 20 para. 11 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9898e0a5f30638665e4860f70c0daca0]: [Sch. 16 para. 1](https://www.legislation.gov.uk/ukpga/2018/12/schedule/16/paragraph/1) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-989b498271c18a95f66ed51054086cd6]: S. 191 in force at 23.7.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 3(h)](https://www.legislation.gov.uk/uksi/2018/625/regulation/3/h)
[^key-98f916de1fd0822bc276904898d720c5]: [Sch. 19 para. 312](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/312) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-98fa005db175e358483a9c7e427babf0]: [Sch. 19 para. 29](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/29) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9a01dffe8e031e6fd2dba2087a13223d]: Words in Sch. 18 para. 5(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 99(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/99/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-9a443c5bd0f1d495d7eb959fe3c7dfdd]: Sch. 1 para. 38 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-9a5a534af2e44027b701cbb835af1113]: S. 108 in force at 16.9.2019 by [S.I. 2019/1188](https://www.legislation.gov.uk/uksi/2019/1188), [reg. 2(f)](https://www.legislation.gov.uk/uksi/2019/1188/regulation/2/f)
[^key-9a7c2d42c9b42f2c440d1a7e097379dc]: [Sch. 19 para. 5](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/5) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9a7f415b585bcfbceb5337eb67913880]: [Sch. 19 para. 354](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/354) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9a8be2cf53d7c39ed62f2d07d32d1c20]: Words in s. 1(4) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 2(4)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/2/4) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-9a96e2a08106565ada79467503826cb4]: [Sch. 19 para. 7](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/7) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9a9736041c34fdc367335955850c35ae]: Words in s. 159(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 65](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/65) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-9ab84fd20d8959180ad4f38e2b805461]: [Sch. 19 para. 25](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/25) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9ac63ff5136041fd04722844c4c6f7c9]: [Sch. 7 para. 45](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/45) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-9acb6d4351d4656b387adbd902b93e6e]: [Sch. 19 para. 39](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/39) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9b02a9bec8375c167bc31a5bc6416f2e]: Sch. 20 para. 9 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9b05bb1b29d1ffb55d5c9c114578c937]: [Sch. 7 para. 15](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/15) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-9b2171fdeed0aa91e80e081837891a4d]: Sch. 1 para. 33 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-9b4888918161ced5908cf5b16e33b46f]: [Sch. 11 para. 11](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/11) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-9b5992e47d071cdf4bc62d00218e439f]: [Sch. 19 para. 193](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/193) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9b74281b86c8372c9d8ee52a902b679f]: S. 205(1A) inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 85(4)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/85/4) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)) (as amended by [S.I. 2020/1586](https://www.legislation.gov.uk/uksi/2020/1586), [regs. 1(2)](https://www.legislation.gov.uk/uksi/2020/1586/regulation/1/2), [5(2)](https://www.legislation.gov.uk/uksi/2020/1586/regulation/5/2)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-9b9087b9158da4ffd811465a30b1f973]: [Sch. 19 para. 146](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/146) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9bc333ae2f3f8bcbd3a38bc3a810fb5a]: [Sch. 15 para. 3](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/3) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-9c101e97812e71a335520eb1c47a6ec6]: Sch. 2 para. 23 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-9cd6eafc08f53ed26f3cab27f3bd17ed]: Words in s. 17(8) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 22(6)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/22/6/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-9ce1c997de01c079f4e45fdcfb0339c3]: Words in s. 151(1)(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 62](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/62) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-9d710e651e6d63fff04c93e4807f2c24]: [Sch. 19 para. 100](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/100) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9dd7994c42a80efb90cbfa1a45252e1d]: [Sch. 12 para. 2](https://www.legislation.gov.uk/ukpga/2018/12/schedule/12/paragraph/2) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-9def3b7505a61a658140ff7ee34bf178]: [Sch. 19 para. 49](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/49) omitted (21.7.2019) by virtue of [The Financial Services and Markets Act 2000 (Prospectus) Regulations 2019 (S.I. 2019/1043)](https://www.legislation.gov.uk/uksi/2019/1043), [regs. 1(1)](https://www.legislation.gov.uk/uksi/2019/1043/regulation/1/1), [37](https://www.legislation.gov.uk/uksi/2019/1043/regulation/37)
[^key-9e24f8af50209b0af1b4ff26a0525e0e]: [Sch. 19 para. 279](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/279) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9ea61d1ece95e50cb79bdb1b64be7a03]: S. 17 cross-heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 21](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/21) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-9ef9aecb69c6cba490e1936f1f0fb107]: Words in s. 157(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 64(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/64/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-9f5c56edc1342d98195ad1b32fab06cb]: [Sch. 19 para. 8](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/8) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9f5da3b688523031c188cc42ef688048]: Words in s. 73(3)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 40(3)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/40/3/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-9f924437bee18db808d47091eedf71e4]: [Sch. 19 para. 213](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/213) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9f9a51d31ece70359c752169867ad4ff]: Words in Sch. 3 para. 20(1)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(19)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/19) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-9fd4ec495d0150d2a876611d7d18844f]: [Sch. 19 para. 85](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/85) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a00ae0d976446db156c56d104bf8a46d]: [Sch. 19 para. 221](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/221) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a0127af1ada079caf6957dccac2808db]: S. 3(10A) inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 4(5)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/4/5) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-a0b98661e146b804075a34298587c3ff]: [Sch. 19 para. 174](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/174) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a108ccc8090ee178d30cecfaf943e5e8]: [Sch. 19 para. 20](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/20) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a1145e70e881abbcff0d5dc04ab6272b]: Sch. 20 para. 56 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a1273524e053f511fd09ea5026a748c7]: Words in Sch. 3 para. 2(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(5)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/5) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-a1c35c4d9fb9c6b8432b9c99b83faa06]: S. 104 in force at 16.9.2019 by [S.I. 2019/1188](https://www.legislation.gov.uk/uksi/2019/1188), [reg. 2(d)](https://www.legislation.gov.uk/uksi/2019/1188/regulation/2/d)
[^key-a2536056f71e77d12ec0552af9cdb0ae]: [Sch. 19 para. 14](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/14) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a2c39c1b8f50d64d3eab992537ab337c]: Words in s. 5(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 6(4)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/6/4) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-a2dc7867f7754a11a35a6a348b1c9035]: [Sch. 7 para. 56](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/56) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-a3c0ce05bf3da8355e376954eddca53f]: [Sch. 7 para. 52](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/52) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-a3ce48c816fb2bf06559889b7357e5f6]: [Sch. 19 para. 330](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/330) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a3e5aec1f29a24d1eaf3ac27bcb0f574]: Sch. 3 para. 13 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-a3e5b77cf0824d21fde09cd713fdccb5]: [Sch. 19 para. 190](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/190) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a44536bac9a597320eab0a82eead9a1b]: Sch. 2 para. 9 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-a4aa35db6bea2e2d38df00cf0ecfb4af]: [Sch. 19 para. 282](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/282) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a4b40f818ce15c1720d09e302bf3f262]: [Sch. 19 para. 263](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/263) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a59f8dde3068bf877b888306045bdfab]: [Sch. 19 para. 424](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/424) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a5d5816e42d277460429b755f59aaec5]: Sch. 20 para. 16 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a5d6a3cabaabe61fe8191d35a6959006]: Words in Sch. 2 para. 25(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(19)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/19/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-a5eeff55dde4d6b88a20de1eb7c39000]: [Sch. 19 para. 378](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/378) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a5f269dcf2171429f01e39e0cc667528]: Sch. 1 para. 28 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-a5f32b7275324384f0c6356c55a7855c]: S. 157(7) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 64(6)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/64/6) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-a623e2942e804444c750d65ec618366c]: [Sch. 19 para. 402](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/402) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a625401585854a4edacab4ebf6ddb133]: [Sch. 19 para. 156](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/156) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a6329d63514954d20f2d428cfd3f35ec]: Words in s. 187(1)(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 81(4)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/81/4/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-a63390fc5b556409349772fb7f0ec1d4]: [Sch. 19 para. 145](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/145) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a6604195d497ecc3ddea17c2bd854a34]: [Sch. 11 para. 5](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/5) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-a685afd8e1ad0bb3dd291dc18372de28]: [Sch. 19 para. 400](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/400) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a68e38da2bdfa2ea3680d54d36ce44b5]: [Sch. 19 para. 419](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/419) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a6b836bb2eded84554fa5fd897590987]: Words in Sch. 2 para. 3(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(7)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/7/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-a6ea8b0e80d6677a025f42dbe552b801]: [Sch. 19 para. 171](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/171) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a6f29ae743c02d47e566e471ff2e85c0]: Sch. 1 para. 12 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-a72770f7a6d3448edd24f63cabe6dfa5]: Words in Sch. 3 para. 6 cross-heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(8)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/8) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-a8f58512cb57f396c3a6b2d0a2120804]: [Sch. 19 para. 179](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/179) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a92af31a14937e990ce7e02e2e9d9f29]: Words in s. 10(5) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 13(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/13/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-a931c9ae51bd816f5bd69abcac767b27]: [S. 160](https://www.legislation.gov.uk/ukpga/2018/12/section/160) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-a94119cccf820588c348cc565b00173b]: [Sch. 19 para. 47](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/47) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-aa6af2689d3c8dbcfd3393c5949edec1]: [Sch. 19 para. 410](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/410) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-aa86426e70dd097305ad06632c463ad0]: Words in [s. 116(2)](https://www.legislation.gov.uk/ukpga/2018/12/section/116/2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 48(4)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/48/4) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-ab17241dc6150ceb8d51a34398cf5b43]: [S. 164](https://www.legislation.gov.uk/ukpga/2018/12/section/164) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-ab3ee4f089fcbc7d49b46a2bbd552991]: Words in s. 180(2)(e) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 75](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/75) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-ab59fd7803f594dabdae198bc7ee59b2]: S. 189 in force at 23.7.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 3(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/3/f)
[^key-ab5b474d3b7afb2f028fbe0f93ce632c]: Words in s. 15(2)(c) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 19(5)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/19/5/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-ab92c540c3a132992c2519ccffece33d]: [Sch. 19 para. 216](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/216) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-abec216a11c53d30529d354f6e83a50f]: [Sch. 15 para. 18](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/18) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-ac0d3ccf4233244b994c97cd184120b6]: [Sch. 7 para. 43](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/43) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-acb0285e2b1938c540581efba74d8844]: [Sch. 19 para. 367](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/367) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-acd9c1db11c3f2dc87e850a09432977c]: [Sch. 19 para. 390](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/390) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ad561b17280fb2bb04693918a0e33719]: [Sch. 19 para. 194](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/194) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ad7fdedeb20c593a8a57d11ce1f3e37e]: [Sch. 11 para. 13](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/13) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-ae62c8e2190203abcf6e1d2577cb264d]: [Sch. 19 para. 37](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/37) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ae7474f0c3ecc17e0da102de1e22069d]: [Sch. 19 para. 337](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/337) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-af00bc19e71787fbc67e62544709eb1b]: [Sch. 12 para. 9](https://www.legislation.gov.uk/ukpga/2018/12/schedule/12/paragraph/9) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-af0b63f67e273e6e110ffcb6b31502f4]: [Sch. 19 para. 148](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/148) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-af704cdbd7c856f0edbefe85c657cb92]: [Sch. 19 para. 24](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/24) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b00c0f26a2d6a3755a47ccea8a91b596]: [Sch. 19 para. 339](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/339) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b01ad887f3d56c8021072a3f068fbcb6]: Sch. 1 para. 11 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-b067cdd42587d1724117cfb8de72ee09]: [Sch. 19 para. 350](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/350) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b0997f585eed7e7038937ae450f7de4f]: [Sch. 19 para. 199](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/199) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b0b94538e5b0cafb0b20aa069c61482f]: Words in Sch. 1 para. 1(3) substituted (31.12.2020) by [The UK Statistics (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/489)](https://www.legislation.gov.uk/uksi/2019/489), [regs. 1](https://www.legislation.gov.uk/uksi/2019/489/regulation/1), [3](https://www.legislation.gov.uk/uksi/2019/489/regulation/3); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-b0db01543b0050f576c5393cc63112bd]: [Sch. 16 para. 2](https://www.legislation.gov.uk/ukpga/2018/12/schedule/16/paragraph/2) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-b14dd74941113a22c1d268f51eb9660d]: Sch. 20 para. 39 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b19644c907c1538c9f4a2b6db6529dea]: [Sch. 19 para. 274](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/274) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b1be5893ae060407bd875c20d32c3938]: [Sch. 19 para. 30](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/30) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b1fceaf86c42fac53cc007de0358f87e]: [Sch. 19 para. 251](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/251) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b22b598c83a6dff2777903b9fdfdef65]: [S. 213(4)](https://www.legislation.gov.uk/ukpga/2018/12/section/213/4) inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 90(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/90/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-b2c1ac345b2156d511d9a5e0cc32de4b]: Sch. 20 para. 19 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b2d226d0cfe537af92b05e90e77440e1]: Words in Sch. 2 para. 28(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(24)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/24/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-b2e90f163831a820a96c66b0fee0479c]: Words in s. 17(8) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 22(6)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/22/6/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-b340272b6edde8560df08ced34064a27]: S. 118(1)-(4) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 50(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/50/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-b3795eef097c1a571dd91a5a58fbb545]: [Sch. 19 para. 397](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/397) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b38545fc0af14c07ceef9e17b64ca5eb]: [Sch. 19 para. 336](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/336) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b3fcc9c6b47a21df6520e7240c7ff7bf]: Words in [Sch. 2 para. 18 cross-heading](https://www.legislation.gov.uk/ukpga/2018/12/schedule/2/part/4/crossheading/gdpr-provisions-to-be-restricted-the-listed-gdpr-provisions) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(16)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/16) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-b43bb1f6638b5994d92beeecf2ab27a2]: S. 207 modified (30.9.2020) by [The Channel Tunnel (Arrangements with the Kingdom of the Netherlands) Order 2020 (S.I. 2020/916)](https://www.legislation.gov.uk/uksi/2020/916), [arts. 1(2)(b)](https://www.legislation.gov.uk/uksi/2020/916/article/1/2/b), [4(3)](https://www.legislation.gov.uk/uksi/2020/916/article/4/3)[(4)](https://www.legislation.gov.uk/uksi/2020/916/article/4/4)
[^key-b448f0542b76286bd7b6f08b1eba41a2]: [Sch. 19 para. 332](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/332) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b452ea5807870d8b5ed178682e71a1c9]: Sch. 3 para. 9 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-b465e86c8c1c06e714d3d2827dbebf59]: Sch. 3 para. 14 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-b46d629f05ec35dd3166d376f05d7e6a]: Words in Sch. 13 para. 3 omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 97(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/97/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-b477b7ab6ad0e09aca8432fb6d5825ec]: [Sch. 19 para. 181](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/181) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b47928de3ad984bd7b4dd3f71d788598]: Sch. 3 para. 8(1)(o) modified by S.I. 1999/677, art. 7(1)(2) (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 237](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/237) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g))
[^key-b499f11052d143d8bd9082382676ba08]: Words in Sch. 2 para. 26(9)(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(21)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/21/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-b4a7bbe1aa38cf9a236d3e2b976a4b43]: Sch. 20 para. 26 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b4c0aed7d7060e936e448ad89b19a7f3]: Words in s. 142(9) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 59(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/59/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-b4ee8b33cc28be5d64d57676972fe9cb]: Words in s. 186(2)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 80(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/80/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-b50cc128cf93e81329e8f692740f94b8]: Sch. 1 para. 36 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-b54c57bf05b376d8d1296b1b3073711a]: [Sch. 19 para. 9](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/9) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b590a9087442280960754e373c622ce8]: [Sch. 19 para. 373](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/373) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b62d921feb3097216f65a44384e7c28a]: Sch. 2 para. 7 modified by S.I. 1999/677, art. 7(1)(2) (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 237](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/237) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g))
[^key-b66bfe28770e7c763a748c72fa460f03]: [Sch. 19 para. 318](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/318) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b67a57ad7f0934155bdc77e2a131f1fa]: Sch. 2 para. 7 modified by S.I. 1999/3145, art. 9(1)(2) (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 238](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/238) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g))
[^key-b69d717e1e9c428be52a8405917b6a47]: [Sch. 11 para. 14](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/14) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-b6ee800cbbca868e5b81fc389982dfb8]: [Sch. 19 para. 225](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/225) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b6fec47aa194969dfe8a3a6fea4187d8]: [Sch. 19 para. 64](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/64) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b7ec9fe5f8e02209dbf599741d3c734a]: Words in s. 187(1)(a) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 81(3)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/81/3/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-b809b11818db07b6251c81d14a36f7e5]: Sch. 1 para. 31 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-b85964a87061e13a255bedfd6fa9b9c3]: [Sch. 19 para. 278](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/278) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b8ac6fb172d66af4a5e7441a6e2e92e5]: Words in s. 204(1)(g) omitted (2.12.2019 at 00:01) by virtue of [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 227(2)(a)](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/227/2/a) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2019/1434](https://www.legislation.gov.uk/uksi/2019/1434), [reg. 2(b)](https://www.legislation.gov.uk/uksi/2019/1434/regulation/2/b)
[^key-b8acde08ea2a80a6fcb78d2122163702]: Words in Sch. 3 para. 11 cross-heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(11)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/11) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-b8b61b3422cb1c2f989b7859d8fe3c85]: Words in s. 25(2)(b) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 33(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/33/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-b8bb776d4ce7a80859a0cd4e072721de]: [Sch. 19 para. 72](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/72) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b8ecea97a092c0a76388cfeca5963182]: Words in s. 206 Table inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 86(6)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/86/6) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-b93822e6be019e9b1da50e3d149d0512]: [Sch. 19 para. 314](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/314) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b94b200a4666765f964f6b64e6e3d0b1]: Sch. 1 para. 13 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-b9933b917dda2c289091db4c60012665]: Words in s. 189(4)(d) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 83(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/83/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-b9fb3ca41d32a811b10aaa5281713ab0]: [Sch. 16 para. 7](https://www.legislation.gov.uk/ukpga/2018/12/schedule/16/paragraph/7) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-ba50110eb56a510d248a092ced92efea]: Sch. 20 para. 10 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-bbc49c524804fb2ab905465728240522]: Words in s. 170(7) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 71](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/71) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-bc71876f7b085a331fb2523e66d417c1]: S. 188 in force at 23.7.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 3(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/3/e)
[^key-bd4de8f85f3e7210b241c119815eb03b]: [Sch. 19 para. 125](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/125) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-bd7353c4ff1428096418d9207dd0851a]: [Sch. 19 para. 75](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/75) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-bda1051a1d1b0d9d9e9c369c328cf110]: S. 93 in force at 16.9.2019 by [S.I. 2019/1188](https://www.legislation.gov.uk/uksi/2019/1188), [reg. 2(a)](https://www.legislation.gov.uk/uksi/2019/1188/regulation/2/a)
[^key-bdb76943ea02d98f95919369d09bb043]: Sch. 1 para. 6 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-bdbe08dca4db3985f45c3f7d98c4371f]: Words in [Sch. 3](https://www.legislation.gov.uk/ukpga/2018/12/schedule/3) heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-bdca30164de5570a8928702ed862e347]: [Sch. 19 para. 256](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/256) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-be0e43ced31d335546a8059944d317db]: [Sch. 19 para. 50](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/50) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-be1bf0983596986c0b786e77ad4ce52e]: [Sch. 19 para. 275](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/275) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-be21e957c0ac10ddafc37dd24c11484d]: [Sch. 19 para. 105](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/105) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-be312be66278b219bf36807ebc298dca]: S. 21(1)-(4) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 29(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/29/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-bef50065785b938e25237c6aa68a6597]: [Sch. 19 para. 285](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/285) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-bf1901e085f9376f525dcebcaece26ab]: [Sch. 12 para. 6](https://www.legislation.gov.uk/ukpga/2018/12/schedule/12/paragraph/6) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-bf2d61f28feb2f6a4a05e3ea8b3954db]: Sch. 2 para. 28 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-bf35de83a0f437b87a9cef54c610a040]: [Sch. 19 para. 172](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/172) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-bf6f2f5cefba8471451edb23ada87197]: Sch. 20 para. 42 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-bf995fccad30924b62ebc61e36091eea]: [Sch. 19 para. 52](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/52) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-bfa38f6ea2f2d1ae4ff2e67570068933]: [Sch. 7 para. 54](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/54) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-bfe88656543ff8d5238b037df8a8af1b]: [Sch. 19 para. 433](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/433) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-bfe8ef2d0b7e57490a5fd744b237a5af]: S. 21 heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 29(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/29/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-c0286c159abd916463bf0ef6a009374d]: [Sch. 1 para. 19](https://www.legislation.gov.uk/ukpga/2018/12/schedule/1/paragraph/19) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-c03eb89cbce80a935ecb6347de5c299b]: Words in Sch. 2 para. 26(9)(d) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(21)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/21/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-c08398fac9ea431bbf20d8d55cdcc986]: [Sch. 15 para. 13](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/13) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-c088d98cf8145c1a34b102fd333f5481]: [Sch. 19 para. 113](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/113) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c1385fd85cc9aa1ac18e428d1255229e]: [Sch. 19 para. 208](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/208) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c16f610c170d5b1d37b2f712191af2cc]: [Sch. 11 para. 12](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/12) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-c1d3f43f097f9a6407e04871a09dba04]: [Sch. 19 para. 335](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/335) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c200f0f3b78d0996b7d83fdabfb5e5be]: Ss. 17A-17C inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 23](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/23) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-c2993c748626851ac752a159c968c2f3]: [Sch. 19 para. 68](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/68) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c2ac2fbd7eae86c3237b0fea08970942]: [Sch. 19 para. 147](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/147) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c2ef1f00c16c6ae79e671982664ebcb6]: Sch. 1 para. 7 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-c356bafc244fdc4ace9be54cbc58a2b8]: [Sch. 19 para. 220](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/220) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c36bb938b5c589478fc26017aba6c037]: [Sch. 7 para. 1](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/1) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-c3878a9352147db7dfa9f90c863bf7d5]: [Sch. 19 para. 79](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/79) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c3db4b87743d73511206b4ae86bb0bbf]: [Sch. 11 para. 2](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/2) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-c444d824a5b6f20e42cd95b28ec028cb]: [Sch. 19 para. 13](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/13) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c4616ae590a3753a8f2fa526f5ab1598]: [Sch. 19 para. 412](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/412) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c47d8b667ae682e06b898703297fc17f]: Sch. 20 para. 34 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c4aa80bf6800be1023988219c3bbbb5b]: [Sch. 19 para. 248](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/248) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c51320ded27a1bd50bf68bdae0baf46b]: Words in [s. 27(5)](https://www.legislation.gov.uk/ukpga/2018/12/section/27/5) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 35](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/35) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-c51b193aa656263473481500b9b47e2b]: [Sch. 7 para. 24](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/24) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-c546bf86c8f31d0e9c29c51ed58b7835]: [Sch. 15 para. 19](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/19) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-c55ae1876443a0b2fefba9ec810b9025]: [Sch. 19 para. 109](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/109) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c56e46dc215f18e71b09f349196ffd4c]: [Sch. 19 para. 31](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/31) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c5ee47c63d27ac9ec02a5ee22620d081]: [Sch. 19 para. 170](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/170) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c68c32f2f423229e644dabde516e73e8]: [Sch. 19 para. 92](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/92) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c6d237308dfd9e4ace550674cf51eb1c]: S. 24(2)(ca)(cb) inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 32(3)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/32/3/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-c6de1710ac870a50c6fae7c72c3e704e]: Sch. 1 para. 26 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-c6eabe9620a932c80ccb60c149f39305]: Sch. 20 para. 57 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c6ff067d2b1a1e1fd14fed19077a1e27]: Words in s. 173(2)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 73](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/73) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-c77367f91e1d7c046076b6ba11f17199]: Sch. 1 para. 22 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-c7ea9a9c87ca4e89d73dbd273cfa8393]: Words in s. 4(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 5(2)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/5/2/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-c7f86e0fd7e97d7dc7de053dc830c822]: Words in s. 17(6) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 22(4)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/22/4/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-c8842a494d6ce371ae2b0bfd423daf8a]: [Sch. 19 para. 244](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/244) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c8b210ff5beb76a0a92b2c6d4bd6e5eb]: Words in Sch. 3 para. 5 cross-heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(6)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/6) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-c8e2994c25fb458736a5c26eaf716e23]: S. 162 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-c914990c72253d6c460805018090a05a]: [Sch. 7 para. 53](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/53) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-c928d8c9711cfedfaf94e5e46642337c]: [Sch. 19 para. 292](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/292) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c950a89def036cb9e2d4a761b45c11a0]: Sch. 20 para. 61 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c95234e363a715e0b865be6ac18a3963]: [Sch. 15 para. 8](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/8) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-c989dc3d9a5b51c09bf8b938e230f75b]: Words in s. 209(4) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 88](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/88) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-c99271dec5b91e51a9f814f1c8a4b5c2]: Words in Sch. 20 para. 18(2)(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 101(4)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/101/4/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-c9dd5c6539aaab7b9c7d8c2530ffbb16]: [Sch. 19 para. 187](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/187) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ca55331b740b2f84383f97045a5d7b5c]: Sch. 20 para. 25 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ca96e304fa8efb2d21e87e6971b2da03]: [Sch. 19 para. 428](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/428) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-cb2511796c16bd899c755ab035c92cf8]: Act applied (31.12.2020) by Regulation (EU) No. 625/2017, Art. 143 (as substituted by [The Official Controls (Animals, Feed and Food, Plant Health etc.) (Amendment) (EU Exit) Regulations 2020 (S.I. 2020/1481)](https://www.legislation.gov.uk/uksi/2020/1481), [regs. 1](https://www.legislation.gov.uk/uksi/2020/1481/regulation/1), [27(3)](https://www.legislation.gov.uk/uksi/2020/1481/regulation/27/3) (with [reg. 46](https://www.legislation.gov.uk/uksi/2020/1481/regulation/46)))
[^key-cb3108a589d4abf7f4623f8e5fbdc4b6]: [Sch. 19 para. 185](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/185) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-cb40895550fff4b1df945a592f3d2928]: S. 26(2)(g)(iv) inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 34(3)(e)(ii)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/34/3/e/ii) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-cb488232f6394d8ef31bca7d0e16a533]: Sch. 3 para. 4 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-cb60abcf455a1fb39b192e2fb65b8e33]: Sch. 20 para. 21 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-cb9887b74f9ddbd87db8262dc983986d]: [Sch. 19 para. 89](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/89) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-cba88e2b39b826968769027cc29370be]: Words in [s. 135(4)](https://www.legislation.gov.uk/ukpga/2018/12/section/135/4) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 56](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/56) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-cc268dff7489493500857e0da3d30cf8]: [Sch. 19 para. 281](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/281) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-cc7111f2b8b984b394cb92bb7c3a96cd]: [Sch. 19 para. 58](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/58) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-cc8fef6eab17a4ac6bac35664627a6a3]: Words in s. 28(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 36(3)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/36/3/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-ccac30bcd9ef201935aa8d55dd2c7179]: [Sch. 19 para. 4](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/4) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ccb74de70cc7a0e82e0af0edf88a190e]: [Sch. 7 para. 8](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/8) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-ccd32dfe47587c5622c9eb7238443189]: [Sch. 19 para. 273](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/273) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-cd0fcadfa37c156db132b641258a55e0]: Sch. 1 para. 35 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-cdd8c10a5150531bb30b7690485fc5fc]: Pt. 2 Ch. 3 applied (31.12.2020) by Regulation (EU) No. 625/2017, Art. 143 (as substituted by [The Official Controls (Animals, Feed and Food, Plant Health etc.) (Amendment) (EU Exit) Regulations 2020 (S.I. 2020/1481)](https://www.legislation.gov.uk/uksi/2020/1481), [regs. 1](https://www.legislation.gov.uk/uksi/2020/1481/regulation/1), [27(3)](https://www.legislation.gov.uk/uksi/2020/1481/regulation/27/3) (with [reg. 46](https://www.legislation.gov.uk/uksi/2020/1481/regulation/46)))
[^key-cdf6ef8adaf644a19027e1ed1cdb2254]: [Sch. 19 para. 355](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/355) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ce61eaf66563099c85e4f387c32e5c33]: Act applied (30.9.2020) by [The Channel Tunnel (Arrangements with the Kingdom of the Netherlands) Order 2020 (S.I. 2020/916)](https://www.legislation.gov.uk/uksi/2020/916), [arts. 1(2)(b)](https://www.legislation.gov.uk/uksi/2020/916/article/1/2/b), [4(3)](https://www.legislation.gov.uk/uksi/2020/916/article/4/3)
[^key-ce6b81a167b4265731f5b10cf3fa3b85]: Sch. 2 para. 27(4) inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(23)(d)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/23/d) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-ce78857695492590423f593605c8ec36]: [Sch. 7 para. 32](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/32) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-ce8f58e41e39345fa68025d5f759b383]: [Sch. 7 para. 20](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/20) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-cf185b11f6eb430ea7b837e8c88bd7b6]: Words in s. 80(4) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 46(4)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/46/4) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-cf7b12fa6e29df3664f564217fb41aec]: [Sch. 19 para. 320](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/320) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-cfa904e383c8454f90dcaaceeb630997]: [Sch. 19 para. 54](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/54) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-cfd00f9390a56e61349aa5a1f9a1ffa9]: [Sch. 19 para. 240](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/240) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-cfd37790b8a4ffc332af6e54afe597a3]: Words in s. 187(1) substituted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 81(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/81/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-d00de55d7e460f218dbfdfc1cc28e86a]: [Sch. 19 para. 84](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/84) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-d035aebb324ef6e0087dfa27a2360edd]: [Sch. 19 para. 394](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/394) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-d0dceb44e3808f208cbe89f1254ea198]: Sch. 3 para. 8(1)(o) modified by S.I. 2007/1118, art. 5(1)(2) (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 324](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/324) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g))
[^key-d0f66d6d5861f68ffafba417b3b6cd8d]: [Sch. 19 para. 233](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/233) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-d0fd51828a41aca7cb26f8a6708a3c8b]: Words in [s. 115(6)](https://www.legislation.gov.uk/ukpga/2018/12/section/115/6) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 47(7)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/47/7) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-d114d373a470ef9c52798d2916ae07af]: Words in Sch. 2 para. 1 cross-heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(4)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/4) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-d142e8d668e46fcefe4fda5df5ec3327]: Sch. 3 para. 3 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-d16c7a54102fa53493454b8eb8c8f1f3]: S. 23 omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 31](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/31) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-d171d83535850d556ca50d4c0a9131d1]: Words in [Sch. 19 para. 432(5)(a)](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/432/5/a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 100(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/100/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-d1c4a5b8f04832edf2cb03e6ea265e7c]: Sch. 1 para. 17 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-d215058b7b57e3a9731a7ad5e4301724]: Words in s. 11(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 14](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/14) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-d21cee9d28e7ef117ac498fbed58738e]: [Sch. 14 para. 10](https://www.legislation.gov.uk/ukpga/2018/12/schedule/14/paragraph/10) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-d246561fbd24e4e3fc88730fdaad884d]: [Sch. 7 para. 51](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/51) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-d28d939c5b88e9d83db1ae875c3e2f99]: [Sch. 19 para. 35](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/35) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-d2992e1a702c7fd6a6c636a5bb840e57]: Sch. 3 para. 10 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-d2ab903fec483b11ddcbb071e3ef3ab0]: Sch. 5 para. 2 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-d2b3c86cc8ebfa8022b13d7f3cb9ebdf]: S. 74 omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 41](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/41) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-d2b9ba5521020831be5beef0f2b1990f]: Words in s. 173(2)(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 73](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/73) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-d2fd9c6100b620310997d76d277b9f80]: [Sch. 19 para. 99](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/99) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-d30e265bd0e7290a2fd7d7064c8670b8]: [Sch. 19 para. 262](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/262) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-d389ab58efdc2e62d3686cf163bc479c]: [Sch. 19 para. 296](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/296) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-d3c84fd6416aecc51ba5440265479cbe]: [Sch. 19 para. 365](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/365) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-d3e1d574f1063ebf020fe69e09894006]: Words in s. 15(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 19(9)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/19/9/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-d3e6a542361c641611591efb60fe9e38]: [Sch. 19 para. 137](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/137) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-d41dc001718a68d14976eac66448eb8a]: Words in Sch. 1 para. 4(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 91(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/91/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-d49a6d2b560c968a1b1a08e01ce6a029]: S. 3(14)(b) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 4(7)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/4/7/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-d4f3fe3c5fbdf78dd7e443f27080c092]: [Sch. 7 para. 44](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/44) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-d50b2691f5d850d9368511bef6e62dee]: [Sch. 19 para. 321](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/321) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-d534be7b3720f9991fab190ffff1752e]: Words in s. 174(2)(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 74](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/74) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-d5814a5c9f9acb766d2ce56a6703bb8e]: [Sch. 11 para. 8](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/8) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-d584974284089f57966a7096404fc460]: Words in s. 73(5)(a) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 40(4)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/40/4) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-d7d2530b8c04272f421e5f13fc49a57f]: [Sch. 15 para. 15](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/15) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-d7f2eb02ca7f034aafd56f74b579aba9]: [Sch. 19 para. 161](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/161) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-d7f3b3ea581183119f32ef174c1446a7]: [Sch. 19 para. 396](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/396) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-d82894d6535af83d3105500941158fc7]: Word in s. 186(3)(b) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 80(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/80/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-d8543783ecce9fc324879502be7a7702]: [Sch. 19 para. 398](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/398) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-d89a6ff40d1b9a78fe4c101979ac8c96]: Sch. 20 para. 7 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-d8d73be9be172f479c33caf3c2fc1670]: Words in s. 210(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 89](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/89) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-d8e364c911e63ea578fc0534de164ddf]: Words in [s. 136(1)(b)](https://www.legislation.gov.uk/ukpga/2018/12/section/136/1/b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 57](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/57) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-d905a49f85abea49a90d25e4d78b00cb]: Words in s. 174(2)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 74](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/74) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-d90ea73c93bcf268873fb7da4680904a]: [Sch. 19 para. 165](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/165) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-d926ea66208808cf0ac6cd8080a79d94]: Sch. 1 para. 16 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-d975bf9312ec73c1e21013621d4551b6]: Sch. 2 para. 14 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-d9d4a5328d371f45edc310525d5e56ca]: S. 195 in force at 23.7.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 3(l)](https://www.legislation.gov.uk/uksi/2018/625/regulation/3/l)
[^key-d9e75b820dadd4eac2b1032ec6c6a4da]: [Sch. 19 para. 258](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/258) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-d9ef046124282afd82fbdc97d2c50598]: [Sch. 7 para. 38](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/38) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-da4d8d7b0fe43481acfe3f79e34c5771]: [Sch. 19 para. 188](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/188) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-da5474989e672f513cfd5369bd8c73d9]: [Sch. 19 para. 41](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/41) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-da640f7e42c73ddf470ab5d98d90bf50]: Sch. 2 para. 7 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-dab6528400a65dd48f125dfd149128c0]: Words in [Sch. 3 Pt. 1](https://www.legislation.gov.uk/ukpga/2018/12/schedule/3/part/1) heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-dab72f344c2223ac494a5ec5e4725a5a]: [Sch. 19 para. 153](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/153) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-daf9e0252da094394cda1b40a87dfe22]: [Sch. 7 para. 49](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/49) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-dbdad71b9ade64a8f7fdfc45c071f848]: Words in Sch. 3 para. 17(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(15)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/15) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-dc321b64fd0fcd1ec60ef61441b8fafc]: [Sch. 8 para. 6](https://www.legislation.gov.uk/ukpga/2018/12/schedule/8/paragraph/6) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-dc40b789ba49496fa957bb0b48f33a2b]: [Sch. 19 para. 77](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/77) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-dc44819fb13fa8e6ea18a61ad3fab776]: [Sch. 19 para. 276](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/276) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-dce28071963c6ace834d117354904185]: [Sch. 7 para. 14](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/14) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-dd0f181b5dd17d7042dc7e38ce07044c]: S. 111 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-dd19920218f3766a11863bfd8609d509]: Words in s. 207(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 87(4)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/87/4) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-dd2b3c609b732e6c74f06eac3ec5403a]: [Sch. 19 para. 387](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/387) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-dd757ab40e97ddf846173abfa98de010]: [Sch. 19 para. 70](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/70) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-dd8583cf6b3633e3cd4398106baef5a8]: [Sch. 19 para. 249](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/249) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ddb24038c52777eed313664ed44d18e8]: [Sch. 19 para. 212](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/212) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ddb56eb702b1a635c52b24c4ba095ef3]: Words in s. 25(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 33(2)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/33/2/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-de215a81f0a30f77df6c9d7b3aa62a84]: Sch. 20 para. 55 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-de38b60ee34fb320e926b3a6a4bfa2b2]: [Sch. 19 para. 183](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/183) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-de7ac3b59d15240bff2525e5f4ee0096]: [Sch. 19 para. 218](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/218) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-deba1ccec93c5dcf33f3a26797f2173c]: S. 109 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-deebf9ef3b2556d2b0b7321f2152e6b2]: [Sch. 19 para. 315](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/315) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-df310fa6ee2a3dff0c63be234a5da9cb]: [Sch. 19 para. 383](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/383) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-df4d3f41a1a238306f55678d6a3b9c30]: Sch. 20 para. 32 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-df726e993c279c8b9f39a174ac48a970]: [Sch. 19 para. 56](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/56) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-df76da218b4fc287b7df92688b5b906a]: [Sch. 19 para. 115](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/115) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-dfd4e8a4ee7d2bdd2b63992d585ea975]: [Sch. 19 para. 234](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/234) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-dffa9388dd0ef050a0bc9980aa1f03ca]: Sch. 1 para. 3 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-e0073adcf48ad8394f78eb971946c0b3]: Words in s. 12(1)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 15](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/15) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-e03184e6a602e0673050d81097dcd560]: Words in Sch. 2 para. 4(4) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(8)(c)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/8/c) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-e0842c692626b5e774c6753f0719945c]: Words in Sch. 2 para. 16(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(14)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/14) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-e0d2f2b8d26ec60067558dd0962095b3]: Words in s. 187(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 81(5)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/81/5/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-e19adfb1f3c5862f38fc50a0d9f8f97e]: [Sch. 19 para. 160](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/160) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e19cbfe5436f8c558c28e7bfce051537]: Words in s. 15(2)(d) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 19(6)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/19/6/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-e1a399ea8db8f0e966700b51a7708047]: [Sch. 19 para. 265](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/265) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e1adfd83503e23bb12c37b264f983157]: [Sch. 19 para. 430](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/430) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e22a317e4dc955876132ce146811edf9]: [Sch. 19 para. 340](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/340) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e2376d4e7ebdd9a757cdbb27840c896f]: Act modified (14.2.2020) by [The Northamptonshire (Structural Changes) Order 2020 (S.I. 2020/156)](https://www.legislation.gov.uk/uksi/2020/156), [arts. 1](https://www.legislation.gov.uk/uksi/2020/156/article/1), [17(2)(e)](https://www.legislation.gov.uk/uksi/2020/156/article/17/2/e)
[^key-e25930aa3cf639fbe9dcbc865cf147f2]: S. 113 in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-e25dd9b1b973623ef52f15cab26e68cb]: [Sch. 8 para. 8](https://www.legislation.gov.uk/ukpga/2018/12/schedule/8/paragraph/8) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-e277a02441fd6aacb99d8f3da6909db8]: [Sch. 8 para. 4](https://www.legislation.gov.uk/ukpga/2018/12/schedule/8/paragraph/4) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-e27e0059768399e01f9b0f986d2a5687]: Words in s. 180(2)(d) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 75](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/75) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-e292a19194c3f4fab612e8e3dcf45f87]: Words in s. 15(2)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 19(3)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/19/3/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-e2b0ddf8b668d190eb64e7e6247065b4]: [S. 132(2)(d)](https://www.legislation.gov.uk/ukpga/2018/12/section/132/2/d) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 55](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/55) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-e2cbe8e7c3f7b29a3482667eec7169ce]: [Sch. 19 para. 3](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/3) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e2d548a4783586924138a4f64263651f]: Words in s. 26(2)(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 34(3)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/34/3/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-e2dd47d0a543b3e922e9c971f2a8baa4]: Words in s. 24(5) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 32(5)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/32/5/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-e36726ddad796892b59de71bc71fac9c]: [Sch. 11 para. 4](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/4) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-e36f3d79dc2160326592a45b956bcee2]: Words in s. 80(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 46(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/46/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-e3bc569ce77a381912f7e45dd5b607a7]: Words in Sch. 3 para. 5(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(7)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/7) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-e3c229800630400cd31ee2e7333a1763]: Words in [s. 120(2)](https://www.legislation.gov.uk/ukpga/2018/12/section/120/2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 52(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/52/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-e3d81e9f8b5c66334909f95bff82cae4]: S. 105 in force at 16.9.2019 by [S.I. 2019/1188](https://www.legislation.gov.uk/uksi/2019/1188), [reg. 2(e)](https://www.legislation.gov.uk/uksi/2019/1188/regulation/2/e)
[^key-e470ab8179af8528ddd36f612bb0f69d]: Words in s. 28(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 36(4)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/36/4) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-e4afbc3f11ae48f0f055c87060290428]: [Sch. 19 para. 385](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/385) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e4d19bddc6c0328454f09fd547393db8]: [Sch. 19 para. 268](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/268) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e51209f96eafbb1ab258e63be1650a81]: [Sch. 19 para. 136](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/136) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e61c7bcd6ea2ed4e56a76b4a860e3400]: S. 147 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-e62033720942b217198c1dfe98c8e731]: [Sch. 19 para. 347](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/347) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e65c667068c961c23636d717a9fe31b9]: [Sch. 19 para. 168](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/168) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e68518991b24f426c7502b2a7e8ed531]: [Sch. 19 para. 201](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/201) omitted (29.3.2019) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(3)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/3), [Sch. 4 para. 3](https://www.legislation.gov.uk/uksi/2019/419/schedule/4/paragraph/3)
[^key-e6d674ace935bcf1083b558a35b32428]: Words in s. 15(2)(c) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 19(5)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/19/5/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-e72064e13dd75d5efe7864fb56a44ab9]: [Sch. 19 para. 298](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/298) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e75907eba429315009a11c3d22ff06fd]: [Sch. 19 para. 202](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/202) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e7856245e743d7a5de4a1d03a5a413ed]: Words in s. 2(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 3](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-e792a8125d606098513f47d2e25be7fe]: Words in [s. 115(7)](https://www.legislation.gov.uk/ukpga/2018/12/section/115/7) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 47(8)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/47/8) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-e7ffa3e81bd3a810e9d34eb945cfc66c]: [Sch. 19 para. 163](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/163) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e814ef10951e6e4e2aa0170b5a7394df]: S. 18(2)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 24(4)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/24/4) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-e81956df0d06f6110c0b4ac40cb98a27]: [Sch. 19 para. 269](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/269) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e8392aedf57540894d7ffc3e0da6093d]: Words in Sch. 2 para. 27(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(23)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/23/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-e848a3d8004e9d924b205afb95f2dc17]: Ss. 74A, 74B inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 42](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/42) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-e858284550ffd5cdcd05135f1ac6dbd0]: Words in [s. 123(7)](https://www.legislation.gov.uk/ukpga/2018/12/section/123/7) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 53](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/53) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-e89782710f07812828650321cc604aa4]: [Sch. 19 para. 358](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/358) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e94472e4cd77ee51f88b9af2fd0297a6]: [Sch. 14 Pt. 1](https://www.legislation.gov.uk/ukpga/2018/12/schedule/14/part/1) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 98](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/98) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-e966768c7106fe0dc55d7c693755813e]: Sch. 20 para. 4 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e99403db3867a4daaebe4da8128b05b5]: [Sch. 19 para. 369](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/369) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e9b848f9dfd63036d3e70f0dd8886750]: [Sch. 7 para. 34](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/34) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-e9fc6a460347285c3702107aaf014e3e]: Words in s. 24(2)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 32(3)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/32/3/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-ea395bf42beb4786205aad06d93444ef]: [Sch. 19 para. 130](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/130) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ea6a6151c0cf3932c26f8be96e70d145]: Words in Sch. 2 para. 4(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(8)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/8/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-ea6f11d03e5cf9bb39766c30d73c6169]: [Sch. 19 para. 23](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/23) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ea72ba67e1f77d2bc922e8cd029f82de]: Sch. 20 para. 52 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ea99f9fb002f73f760fea222fdb9ef92]: Sum in s. 157(5) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 64(4)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/64/4) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-ea9d50e0b1e08135b83edb2cce36af85]: Sch. 2 para. 7 modified by S.I. 2007/1118, art. 5(1)(2) (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 324](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/324) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g))
[^key-eaa81af4a8e0c8b3ce342bad34f36ba2]: Words in Sch. 2 para. 27(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(23)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/23/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-eb49132cb8ec05a9ceaa0e3d7c7c1ad1]: [Sch. 19 para. 177](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/177) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-eb4cab607306f7c1339e70bed947d88d]: Sch. 20 para. 15 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-eb657c142c3f50225154d09ddb60518c]: [Sch. 8 para. 9](https://www.legislation.gov.uk/ukpga/2018/12/schedule/8/paragraph/9) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-eb8139f6b70ca4dec02be30470479741]: Words in s. 15(2)(f) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 19(8)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/19/8/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-ebbf8e6619bc3e211728d99978469935]: [Sch. 19 para. 326](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/326) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ebc3859cb98a52a9be07b9734f108537]: [Sch. 19 para. 407](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/407) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ec0464280a18691fbcb6515bd0852c75]: [Sch. 15 para. 1](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/1) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-ec0cba10767091647b040d74d1178660]: Words in s. 7(1) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 10(2)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/10/2/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-ec4c69b934ac57e2e43214a23dcbb96d]: [Sch. 11 para. 9](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/9) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-eced7daf0a93577817bcb97bd3948271]: S. 21 cross-heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 28](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/28) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-ed498558e2f05ed1eacf387d181f2ea5]: Words in Sch. 3 para. 20 cross-heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(18)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/18) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-ed56ea896273a41068d24de6c71e6165]: [Sch. 6](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 96](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/96) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-edcda9a310fb95ba168f7aa1cb086887]: [Sch. 8 para. 5](https://www.legislation.gov.uk/ukpga/2018/12/schedule/8/paragraph/5) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-edf909958009b94eaba7a07f5cb7d3ab]: [Sch. 19 para. 374](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/374) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ee309db6643b4037ea2a506821cd0818]: Sch. 20 para. 3 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ee8d24ff7579d381bcf3447e849bb137]: [Sch. 19 para. 303](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/303) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ee913b1171c2f96081016642901d4393]: [Sch. 7 para. 37](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/37) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-eecbeef6e50cfe3fc02d1b95f68648e7]: [Sch. 19 para. 86](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/86) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ef34a89ba28c172143123866dc86ac69]: [Sch. 19 para. 307](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/307) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ef6078ac24fc77609c82e05a80eb24d7]: Words in s. 15(2)(d) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 19(6)(c)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/19/6/c) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-ef6461538bedabe292afcef4ceaeb7e6]: [Sch. 19 para. 284](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/284) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ef69a37372aa6c408b351020173dbdf9]: [Sch. 15 para. 4](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/4) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-efeacacfef60e8ff1a67439770fe3b48]: [Sch. 9 para. 4](https://www.legislation.gov.uk/ukpga/2018/12/schedule/9/paragraph/4) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-efefe38304f75aba67a62c87caf4f25e]: [Sch. 15 para. 17](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/17) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-f01cfdd076622c51d98828fe590750f4]: [Sch. 19 para. 73](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/73) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-f07eab9e4a9bf6d612d592a97af71a89]: [Sch. 19 para. 159](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/159) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-f106395db15e7bf5a355770eae3d3f6a]: [Sch. 19 para. 329](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/329) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-f122f0c0c7045d69f3934a6b984c03c8]: [Sch. 19 para. 195](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/195) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-f13bf41e503097cc8d4107dadef0c470]: [Sch. 19 para. 375](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/375) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-f13e34f57b68b2f3aa30277188bfcc15]: Sch. 1 para. 10 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-f1e72d6620cae06e2c6df77112c0cc3c]: Words in s. 18(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 24(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/24/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-f1ea12c4ad88d4f388ce1587dd4bb8fa]: [Sch. 19 para. 116](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/116) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-f251ec0fb7d1f9d415237244a6167b7b]: [Sch. 19 para. 237](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/237) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-f26231d3616eb287b3ee33c4cae88815]: Words in Sch. 20 Pt. 3 heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 101(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/101/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-f287d086a4e8e739fe2ef37b6accb6d4]: Sch. 20 para. 36 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-f2da6f3a2b23afc935273439d0cf1789]: Words in s. 15(2)(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 19(4)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/19/4/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-f2e7bbf27eee985d9a2bb76f58d3deb1]: [Sch. 19 para. 219](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/219) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-f34b44dec21e9a4484c77b8fbc58e937]: Sch. 20 para. 40 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-f3538c932d11050dee0f2e1eb61020d3]: Words in s. 11(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 14](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/14) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-f36da07bc6957dc9cf0e7e6dcb8769d0]: [S. 116(A1)](https://www.legislation.gov.uk/ukpga/2018/12/section/116/A1) inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 48(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/48/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-f36e3f8d2e9c3f68d669cb6b0bbd97d6]: [Sch. 7 para. 3](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/3) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-f372ec304285c90f7943306b4b88d34f]: [Sch. 19 para. 16](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/16) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-f3c33a1b55881622df1ea41ec30cb96c]: Sch. 1 para. 37 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-f3f9b2e5f89457aeaa4f41a30c82f461]: [Sch. 7 para. 41](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/41) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-f43ca2a3521eaade711bc4bf7677fd8d]: Words in s. 209(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 88](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/88) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-f4979cce47b9db75cf9c23da4f9fa151]: Words in s. 149(4)(c) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 61](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/61) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-f4afc6d6129e6908fd5ea3cb69bb36df]: S. 28(5) inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 36(5)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/36/5) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-f4bf067041e8f9f8848359b6b4e202b0]: S. 207(3) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 87(5)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/87/5) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-f553e60aef4a123f0721442edebd1dcf]: S. 172 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-f5f2be2d52fde50a90249c3696ee9e5c]: S. 207(6) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 87(7)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/87/7) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-f61b1c41d1ef400486d9a7c32e3ef26b]: [Sch. 16 para. 5](https://www.legislation.gov.uk/ukpga/2018/12/schedule/16/paragraph/5) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-f78da6f023a80509141fa555013b5b91]: Act modified (23.5.2019) by [The Buckinghamshire (Structural Changes) Order 2019 (S.I. 2019/957)](https://www.legislation.gov.uk/uksi/2019/957), [arts. 1](https://www.legislation.gov.uk/uksi/2019/957/article/1), [15(2)](https://www.legislation.gov.uk/uksi/2019/957/article/15/2)
[^key-f7c63ce6cee731467dc869770e2c9f70]: Words in s. 181 substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 76](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/76) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-f838d49e21c426886f987f4284f2defe]: Words in Sch. 3 para. 12(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(14)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/14) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-f89e2d4a625a493b7c0cd20626e0b437]: Words in Sch. 3 para. 19 cross-heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(16)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/16) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-f9037392e04ce91d10ca238c50493e35]: [Sch. 7 para. 21](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/21) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-f96988967581766c70c8c1dec2b2775e]: [Sch. 16 para. 8](https://www.legislation.gov.uk/ukpga/2018/12/schedule/16/paragraph/8) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-f97a9a1810af918b554cccf9af5908b8]: [Sch. 19 para. 345](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/345) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-f97af0b42168a85cdcc3daab4547ff7f]: Sch. 20 para. 30 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-f9e750f4945678cf8a4558a867d56cf2]: [Sch. 19 para. 389](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/389) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-f9ed19a4487f8b68c8c2886e208463fe]: Sch. 20 para. 17 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-fa356a2624ede25a37981cc83a5ee715]: Words in Sch. 2 para. 2(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(6)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/6/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-fa38f60b5d4f99f26df799872e6cdbe5]: Words in [s. 115(9)](https://www.legislation.gov.uk/ukpga/2018/12/section/115/9) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 47(10)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/47/10) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-faa82338427aa33729b4502a5d841e1d]: [Sch. 19 para. 266](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/266) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-fb61e29e24493921fc39e369e4a42620]: [Sch. 19 para. 357](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/357) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-fb676c41b528ba898415453b8d0f7a90]: [Sch. 19 para. 182](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/182) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-fb7b533febf48a686748772dc38e418b]: Words in Sch. 3 para. 21(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(21)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/21) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-fc59486e66036027803653a12bf23594]: S. 118 heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 50(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/50/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-fc6a8eec58cbdca916769f66c1fcf95d]: [Sch. 19 para. 209](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/209) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-fca3b1b0c73fcd872e13405824270f8e]: S. 194 in force at 23.7.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 3(k)](https://www.legislation.gov.uk/uksi/2018/625/regulation/3/k)
[^key-fcf261b8f1782b32726129a6c66bdebd]: Words in s. 15(5) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 19(12)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/19/12) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-fd0986f7738e6fad0a16aeb00a034882]: [Sch. 19 para. 155](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/155) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-fd0c1206a5d534731177f0955c0cc52b]: [Sch. 19 para. 173](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/173) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-fd5a56238fd323f3236b1441a0713b63]: Words in Sch. 2 para. 6 substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(11)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/11) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-fdbc640373aa15e11b3c435f27bfb9a5]: [Sch. 19 para. 98](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/98) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-fde9fcf105d0042f1bda9820bf84606a]: [Sch. 19 para. 112](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/112) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-fe184c23ee47121bd5d9ccc551211b0c]: [Sch. 19 para. 191](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/191) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-fe7a3308baf800ac52f925c05dae0942]: S. 24(2)(d) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 32(3)(c)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/32/3/c) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-fe8ced2c1696c5a472a770ed18c245f4]: S. 192 in force at 23.7.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 3(i)](https://www.legislation.gov.uk/uksi/2018/625/regulation/3/i)
[^key-fea2840db43536e89fbad12e76ee7857]: [Sch. 12 para. 11](https://www.legislation.gov.uk/ukpga/2018/12/schedule/12/paragraph/11) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-fed272c8d1c4b1280f93db05392dbbfd]: [Sch. 7 para. 22](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/22) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-fee6c5c48bc9780e4333e44e43bc9ef0]: Sch. 13 para. 1(1)(i) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 97(2)(d)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/97/2/d) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-fef37e8482c3f3bf900f2bc9a1255f17]: [Sch. 19 para. 74](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/74) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ff22ac74c2a5beddde84ab38a67d210a]: Words in Sch. 13 para. 1(1)(e) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 97(2)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/97/2/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-ff63110f11b2b9882390f31a36181e9a]: [Sch. 19 para. 80](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/80) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ff84a0a5b654d268377d223457dbe16d]: [S. 116(1)(a)](https://www.legislation.gov.uk/ukpga/2018/12/section/116/1/a) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 48(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/48/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^M_C_b4a1b797-3afd-489c-a701-aac3402b439a]: Pt. 5 applied in part (with modifications) by [S.I. 2016/696](https://www.legislation.gov.uk/uksi/2016/696), [Sch. 2](https://www.legislation.gov.uk/uksi/2016/696/schedule/2) (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 406](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/406) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g) (with [reg. 4](https://www.legislation.gov.uk/uksi/2018/625/regulation/4)))
[^M_C_e888a930-eb8d-4d2d-c3ca-53b9f87a86ca]: Pt. 6 applied in part (with modifications) by [S.I. 2016/696](https://www.legislation.gov.uk/uksi/2016/696), [Sch. 2](https://www.legislation.gov.uk/uksi/2016/696/schedule/2) (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 406](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/406) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g) (with [reg. 4](https://www.legislation.gov.uk/uksi/2018/625/regulation/4)))
[^M_C_ef5e908b-c77b-46e7-eca0-1c165fc65218]: S. 13 applied by [S.I. 2015/1945](https://www.legislation.gov.uk/uksi/2015/1945), [reg. 15(1)](https://www.legislation.gov.uk/uksi/2015/1945/regulation/15/1) (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 387(2)](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/387/2) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g))
[^M_F_d572f402-2b66-4807-ea89-c9fa6447e306]: Words in s. 207(7) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 87(8)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/87/7) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^M_I_001184dc-ddbe-45f4-bebc-3ba7048d50bc]: S. 17 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_01c79242-e11a-4de6-89be-22106b74fbb8]: S. 73 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_023448da-c411-49dc-cc85-fee53ef9d5f6]: S. 114 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_052d410d-a4da-48f9-e8a4-126c4f6c971d]: S. 170 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^M_I_0540997b-4e51-47d5-e2c2-f361a535020a]: Sch. 5 para. 4 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_058f5ee4-0c32-422e-d9f3-b212d036db5e]: S. 141 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_06b96688-7c53-468d-c866-e9a1041b7743]: S. 78 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_06c6d4a7-e30f-432f-aa3e-c110f8eaa109]: S. 21 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_08c3cc03-d1fe-4cbc-c1d5-def8fafeb216]: S. 132 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_09139abf-9e2b-492e-abb0-a5b57cc064f4]: S. 149 in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^M_I_0aab0745-8612-4dd8-bc21-471c8ce93916]: S. 153 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^M_I_0f49d291-8dc5-4fb9-8b43-8f905ca39aa8]: S. 6 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_10e78792-3248-45d1-f90b-fb5d0e8b5e88]: S. 10 in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_121a1e60-73cd-4cca-c7fe-190c0ea7fe2c]: Sch. 13 para. 3 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_12c22354-7834-42e7-8798-07f1dde108b9]: S. 138 in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_1521588a-7d32-42bf-8bdd-f3cf5940e5ca]: Sch. 2 para. 1 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_1574309e-0fb7-417d-d1d4-23e96c23545f]: S. 64 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_1576d3fb-ced4-4d34-ec38-bcec573f1813]: Sch. 2 para. 26 in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_16855a45-e444-4356-a88e-7307bc6bca55]: S. 4 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_168df6f9-364c-4184-a194-3e9281c03b18]: S. 130 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_1f1683ef-67fd-402d-f360-a6484a761b03]: S. 136 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_1fbf4d26-7d75-4c01-ffac-2c67de207080]: S. 152 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^M_I_20e5dcba-2a1d-4359-aac2-ad45a251cc65]: Sch. 4 para. 1 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_222d6b89-8e89-402f-8222-65a1dea300f6]: Sch. 2 para. 2 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_2379c414-c179-41f5-8cd2-f26aad3a1969]: S. 59 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_239171aa-c678-4ff3-c101-a3b8431e487b]: S. 128 in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_25166470-99f6-4e01-e8f1-2ad0e67c766a]: S. 165 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^M_I_29681cd4-4b4a-447a-e2a1-57524db1d0fe]: S. 19 in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_2abf9ee8-3f94-4177-c4bd-4daf3d65e5a3]: S. 97 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^M_I_2bb8eb2d-ee74-4f52-ecac-7789473181c4]: S. 120 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_2c9d899d-cbb4-49de-dfc1-2d554efd5db1]: S. 20 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_2e29e5e1-8c41-46fc-a235-4e7cf9f16ca8]: Sch. 1 para. 39 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_30b536c2-931a-4411-f791-891af74cdfba]: S. 186 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^M_I_31363d8d-9c84-4ec2-bbd8-9aaefc6a07cb]: S. 156 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^M_I_34b2fbf2-1e4a-4d07-d099-1a38465186af]: S. 174 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^M_I_34e0f2d9-f333-43c2-9bd6-92eeb4ab691c]: Sch. 2 para. 25 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_36fe88db-2ffd-4a82-8bd6-5b571ea0df07]: Sch. 2 para. 4 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_372475c2-f786-4737-b481-aead1aa9c3ab]: S. 169 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^M_I_391b74dc-ff38-40f0-dbeb-d4d0a0c497ae]: S. 15 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_39340472-b308-446c-f416-de36a113b1c3]: S. 71 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_3a0cba3d-d7ac-4e80-ee7b-7c72f2e50667]: S. 171 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^M_I_3a6f1a21-3448-4b2a-be96-a9e9e60fd5b0]: S. 44 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_3c42d1bb-45b0-432b-c134-e3b599ff9254]: Sch. 3 para. 6 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_3e451190-f0c7-43b2-d2d7-28b88e307c39]: Sch. 3 para. 2 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_3ed2e15f-1eb7-4d90-e4d8-d26085739fbe]: S. 32 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_3f2dff73-cf74-4ec2-b84f-44e3562c005e]: S. 150 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^M_I_3f872866-06d2-4431-ac57-220c7b048d4c]: S. 63 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_3fdbc701-24a4-4f5e-8c4e-72eb7c51289b]: S. 28 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_42dc6850-6533-4b7e-e2cf-6b6c5fb4f747]: Sch. 1 para. 41 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_4469aa8f-c4ad-44c4-86cf-51dfe216cf18]: S. 151 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^M_I_457ae041-da77-46a3-d696-f4a38d15111e]: Sch. 1 para. 4 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_4980a4df-9065-411f-8d52-22ed992ade58]: S. 27 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_49bf51d7-da34-46f3-dca7-2362fec8e9af]: Sch. 1 para. 23 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_4cb33b48-fb05-441c-ad41-ab84ff1cc8de]: S. 45 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_4e059d57-96b5-4181-d7d2-791c643425f9]: Sch. 1 para. 1 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_4f1080c2-21a7-4c82-a89d-e7adfbd426fc]: Sch. 3 para. 11 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_4f213d8e-57db-413c-ccda-49423c6a9fdf]: S. 72 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_536accb5-c56e-4c05-9321-92e7d2337856]: S. 131 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_5532b144-5184-4c2c-fac1-a8163905e00c]: Sch. 5 para. 6 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_567c4630-0496-412d-a23f-202d19bddefa]: Sch. 17 para. 1 in force at 23.7.2018, see [s. 212(3)(d)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/3/d)
[^M_I_57447cf7-8ba0-44f8-cfaa-e84f882e8cb3]: Sch. 17 para. 4 in force at 23.7.2018, see [s. 212(3)(d)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/3/d)
[^M_I_593f54de-1e08-4c3e-f3ef-64051cc8d266]: S. 179 in force at 23.7.2018, see [s. 212(3)(e)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/3/e)
[^M_I_59507319-9aa1-4a5c-ac20-f136b7a16ed9]: Sch. 3 para. 19 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_5ac0b663-bead-426f-d919-937d2ed7365c]: S. 75 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_5ac45927-8647-4884-f5fd-427e5e0afe77]: Sch. 3 para. 5 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_5c6b5d6b-2c80-40cd-ea63-6e6a627488b9]: S. 49 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_5cff7ca7-5185-44a0-80a7-3edfa76b406e]: S. 13 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_5d7d1c41-5513-4c30-a5e3-a6742f62188f]: S. 143 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^M_I_5d97a9f6-9446-4bef-ef73-af80493561f2]: S. 16 in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_5dd63e8c-7050-440c-ffbc-309ef77d1ea8]: Sch. 4 para. 2 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_5f2b7364-a500-4bc5-8808-3acc657acdb2]: S. 173 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^M_I_5f6d8e46-a956-4bae-a8f7-6853febf945c]: S. 5 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_5fece20b-b02a-4ab5-e6e2-55118404f6f8]: S. 180 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^M_I_6001f914-95f9-4acb-9746-21a3beccdfac]: S. 12 in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_62c67ce5-a2dd-494a-9ee1-9f07c9499112]: S. 122 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_6537d08e-b9ed-4eef-e7da-07245fa6f534]: Sch. 2 para. 12 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_65d310f2-daa6-4635-ef8b-9b4d9f30fef9]: S. 62 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_6927ea01-1dd8-471d-d354-6d65ef9e17ea]: Sch. 20 para. 50 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^M_I_6ad9a872-b68b-4e05-f1b5-92db9c6d0ff9]: Sch. 4 para. 5 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_6b25091d-f95a-49dc-af77-daa527fdefdc]: Sch. 17 para. 2 in force at 23.7.2018, see [s. 212(3)(d)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/3/d)
[^M_I_6cd0a813-77e1-4596-c329-d593cdd2dbf1]: Sch. 3 para. 21 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_6e331738-092a-40d0-93dd-2a952272df54]: S. 57 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_6e4ced79-902f-4770-e83a-88b5e6a453bb]: S. 106 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^M_I_71950d7e-e7f1-400d-9c57-0b88753b8e0c]: S. 61 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_71f9449e-04bd-4ecf-c35a-74de3baff40e]: Sch. 4 para. 4 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_7313d5f1-d03c-4749-c489-1b35781632bf]: S. 116 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_7479f073-2b58-49f7-eead-ccd6b6136180]: S. 101 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^M_I_74c7c8a7-9076-4400-ae7b-7ad3a58732e1]: S. 25 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_76d1e4f8-9926-4de2-b335-e4d438edb989]: Sch. 1 para. 2 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_76da4643-8e05-4859-98a5-b82748f4a71d]: S. 81 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_79a2e3de-32a3-47c6-dda7-6b7747943801]: S. 178 in force at 23.7.2018, see [s. 212(3)(d)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/3/d)
[^M_I_7a33872e-7406-40df-9e6c-2e982eb80241]: S. 137 in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_7c1a4b6a-00b4-430b-d05d-c43749094035]: S. 92 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^M_I_81571ff7-69ee-497b-8b80-fa5821132c00]: S. 142 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^M_I_823d7c60-4c49-4046-d084-63e3c878f220]: S. 8 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_82b18c8b-cb16-4ad1-878c-8fd304610930]: S. 99 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^M_I_82c6bc0d-d6c8-4662-fcf6-6abbc290f7b3]: S. 139 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_85c6af85-3c5b-4fbd-c7b8-108ae565afaa]: S. 124 not in force at Royal Assent; s. 124 in force at 23.7.2018, see [s. 212(3)(a)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/3/a)
[^M_I_8683177b-98ef-4022-ab04-ccc580bc3b1d]: S. 155 in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^M_I_881dda53-b717-425e-8142-f7976a8174ac]: S. 1 in force at Royal Assent, see [s. 212(2)(a)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/a)
[^M_I_88b3c1b8-12f9-4400-fad2-2beaaa55d5d8]: S. 56 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_8ae9281f-1097-4ee9-f76f-cd8d2525eaf6]: S. 157 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^M_I_8c4e8eb0-b9be-4aad-a48e-efa68a2db249]: S. 134 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_8ffde057-b2ea-4c81-f8a2-5e4ab1649225]: S. 31 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_91518b62-ba84-4e47-8efb-1caae5146c11]: S. 118 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_9278b394-0992-4b27-bae4-d00400b4d831]: S. 135 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_93990c54-c0ee-4ca7-f3a8-aea2cb642281]: S. 94 in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^M_I_9504db77-a6a3-4319-cd7f-6718d98acc5e]: S. 115 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_95a2e458-7d97-4c0c-d3e1-9597b82c7433]: S. 159 in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^M_I_9804b0d5-f37d-4150-cd3c-319757236e8d]: S. 167 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^M_I_9c0d6c64-5423-4080-8352-7bb8d2632c1d]: S. 14 in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_a2d52cf4-c053-479c-c668-54966a9a7c22]: S. 181 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^M_I_a37ef16d-2cd9-4e0f-e077-8c5d46152c20]: S. 95 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^M_I_a5399a90-4a75-4c74-8cec-23321c0d3fd7]: S. 3 in force at Royal Assent, see [s. 212(2)(a)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/a)
[^M_I_a5d31172-3333-4d92-cb20-64b812344a40]: S. 121 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_a5f292bd-7e59-4888-837d-a728629d45a7]: Sch. 4 para. 3 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_a71f60bf-7db3-40a0-b963-840be27dcfbb]: S. 119 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_a7b85df0-21b3-4b80-eb4c-29019ab49964]: S. 24 in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_ab2d64c7-b166-45cf-842d-36ad8f908e2c]: S. 117 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_ae1d0dcc-6b09-429f-811e-2060266818a4]: S. 46 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_ae8e7f88-16b2-4b20-dbce-2c5dc39a1b68]: S. 43 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_aec3683b-69c6-440f-846b-8b8313671bf5]: S. 69 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_af26b735-43a6-4688-d21f-f9bd1cba69c5]: S.65 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_af7cd330-6e0e-46b0-959b-43e0629e5b85]: S. 29 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_b0c5485c-7f92-431a-89b0-c2732c0cad58]: Sch. 5 para. 1 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_b201d095-3f70-45b4-bcb5-b8532434c8c3]: S. 76 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_b309e3cd-87fd-499e-e10a-8fcbdb13e144]: Sch. 17 para. 3 in force at 23.7.2018, see [s. 212(3)(d)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/3/d)
[^M_I_b374618b-16d6-4d87-a6f2-861983f24085]: S. 70 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_b41aa1df-b4ef-4d59-aa1e-3231f2ac52c0]: Sch. 3 para. 20 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_b508ce3f-d940-4150-ad62-23f86f38b8e6]: S. 177 in force at 23.7.2018, see [s. 212(3)(c)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/3/c)
[^M_I_b67c4109-933e-4919-ceba-5e061b4d1a4c]: S. 26 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_b7567b75-8af2-4940-a45e-066c4b97aad9]: Sch. 18 para. 5 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^M_I_b816fd11-02d6-4987-c11f-0d83ef14b625]: S. 66 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_b96af367-24b4-4dc8-b449-1b4d146a45be]: Sch. 3 para. 17 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_b9ff7a53-68ba-4b5f-cea4-cc713fe3737a]: S. 50 in force in so far as not already in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_bbfafeaf-251f-4c63-a3fa-3a94ee9d5627]: S. 77 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_bc96b136-0fac-464a-9d2c-66928756f962]: Sch. 2 para. 16 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_bd2610c7-1c20-44bd-bd54-f7cec50cefdf]: Sch. 2 para. 20 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_bf3711a7-f203-49fa-ba50-dc4a9245ae9a]: S. 60 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_c1f33cf3-e662-4b89-ea75-a314be526ffa]: S. 48 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_c29ec2b5-23fc-42eb-ccc5-bd4e7c07653e]: S. 100 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^M_I_c2bb7aaf-74cb-4f58-e50e-be87e3c3bcb0]: Sch. 2 para. 11 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_c37eeacc-733b-4fd9-b03b-d8d029a82ea7]: Sch. 3 para. 1 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_c3ecc2f3-1e54-4634-b1c6-9e30f80388ab]: Sch. 2 para. 10 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_c5924cf3-6bec-4577-ae67-0fd578ee36d6]: S. 67 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_c853ced2-b522-4a39-9482-405217ecdbe7]: Sch. 2 para. 18 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_c930fb6e-cfcd-4863-db90-daafa37940ab]: S. 98 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^M_I_cd6fe374-e332-4c0e-875f-aa4dc41075f6]: S. 68 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_d0d73c42-8e30-469d-f331-baaea535f1cb]: Sch. 3 para. 7 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_d12995b4-0d48-4403-a1e6-4860af1c5761]: S. 30 in force in so far as not already in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_d258a6c5-2e63-4494-a85c-2fb83e0fd5f3]: Sch. 18 para. 4 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^M_I_d2cfddfb-2465-4e45-adcb-81429283652b]: S. 168 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^M_I_d3fc4004-a877-407a-8153-3ccc2d14ad91]: Sch. 2 para. 6 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_d4e0fb9d-6ef7-4135-b67d-0ea7d2c25a58]: Sch. 18 para. 1 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^M_I_d69dd7f5-3ead-4b03-f72c-ff3b578ecd5b]: S. 55 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_d74e4721-9593-445e-c9b1-9870df442f1f]: Sch. 20 para. 18 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^M_I_d7cf0043-ae6a-4697-de33-cdf539128035]: Sch. 2 para. 13 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_da01c4c2-f825-40ab-f69c-0d6e773451b9]: S. 2 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(a)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/a)
[^M_I_da07269f-db52-4980-a0c1-b39b712f7b3a]: S. 107 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^M_I_dbf566ba-d952-47d7-bc7b-5680d691f29a]: Sch. 2 para. 3 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_dcaef763-924e-4781-d81d-b11a8ad30472]: S. 33 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_dce41456-1292-42fc-86ad-012f24a66ab8]: S. 18 in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_dd2d81f5-ec2f-4277-e4c8-6dee20e72e31]: S. 11 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_e0e612ed-1ee3-42f6-ce07-e7e69f860bfc]: S. 166 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^M_I_e2a5d092-6e8a-4f38-c7b8-f59f831094c1]: S. 58 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_ea160988-028f-4a8b-9a09-9f3741dc5fe9]: S. 79 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_ef23244d-e6ce-4d81-fe87-8e68e4a1f316]: Sch. 13 para. 1 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_efe9e3d5-b2a4-42b5-9cde-33f394f571dc]: Sch. 3 para. 12 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_f1846588-44ae-4fac-d1f9-edbe1422eb8a]: S. 47 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_f7576ea7-8886-4705-ec43-bade7812bb41]: S. 140 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_f7c8792b-5c3b-472d-b608-e90d8d4ccd14]: S. 133 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_fc1fcecd-8eaa-4599-fb93-6c31bc4624a7]: S. 7 in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_fd8bbf79-c904-4594-bf5b-93a7b716007d]: S. 129 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_fe20ae3a-ee70-40d2-93cd-0c62f663ac11]: S. 96 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^M_I_ffacd87e-5a20-492e-de3c-99476f317c17]: S. 80 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
#### Special categories of personal data etc: supplementary
##### 17A
- (1) The Secretary of State may by regulations specify any of the following which the Secretary of State considers ensures an adequate level of protection of personal data—
- (a) a third country,
- (b) a territory or one or more sectors within a third country,
- (c) an international organisation, or
- (d) a description of such a country, territory, sector or organisation.
- (2) For the purposes of the UK GDPR and this Part of this Act, a transfer of personal data to a third country or an international organisation is based on adequacy regulations if, at the time of the transfer, regulations made under this section are in force which specify, or specify a description which includes—
- (a) in the case of a third country, the country or a relevant territory or sector within the country, or
- (b) in the case of an international organisation, the organisation.
- (3) Regulations under this section may specify that the Secretary of State considers that an adequate level of protection of personal data is ensured only for a transfer specified or described in the regulations and, if they do so, only such a transfer may rely on those regulations for the purposes of subsection (2).
- (4) Article 45(2) of the UK GDPR makes provision about the assessment of the adequacy of the level of protection for the purposes of this section and section 17B.
- (5) Regulations under this section—
- (a) where they relate to a third country, must specify their territorial and sectoral application;
- (b) where applicable, must specify the independent supervisory authority or authorities referred to in Article 45(2)(b) of the UK GDPR.
- (6) Regulations under this section may, among other things—
- (a) provide that in relation to a country, territory, sector, organisation or transfer specified, or falling within a description specified, in the regulations, section 17B(1) has effect as if it required the reviews described there to be carried out at such shorter intervals as are specified in the regulations;
- (b) identify a transfer of personal data by any means, including by reference to the controller or processor, the recipient, the personal data transferred or the means by which the transfer is made or by reference to relevant legislation, lists or other documents, as they have effect from time to time;
- (c) confer a discretion on a person.
- (7) Regulations under this section are subject to the negative resolution procedure.
##### 17B
- (1) For so long as regulations under section 17A are in force which specify, or specify a description which includes, a third country, a territory or sector within a third country or an international organisation, the Secretary of State must carry out a review of whether the country, territory, sector or organisation ensures an adequate level of protection of personal data at intervals of not more than 4 years.
- (2) Each review under subsection (1) must take into account all relevant developments in the third country or international organisation.
- (3) The Secretary of State must, on an ongoing basis, monitor developments in third countries and international organisations that could affect decisions to make regulations under section 17A or to amend or revoke such regulations.
- (4) Where the Secretary of State becomes aware that a country, territory, sector or organisation specified, or falling within a description specified, in regulations under section 17A no longer ensures an adequate level of protection of personal data, whether as a result of a review under this section or otherwise, the Secretary of State must, to the extent necessary, amend or revoke the regulations.
- (5) Where regulations under section 17A are amended or revoked in accordance with subsection (4), the Secretary of State must enter into consultations with the third country or international organisation concerned with a view to remedying the lack of an adequate level of protection.
- (6) The Secretary of State must publish—
- (a) a list of the third countries, territories and specified sectors within a third country and international organisations, and the descriptions of such countries, territories, sectors and organisations, which are for the time being specified in regulations under section 17A, and
- (b) a list of the third countries, territories and specified sectors within a third country and international organisations, and the descriptions of such countries, territories, sectors and organisations, which have been but are no longer specified in such regulations.
- (7) In the case of regulations under section 17A which specify that an adequate level of protection of personal data is ensured only for a transfer specified or described in the regulations—
- (a) the duty under subsection (1) is only to carry out a review of the level of protection ensured for such a transfer, and
- (b) the lists published under subsection (6) must specify or describe the relevant transfers.
##### 17C
- (1) The Secretary of State may by regulations specify standard data protection clauses which the Secretary of State considers provide appropriate safeguards for the purposes of transfers of personal data to a third country or an international organisation in reliance on Article 46 of the UK GDPR (and see also section 119A).
- (2) The Secretary of State must keep under review the standard data protection clauses specified in regulations under this section that are for the time being in force.
- (3) Regulations under this section are subject to the negative resolution procedure.
#### Manual unstructured data used in longstanding historical research
#### Processing to which this Part applies
#### Processing to which this Part applies
#### Regulations and consultation
#### Index of defined expressions
### Employment, social security and social protection
### Health or social care purposes
### Public health
### Research etc
### Requirement for an appropriate policy document when relying on conditions in this Part
### Statutory etc and government purposes
### Administration of justice and parliamentary purposes
### Equality of opportunity or treatment
### Racial and ethnic diversity at senior levels of organisations
### Preventing or detecting unlawful acts
### Protecting the public against dishonesty etc
### Regulatory requirements relating to unlawful acts and dishonesty etc
### Journalism etc in connection with unlawful acts and dishonesty etc
### Preventing fraud
### Suspicion of terrorist financing or money laundering
### Support for individuals with a particular disability or medical condition
### Counselling etc
### Safeguarding of children and of individuals at risk
### Safeguarding of economic well-being of certain individuals
### Insurance
### Occupational pensions
### Political parties
### Elected representatives responding to requests
### Disclosure to elected representatives
### Informing elected representatives about prisoners
### Publication of legal judgments
### Anti-doping in sport
### Standards of behaviour in sport
### Consent
### Protecting individual's vital interests
### Processing by not-for-profit bodies
### Personal data in the public domain
### Legal claims
### Judicial acts
### Administration of accounts used in commission of indecency offences involving children
### Extension of conditions in Part 2 of this Schedule referring to substantial public interest
### Extension of insurance conditions
### Application of this Part of this Schedule
### Requirement to have an appropriate policy document in place
### Additional safeguard: retention of appropriate policy document
### Additional safeguard: record of processing
### GDPR provisions to be adapted or restricted: “the listed GDPR provisions”
### Crime and taxation: general
### Crime and taxation: risk assessment systems
### Immigration
### Information required to be disclosed by law etc or in connection with legal proceedings
### GDPR provisions to be restricted: “the listed GDPR provisions”
### Functions designed to protect the public etc
### Audit functions
### Functions of the Bank of England
### Regulatory functions relating to legal services, the health service and children's services
### Regulatory functions of certain other persons
### Parliamentary privilege
### Judicial appointments, judicial independence and judicial proceedings
### Crown honours, dignities and appointments
### Protection of the rights of others: general
### Assumption of reasonableness for health workers, social workers and education workers
### GDPR provisions to be restricted: “the listed GDPR provisions”
### Legal professional privilege
### Self incrimination
### Corporate finance
### Management forecasts
### Negotiations
### Confidential references
### Exam scripts and exam marks
### Journalistic, academic, artistic and literary purposes
### Research and statistics
### Archiving in the public interest
### Definitions
### Exemption from the listed GDPR provisions: data processed by a court
### Exemption from the listed GDPR provisions: data subject's expectations and wishes
### Exemption from Article 15 of the GDPR: serious harm
### Restriction of Article 15 of the GDPR: prior opinion of appropriate health professional
### Definitions
### Exemption from the listed GDPR provisions: data processed by a court
### Exemption from the listed GDPR provisions: data subject's expectations and wishes
### Exemption from Article 15 of the GDPR: serious harm
### Restriction of Article 15 of the GDPR: prior opinion of Principal Reporter
### Educational records
### Other definitions
### Exemption from the listed GDPR provisions: data processed by a court
### Exemption from Article 15 of the GDPR: serious harm
### Restriction of Article 15 of the GDPR: prior opinion of Principal Reporter
### Exemption from Article 15 of the GDPR: child abuse data
### GDPR provisions to be restricted: “the listed GDPR provisions”
### Human fertilisation and embryology information
### Adoption records and reports
### Statements of special educational needs
### Parental order records and reports
### Information provided by Principal Reporter for children's hearing
### Introduction
### Review
### Right to appeal
### Appeal panel
### Hearing
### Decision following referral to appeal panel
### Meaning of “working day”
### Introductory
### References to the GDPR and its provisions
### References to Union law and Member State law
### References to the Union and to Member States
### References to supervisory authorities
### References to the national parliament
### Chapter I of the GDPR (general provisions)
### Chapter II of the GDPR (principles)
### Section 1 of Chapter III of the GDPR (rights of the data subject: transparency and modalities)
### Section 2 of Chapter III of the GDPR (rights of the data subject: information and access to personal data)
### Section 3 of Chapter III of the GDPR (rights of the data subject: rectification and erasure)
### Section 4 of Chapter III of the GDPR (rights of the data subject: right to object and automated individual decision-making)
### Section 5 of Chapter III of the GDPR (rights of the data subject: restrictions)
### Section 1 of Chapter IV of the GDPR (controller and processor: general obligations)
### Section 3 of Chapter IV of the GDPR (controller and processor: data protection impact assessment and prior consultation)
### Section 4 of Chapter IV of the GDPR (controller and processor: data protection officer)
### Section 5 of Chapter IV of the GDPR (controller and processor: codes of conduct and certification)
### Chapter V of the GDPR (transfers of data to third countries or international organisations)
### Section 1 of Chapter VI of the GDPR (independent supervisory authorities: independent status)
### Section 2 of Chapter VI of the GDPR (independent supervisory authorities: competence, tasks and powers)
### Chapter VII of the GDPR (co-operation and consistency)
### Chapter VIII of the GDPR (remedies, liability and penalties)
### Chapter IX of the GDPR (provisions relating to specific processing situations)
### Chapter X of the GDPR (delegated acts and implementing acts)
### Chapter XI of the GDPR (final provisions)
### Introductory
### General modifications
### Exemptions
### Chief officers of police and other policing bodies
### Other authorities with investigatory functions
### Authorities with functions relating to offender management
### Other authorities
### Statutory etc purposes
### Administration of justice
### Protecting individual's vital interests
### Safeguarding of children and of individuals at risk
### Personal data already in the public domain
### Legal claims
### Judicial acts
### Preventing fraud
### Archiving etc
### Consent to particular processing
### Right or obligation relating to employment
### Vital interests of a person
### Safeguarding of children and of individuals at risk
### Data already published by data subject
### Legal proceedings etc
### Administration of justice, parliamentary, statutory etc and government purposes
### Medical purposes
### Equality
### Preliminary
### Crime
### Information required to be disclosed by law etc or in connection with legal proceedings
### Parliamentary privilege
### Judicial proceedings
### Crown honours and dignities
### Armed forces
### Economic well-being
### Legal professional privilege
### Negotiations
### Confidential references given by the controller
### Exam scripts and marks
### Research and statistics
### Archiving in the public interest
### Status and capacity
### Appointment
### Resignation and removal
### Salary etc
### Officers and staff
### Carrying out of the Commissioner's functions by officers and staff
### Authentication of the seal of the Commissioner
### Presumption of authenticity of documents issued by the Commissioner
### Money
### Fees etc and other sums
### Accounts
### Scotland
### General tasks
### General powers
### Definitions
### Co-operation
### Requests for information and assistance from LED supervisory authorities
### Fees
### Restrictions on use of information
### LED supervisory authority
### Co-operation between the Commissioner and foreign designated authorities
### Assisting persons resident outside the UK with requests under Article 14 of the Convention
### Assisting UK residents with requests under Article 8 of the Convention
### Restrictions on use of information
### Foreign designated authority
### Issue of warrants in connection with non-compliance and offences
### Issue of warrants in connection with assessment notices
### Restrictions on issuing warrants: processing for the special purposes
### Restrictions on issuing warrants: procedural requirements
### Content of warrants
### Copies of warrants
### Execution of warrants: reasonable force
### Execution of warrants: time when executed
### Execution of warrants: occupier of premises
### Execution of warrants: seizure of documents etc
### Matters exempt from inspection and seizure: privileged communications
### Matters exempt from inspection and seizure: Parliamentary privilege
### Partially exempt material
### Return of warrants
### Offences
### Self-incrimination
### Vessels, vehicles etc
### Scotland
### Northern Ireland
### Meaning of “penalty”
### Notice of intent to impose penalty
### Contents of notice of intent
### Giving a penalty notice
### Contents of penalty notice
### Period for payment of penalty
### Variation of penalty
### Cancellation of penalty
### Enforcement of payment
### Interpretation
### Information notices
### Assessment notices
### Applications in respect of urgent notices
### Relevant records
### Relevant health records
### Relevant records relating to a conviction or caution
### Relevant records relating to statutory functions
### Data subject access right
### Records stating that personal data is not processed
### Power to amend
### Registration Service Act 1953 (c. 37)
### Veterinary Surgeons Act 1966 (c. 36)
### Parliamentary Commissioner Act 1967 (c. 13)
### Local Government Act 1974 (c. 7)
### Consumer Credit Act 1974 (c. 39)
### Pharmacy (Northern Ireland) Order 1976 (S.I. 1976/1213 (N.I. 22))
### Representation of the People Act 1983 (c. 2)
### Medical Act 1983 (c. 54)
### Dentists Act 1984 (c. 24)
### Companies Act 1985 (c. 6)
### Access to Medical Reports Act 1988 (c. 28)
### Opticians Act 1989 (c. 44)
### Access to Health Records Act 1990 (c. 23)
### Human Fertilisation and Embryology Act 1990 (c. 37)
### Trade Union and Labour Relations (Consolidation) Act 1992 (c. 52)
### Tribunals and Inquiries Act 1992 (c. 53)
### Industrial Relations (Northern Ireland) Order 1992 (S.I. 1992/807 (N.I. 5))
### Health Service Commissioners Act 1993 (c. 46)
### Data Protection Act 1998 (c. 29)
### Crime and Disorder Act 1998 (c. 37)
### Food Standards Act 1999 (c. 28)
### Immigration and Asylum Act 1999 (c. 33)
### Financial Services and Markets Act 2000 (c. 8)
### Terrorism Act 2000 (c. 11)
### Freedom of Information Act 2000 (c. 36)
### Political Parties, Elections and Referendums Act 2000 (c. 41)
### Public Finance and Accountability (Scotland) Act 2000 (asp 1)
### Criminal Justice and Police Act 2001 (c. 16)
### Anti-terrorism, Crime and Security Act 2001 (c.24)
### Health and Personal Social Services Act (Northern Ireland) 2001 (c. 3 (N.I.))
### Justice (Northern Ireland) Act 2002 (c. 26)
### Proceeds of Crime Act 2002 (c. 29)
### Enterprise Act 2002 (c. 40)
### Scottish Public Services Ombudsman Act 2002 (asp 11)
### Freedom of Information (Scotland) Act 2002 (asp 13)
### Courts Act 2003 (c. 39)
### Sexual Offences Act 2003 (c. 42)
### Criminal Justice Act 2003 (c. 44)
### Mental Health (Care and Treatment) (Scotland) Act 2003 (asp 13)
### Public Audit (Wales) Act 2004 (c. 23)
### Companies (Audit, Investigations and Community Enterprise) Act 2004 (c. 27)
### Domestic Violence, Crime and Victims Act 2004 (c. 28)
### Children Act 2004 (c. 31)
### Constitutional Reform Act 2005 (c. 4)
### Mental Capacity Act 2005 (c. 9)
### Public Services Ombudsman (Wales) Act 2005 (c. 10)
### Commissioners for Revenue and Customs Act 2005 (c. 11)
### Gambling Act 2005 (c. 19)
### Commissioner for Older People (Wales) Act 2006 (c. 30)
### National Health Service Act 2006 (c. 41)
### National Health Service (Wales) Act 2006 (c. 42)
### Companies Act 2006 (c. 46)
### Tribunals, Courts and Enforcement Act 2007 (c. 15)
### Statistics and Registration Service Act 2007 (c. 18)
### Serious Crime Act 2007 (c. 27)
### Legal Services Act 2007 (c. 29)
### Adoption and Children (Scotland) Act 2007 (asp 4)
### Criminal Justice and Immigration Act 2008 (c. 4)
### Regulatory Enforcement and Sanctions Act 2008 (c. 13)
### Health and Social Care Act 2008 (c. 14)
### Counter-Terrorism Act 2008 (c. 28)
### Public Health etc. (Scotland) Act 2008 (asp 5)
### Banking Act 2009 (c. 1)
### Borders, Citizenship and Immigration Act 2009 (c. 11)
### Marine and Coastal Access Act 2009 (c. 23)
### Coroners and Justice Act 2009 (c. 25)
### Broads Authority Act 2009 (c. i)
### Health and Social Care (Reform) Act (Northern Ireland) 2009 (c. 1 (N.I.))
### Terrorist Asset-Freezing etc. Act 2010 (c. 38)
### Marine (Scotland) Act 2010 (asp 5)
### Charities Act 2011 (c. 25)
### Welsh Language (Wales) Measure 2011 (nawm 1)
### Safeguarding Board Act (Northern Ireland) 2011 (c. 7 (N.I))
### Health and Social Care Act 2012 (c. 7)
### Protection of Freedoms Act 2012 (c. 9)
### HGV Road User Levy Act 2013 (c. 7)
### Crime and Courts Act 2013 (c. 22)
### Marine Act (Northern Ireland) 2013 (c. 10 (N.I.))
### Local Audit and Accountability Act 2014 (c. 2)
### Anti-social Behaviour, Crime and Policing Act 2014 (c. 12)
### Immigration Act 2014 (c. 22)
### Care Act 2014 (c. 23)
### Social Services and Well-being (Wales) Act 2014 (anaw 4)
### Counter-Terrorism and Security Act 2015 (c. 6)
### Small Business, Enterprise and Employment Act 2015 (c. 26)
### Modern Slavery Act 2015 (c. 30)
### Human Trafficking and Exploitation (Criminal Justice and Support for Victims) Act (Northern Ireland) 2015 (c. 2 (N.I.))
### Justice Act (Northern Ireland) 2015 (c. 9 (N.I.))
### Immigration Act 2016 (c. 19)
### Investigatory Powers Act 2016 (c. 25)
### Public Services Ombudsman Act (Northern Ireland) 2016 (c. 4 (N.I.))
### Health and Social Care (Control of Data Processing) Act (Northern Ireland) 2016 (c. 12 (N.I.))
### Mental Capacity Act (Northern Ireland) 2016 (c. 18 (N.I.))
### Justice Act (Northern Ireland) 2016 (c. 21 (N.I.))
### Policing and Crime Act 2017 (c. 3)
### Children and Social Work Act 2017 (c. 12)
### Higher Education and Research Act 2017 (c. 29)
### Digital Economy Act 2017 (c. 30)
### Landfill Disposals Tax (Wales) Act 2017 (anaw 3)
### Additional Learning Needs and Educational Tribunal (Wales) Act 2018 (anaw 2)
### This Act
### Estate Agents (Specified Offences) (No. 2) Order 1991 (S.I. 1991/1091)
### Channel Tunnel (International Arrangements) Order 1993 (S.I. 1993/1813)
### Access to Health Records (Northern Ireland) Order 1993 (S.I. 1993/1250 (N.I. 4))
### Channel Tunnel (Miscellaneous Provisions) Order 1994 (S.I. 1994/1405)
### European Primary and Specialist Dental Qualifications Regulations 1998 (S.I. 1998/811)
### Scottish Parliamentary Corporate Body (Crown Status) Order 1999 (S.I. 1999/677)
### Northern Ireland Assembly Commission (Crown Status) Order 1999 (S.I. 1999/3145)
### Data Protection (Corporate Finance Exemption) Order 2000 (S.I. 2000/184)
### Data Protection (Conditions under Paragraph 3 of Part II of Schedule 1) Order 2000 (S.I. 2000/185)
### Data Protection (Functions of Designated Authority) Order 2000 (S.I. 2000/186)
### Data Protection (International Co-operation) Order 2000 (S.I. 2000/190)
### Data Protection (Subject Access) (Fees and Miscellaneous Provisions) Regulations 2000 (S.I. 2000/191)
### Consumer Credit (Credit Reference Agency) Regulations 2000 (S.I. 2000/290)
### Data Protection (Subject Access Modification) (Health) Order 2000 (S.I. 2000/413)
### Data Protection (Subject Access Modification) (Education) Order 2000 (S.I. 2000/414)
### Data Protection (Subject Access Modification) (Social Work) Order 2000 (S.I. 2000/415)
### Data Protection (Crown Appointments) Order 2000 (S.I. 2000/416)
### Data Protection (Processing of Sensitive Personal Data) Order 2000 (S.I. 2000/417)
### Data Protection (Miscellaneous Subject Access Exemptions) Order 2000 (S.I. 2000/419)
### Data Protection (Designated Codes of Practice) (No. 2) Order 2000 (S.I. 2000/1864)
### Representation of the People (England and Wales) Regulations 2001 (S.I. 2001/341)
### Representation of the People (Scotland) Regulations 2001 (S.I. 2001/497)
### Financial Services and Markets Act 2000 (Disclosure of Confidential Information) Regulations 2001 (S.I. 2001/2188)
### Nursing and Midwifery Order 2001 (S.I. 2002/253)
### Electronic Commerce (EC Directive) Regulations 2002 (S.I. 2002/2013)
### Data Protection (Processing of Sensitive Personal Data) (Elected Representatives) Order 2002 (S.I. 2002/2905)
### Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426)
### Nationality, Immigration and Asylum Act 2002 (Juxtaposed Controls) Order 2003 (S.I. 2003/2818)
### Pupils' Educational Records (Scotland) Regulations 2003 (S.S.I. 2003/581)
### European Parliamentary Elections (Northern Ireland) Regulations 2004 (S.I. 2004/1267)
### Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004 (S.I. 2004/3244)
### Environmental Information Regulations 2004 (S.I. 2004/3391)
### Environmental Information (Scotland) Regulations 2004 (S.S.I. 2004/520)
### Licensing Act 2003 (Personal Licences) Regulations 2005 (S.I. 2005/41)
### Education (Pupil Information) (England) Regulations 2005 (S.I. 2005/1437)
### Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005 (S.I. 2005/2042)
### Register of Judgments, Orders and Fines Regulations 2005 (S.I. 2005/3595)
### Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005 (S.S.I. 2005/494)
### Data Protection (Processing of Sensitive Personal Data) Order 2006 (S.I. 2006/2068)
### National Assembly for Wales (Representation of the People) Order 2007 (S.I. 2007/236)
### Mental Capacity Act 2005 (Loss of Capacity during Research Project) (England) Regulations 2007 (S.I. 2007/679)
### National Assembly for Wales Commission (Crown Status) Order 2007 (S.I. 2007/1118)
### Mental Capacity Act 2005 (Loss of Capacity during Research Project) (Wales) Regulations 2007 (S.I. 2007/837 (W.72))
### Representation of the People (Absent Voting at Local Elections) (Scotland) Regulations 2007 (S.S.I. 2007/170)
### Representation of the People (Post-Local Government Elections Supply and Inspection of Documents) (Scotland) Regulations 2007 (S.S.I. 2007/264)
### Education (Pupil Records and Reporting) (Transitional) Regulations (Northern Ireland) 2007 (S.R. (N.I.) 2007 No. 43)
### Representation of the People (Northern Ireland) Regulations 2008 (S.I. 2008/1741)
### Companies Act 2006 (Extension of Takeover Panel Provisions) (Isle of Man) Order 2008 (S.I. 2008/3122)
### Controlled Drugs (Supervision of Management and Use) (Wales) Regulations 2008 (S.I. 2008/3239 (W.286))
### Energy Order 2003 (Supply of Information) Regulations (Northern Ireland) 2008 (S.R. (N.I.) 2008 No. 3)
### Companies (Disclosure of Address) Regulations 2009 (S.I. 2009/214)
### Overseas Companies Regulations 2009 (S.I. 2009/1801)
### Data Protection (Processing of Sensitive Personal Data) Order 2009 (S.I. 2009/1811)
### Provision of Services Regulations 2009 (S.I. 2009/2999)
### INSPIRE Regulations 2009 (S.I. 2009/3157)
### INSPIRE (Scotland) Regulations 2009 (S.S.I. 2009/440)
### Controlled Drugs (Supervision of Management and Use) Regulations (Northern Ireland) 2009 (S.R (N.I.) 2009 No. 225)
### Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010 (S.I. 2010/31)
### Pharmacy Order 2010 (S.I. 2010/231)
### Data Protection (Monetary Penalties) Order 2010 (S.I. 2010/910)
### National Employment Savings Trust Order 2010 (S.I. 2010/917)
### Local Elections (Northern Ireland) Order 2010 (S.I. 2010/2977)
### Pupil Information (Wales) Regulations 2011 (S.I. 2011/1942 (W.209))
### Debt Arrangement Scheme (Scotland) Regulations 2011 (S.S.I. 2011/141)
### Police and Crime Commissioner Elections Order 2012 (S.I. 2012/1917)
### Data Protection (Processing of Sensitive Personal Data) Order 2012 (S.I. 2012/1978)
### Neighbourhood Planning (Referendums) Regulations 2012 (S.I. 2012/2031)
### Controlled Drugs (Supervision of Management and Use) Regulations 2013 (S.I. 2013/373)
### Communications Act 2003 (Disclosure of Information) Order 2014 (S.I. 2014/1825)
### Criminal Justice and Data Protection (Protocol No. 36) Regulations 2014 (S.I. 2014/3141)
### Data Protection (Assessment Notices) (Designation of National Health Service Bodies) Order 2014 (S.I. 2014/3282)
### The Control of Explosives Precursors etc Regulations (Northern Ireland) 2014 (S.R. (N.I.) 2014 No. 224)
### Control of Poisons and Explosives Precursors Regulations 2015 (S.I. 2015/966)
### Companies (Disclosure of Date of Birth Information) Regulations 2015 (S.I. 2015/1694)
### Small and Medium Sized Business (Credit Information) Regulations 2015 (S.I. 2015/1945)
### European Union (Recognition of Professional Qualifications) Regulations 2015 (S.I. 2015/2059)
### Scottish Parliament (Elections etc) Order 2015 (S.S.I. 2015/425)
### Recall of MPs Act 2015 (Recall Petition) Regulations 2016 (S.I. 2016/295)
### Register of People with Significant Control Regulations 2016 (S.I. 2016/339)
### Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 (S.I. 2016/696)
### Court Files Privileged Access Rules (Northern Ireland) 2016 (S.R. (N.I.) 2016 No. 123)
### Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (S.I. 2017/692)
### Scottish Partnerships (Register of People with Significant Control) Regulations 2017 (S.I. 2017/694)
### Data Protection (Charges and Information) Regulations 2018 (S.I. 2018/480)
### National Health Service (General Medical Services Contracts) (Scotland) Regulations 2018 (S.S.I. 2018/66)
### National Health Service (Primary Medical Services Section 17C Agreements) (Scotland) Regulations 2018 (S.S.I. 2018/67)
### Introduction
### General modifications
### Specific modification of references to terms used in the Data Protection Act 1998
### Definitions
### Provision inserted in subordinate legislation by this Schedule
### Interpretation
### Right of access to personal data under the 1998 Act
### Right to prevent processing likely to cause damage or distress under the 1998 Act
### Right to prevent processing for purposes of direct marketing under the 1998 Act
### Automated processing under the 1998 Act
### Compensation for contravention of the 1998 Act or Part 4 of the 2014 Regulations
### Rectification, blocking, erasure and destruction under the 1998 Act
### Jurisdiction and procedure under the 1998 Act
### Exemptions under the 1998 Act
### Prohibition by this Act of requirement to produce relevant records
### Avoidance under this Act of certain contractual terms relating to health records
### Exemptions from the GDPR: restrictions of rules in Articles 13 to 15 of the GDPR
### Manual unstructured data held by FOI public authorities
### Logging
### Regulation 50 of the 2014 Regulations (disapplication of the 1998 Act)
### Maximum fee for data subject access requests to intelligence services
### National security certificates: processing of personal data under the 1998 Act
### National security certificates: processing of personal data under the 2018 Act
### Appointment etc
### Accounts
### Annual report
### Fees etc received by the Commissioner
### Functions in connection with the Data Protection Convention
### Co-operation with the European Commission: transfers of personal data outside the EEA
### Charges payable to the Commissioner by controllers
### Requests for assessment
### Codes of practice
### Interpretation of this Part
### Information notices
### Special information notices
### Assessment notices
### Enforcement notices
### Determination by Commissioner as to the special purposes
### Restriction on enforcement in case of processing for the special purposes
### Offences
### Powers of entry
### Monetary penalties
### Appeals
### Exemptions
### Tribunal Procedure Rules
### Obstruction etc
### Enforcement etc under the 2014 Regulations
### Information notices
### Powers of entry
### Tribunal Procedure Rules
### Powers to disclose information to the Commissioner
### Codes etc required to be consistent with the Commissioner's data-sharing code
### Consumer Credit Act 1974
### Freedom of Information Act 2000
### Freedom of Information (Scotland) Act 2002
### Access to Health Records (Northern Ireland) Order 1993 (S.I. 1993/1250 (N.I. 4))
### Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2450)
### Health and Personal Social Services (Quality, Improvement and Regulation) (Northern Ireland) Order 2003 (S.I. 2003/431 (N.I. 9))
### Environmental Information Regulations 2004 (S.I. 2004/3391)
### Environmental Information (Scotland) Regulations 2004 (S.S.I. 2004/520)
## Editorial notes
[^c23266291]: S. 7 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23266301]: S. 10 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23266331]: S. 12 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23266351]: S. 14 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23266361]: S. 16 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23266371]: S. 18 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23266381]: S. 19 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23266391]: [S. 23](https://www.legislation.gov.uk/ukpga/2018/12/section/23) in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23266401]: S. 24 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23266411]: S. 30 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23266421]: [S. 35](https://www.legislation.gov.uk/ukpga/2018/12/section/35) in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23266431]: S. 50 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23266471]: S. 53 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23268021]: S. 54 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23268891]: [S. 86](https://www.legislation.gov.uk/ukpga/2018/12/section/86) in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23268981]: S. 94 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23269021]: S. 113 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23287301]: S. 125 not in force at Royal Assent; s. 125 in force at 23.7.2018 for specified purposes, see [s. 212(3)(b)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/3/b)
[^c23287311]: S. 126 not in force at Royal Assent; s. 126 in force at 23.7.2018 for specified purposes, see [s. 212(3)(b)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/3/b)
[^c23287321]: S. 127 not in force at Royal Assent; s. 127 in force at 23.7.2018 for specified purposes, see [s. 212(3)(b)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/3/b)
[^c23269091]: S. 128 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23269101]: S. 137 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23269111]: S. 138 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23269131]: S. 149 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23269141]: S. 155 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23269151]: S. 159 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23269161]: S. 183 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23269171]: S. 188 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23269181]: S. 190 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23269191]: S. 191 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23269201]: S. 203 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23269211]: S. 211 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23269221]: S. 213(2) in force and s. 213(3) in force for specified purposes at Royal Assent, see [s. 212(2)(e)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/e/f)
[^c23270721]: Sch. 2 para. 15 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23269231]: Sch. 2 para. 26 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23269241]: Sch. 18 para. 7 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23269251]: [Sch. 19 para. 60](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/60) in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23269261]: [Sch. 19 para. 434](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/434) in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^key-3e6824e9fac1395ac56538683f7c074b]: S. 123 in force at 23.7.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 3(a)](https://www.legislation.gov.uk/uksi/2018/625/regulation/3/a)
[^key-36b37c6d1c4d4736d1dab263576fcebd]: S. 125 in force at 23.7.2018 for specified purposes by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 3(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/3/b)
[^key-8cff94f874bcf79b507759af01a7f312]: S. 126 in force at 23.7.2018 for specified purposes by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 3(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/3/c)
[^key-43399f72f3c3d874b4165535c7568a5d]: S. 127 in force at 23.7.2018 for specified purposes by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 3(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/3/d)
[^key-bc71876f7b085a331fb2523e66d417c1]: S. 188 in force at 23.7.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 3(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/3/e)
[^key-ab59fd7803f594dabdae198bc7ee59b2]: S. 189 in force at 23.7.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 3(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/3/f)
[^key-579c3cd911e92166215a70e270b7943b]: S. 190 in force at 23.7.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 3(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/3/g)
[^key-989b498271c18a95f66ed51054086cd6]: S. 191 in force at 23.7.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 3(h)](https://www.legislation.gov.uk/uksi/2018/625/regulation/3/h)
[^key-fe8ced2c1696c5a472a770ed18c245f4]: S. 192 in force at 23.7.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 3(i)](https://www.legislation.gov.uk/uksi/2018/625/regulation/3/i)
[^key-973b20ca86f76226ec3ba9a60c4213af]: S. 193 in force at 23.7.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 3(j)](https://www.legislation.gov.uk/uksi/2018/625/regulation/3/j)
[^key-fca3b1b0c73fcd872e13405824270f8e]: S. 194 in force at 23.7.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 3(k)](https://www.legislation.gov.uk/uksi/2018/625/regulation/3/k)
[^key-d9d4a5328d371f45edc310525d5e56ca]: S. 195 in force at 23.7.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 3(l)](https://www.legislation.gov.uk/uksi/2018/625/regulation/3/l)
[^key-2434c3fb6c8b5ee17896e645120e0c61]: Sch. 2 para. 27 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-bf2d61f28feb2f6a4a05e3ea8b3954db]: Sch. 2 para. 28 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-3d4bdf3729cdaf65278d4e8242b8c0e8]: [Sch. 19 para. 76](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/76) omitted (29.3.2019) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(3)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/3), [Sch. 4 para. 3](https://www.legislation.gov.uk/uksi/2019/419/schedule/4/paragraph/3)
[^key-e68518991b24f426c7502b2a7e8ed531]: [Sch. 19 para. 201](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/201) omitted (29.3.2019) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(3)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/3), [Sch. 4 para. 3](https://www.legislation.gov.uk/uksi/2019/419/schedule/4/paragraph/3)
[^key-f78da6f023a80509141fa555013b5b91]: Act modified (23.5.2019) by [The Buckinghamshire (Structural Changes) Order 2019 (S.I. 2019/957)](https://www.legislation.gov.uk/uksi/2019/957), [arts. 1](https://www.legislation.gov.uk/uksi/2019/957/article/1), [15(2)](https://www.legislation.gov.uk/uksi/2019/957/article/15/2)
[^key-9def3b7505a61a658140ff7ee34bf178]: [Sch. 19 para. 49](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/49) omitted (21.7.2019) by virtue of [The Financial Services and Markets Act 2000 (Prospectus) Regulations 2019 (S.I. 2019/1043)](https://www.legislation.gov.uk/uksi/2019/1043), [regs. 1(1)](https://www.legislation.gov.uk/uksi/2019/1043/regulation/1/1), [37](https://www.legislation.gov.uk/uksi/2019/1043/regulation/37)
[^key-72fc14e4074bc221cce83073cc6b4954]: Words in Sch. 2 para. 10(2)(c)(iv) inserted (E.W.) (23.7.2019) by [Public Services Ombudsman (Wales) Act 2019 (anaw 3)](https://www.legislation.gov.uk/anaw/2019/3), [s. 77(1)](https://www.legislation.gov.uk/anaw/2019/3/section/77/1), [Sch. 5 para. 28](https://www.legislation.gov.uk/anaw/2019/3/schedule/5/paragraph/28); [S.I. 2019/1096](https://www.legislation.gov.uk/wsi/2019/1096), [reg. 2](https://www.legislation.gov.uk/wsi/2019/1096/regulation/2)
[^key-bda1051a1d1b0d9d9e9c369c328cf110]: S. 93 in force at 16.9.2019 by [S.I. 2019/1188](https://www.legislation.gov.uk/uksi/2019/1188), [reg. 2(a)](https://www.legislation.gov.uk/uksi/2019/1188/regulation/2/a)
[^key-74ae32c1534b7fb225df9f0b0a326da8]: S. 102 in force at 16.9.2019 by [S.I. 2019/1188](https://www.legislation.gov.uk/uksi/2019/1188), [reg. 2(b)](https://www.legislation.gov.uk/uksi/2019/1188/regulation/2/b)
[^key-00c31acc0526af8b197626c45f603186]: S. 103 in force at 16.9.2019 by [S.I. 2019/1188](https://www.legislation.gov.uk/uksi/2019/1188), [reg. 2(c)](https://www.legislation.gov.uk/uksi/2019/1188/regulation/2/c)
[^key-a1c35c4d9fb9c6b8432b9c99b83faa06]: S. 104 in force at 16.9.2019 by [S.I. 2019/1188](https://www.legislation.gov.uk/uksi/2019/1188), [reg. 2(d)](https://www.legislation.gov.uk/uksi/2019/1188/regulation/2/d)
[^key-e3d81e9f8b5c66334909f95bff82cae4]: S. 105 in force at 16.9.2019 by [S.I. 2019/1188](https://www.legislation.gov.uk/uksi/2019/1188), [reg. 2(e)](https://www.legislation.gov.uk/uksi/2019/1188/regulation/2/e)
[^key-9a5a534af2e44027b701cbb835af1113]: S. 108 in force at 16.9.2019 by [S.I. 2019/1188](https://www.legislation.gov.uk/uksi/2019/1188), [reg. 2(f)](https://www.legislation.gov.uk/uksi/2019/1188/regulation/2/f)
[^key-b8ac6fb172d66af4a5e7441a6e2e92e5]: Words in s. 204(1)(g) omitted (2.12.2019 at 00:01) by virtue of [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 227(2)(a)](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/227/2/a) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2019/1434](https://www.legislation.gov.uk/uksi/2019/1434), [reg. 2(b)](https://www.legislation.gov.uk/uksi/2019/1434/regulation/2/b)
[^key-73a5bdb2a7cc14d028614db4749623ee]: Words in s. 204(1)(g) omitted (2.12.2019 at 00:01) by virtue of [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 227(2)(b)](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/227/2/b) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2019/1434](https://www.legislation.gov.uk/uksi/2019/1434), [reg. 2(b)](https://www.legislation.gov.uk/uksi/2019/1434/regulation/2/b)
[^key-6d40880f4046ed50e5f12cfbeea87fa1]: S. 204(2)(a) substituted (2.12.2019 at 00:01) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 227(3)](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/227/3) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2019/1434](https://www.legislation.gov.uk/uksi/2019/1434), [reg. 2(b)](https://www.legislation.gov.uk/uksi/2019/1434/regulation/2/b)
[^key-e2376d4e7ebdd9a757cdbb27840c896f]: Act modified (14.2.2020) by [The Northamptonshire (Structural Changes) Order 2020 (S.I. 2020/156)](https://www.legislation.gov.uk/uksi/2020/156), [arts. 1](https://www.legislation.gov.uk/uksi/2020/156/article/1), [17(2)(e)](https://www.legislation.gov.uk/uksi/2020/156/article/17/2/e)
[^key-b43bb1f6638b5994d92beeecf2ab27a2]: S. 207 modified (30.9.2020) by [The Channel Tunnel (Arrangements with the Kingdom of the Netherlands) Order 2020 (S.I. 2020/916)](https://www.legislation.gov.uk/uksi/2020/916), [arts. 1(2)(b)](https://www.legislation.gov.uk/uksi/2020/916/article/1/2/b), [4(3)](https://www.legislation.gov.uk/uksi/2020/916/article/4/3)[(4)](https://www.legislation.gov.uk/uksi/2020/916/article/4/4)
[^key-ce61eaf66563099c85e4f387c32e5c33]: Act applied (30.9.2020) by [The Channel Tunnel (Arrangements with the Kingdom of the Netherlands) Order 2020 (S.I. 2020/916)](https://www.legislation.gov.uk/uksi/2020/916), [arts. 1(2)(b)](https://www.legislation.gov.uk/uksi/2020/916/article/1/2/b), [4(3)](https://www.legislation.gov.uk/uksi/2020/916/article/4/3)
[^key-953b9df49e10ea57d7c67ec16df9d1c0]: Act excluded (30.9.2020) by [The Channel Tunnel (Arrangements with the Kingdom of the Netherlands) Order 2020 (S.I. 2020/916)](https://www.legislation.gov.uk/uksi/2020/916), [arts. 1(2)(b)](https://www.legislation.gov.uk/uksi/2020/916/article/1/2/b)[4(4)](https://www.legislation.gov.uk/uksi/2020/916/article/4/4)
[^key-ed56ea896273a41068d24de6c71e6165]: [Sch. 6](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 96](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/96) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^M_I_ad986912-0e3e-41e4-b0ef-7542e2eaf538]: S. 3 in force at Royal Assent, see [s. 212(2)(a)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/a)
[^M_I_d478c851-450a-4273-8a07-177acdbfde63]: S. 1 in force at Royal Assent, see [s. 212(2)(a)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/a)
[^M_I_593f54de-1e08-4c3e-f3ef-64051cc8d266]: S. 179 in force at 23.7.2018, see [s. 212(3)(e)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/3/e)
[^M_I_79a2e3de-32a3-47c6-dda7-6b7747943801]: S. 178 in force at 23.7.2018, see [s. 212(3)(d)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/3/d)
[^M_I_b508ce3f-d940-4150-ad62-23f86f38b8e6]: S. 177 in force at 23.7.2018, see [s. 212(3)(c)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/3/c)
[^key-f48265c91f92324157bcbd69aec5f2d1]: S. 159 applied (with modifications) by S.I. 2016/696, Sch. 2 (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 406](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/406) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g) (with [reg. 4](https://www.legislation.gov.uk/uksi/2018/625/regulation/4)))
[^key-0e1a221ed43e81a753b0777427765028]: S. 176 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-671bdd93a20a3ea8bfc60116d53d6386]: [S. 151](https://www.legislation.gov.uk/ukpga/2018/12/section/151) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-f1a10e1df16440d73d2c4a2897646e99]: S. 159 in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-d225951e2ce1ec62c35c07dbab2fd079]: S. 169 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-983bc901db1c18653e17ad1a7abe6eb9]: [S. 154](https://www.legislation.gov.uk/ukpga/2018/12/section/154) applied (with modifications) by S.I. 2016/696, Sch. 2 (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 406](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/406) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g) (with [reg. 4](https://www.legislation.gov.uk/uksi/2018/625/regulation/4)))
[^key-f553e60aef4a123f0721442edebd1dcf]: S. 172 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-6251e3f8b043005c1b3af9c93785fec4]: [S. 144](https://www.legislation.gov.uk/ukpga/2018/12/section/144) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-9702e78daee1441e8db8fb0bd641a1d1]: [S. 145](https://www.legislation.gov.uk/ukpga/2018/12/section/145) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-730bc1c474fbdbd93f519027acff36fe]: [S. 146](https://www.legislation.gov.uk/ukpga/2018/12/section/146) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-334055490339c13a3065b12d15d14412]: [S. 163](https://www.legislation.gov.uk/ukpga/2018/12/section/163) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-feb5964141054c6e4f3b85e4309cc00f]: S. 150 applied (with modifications) by S.I. 2016/696, Sch. 2 (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 406](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/406) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g) (with [reg. 4](https://www.legislation.gov.uk/uksi/2018/625/regulation/4)))
[^key-ac2b498ccda10c6a036c83faf1d9f655]: [S. 168](https://www.legislation.gov.uk/ukpga/2018/12/section/168) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-ab17241dc6150ceb8d51a34398cf5b43]: [S. 164](https://www.legislation.gov.uk/ukpga/2018/12/section/164) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-3fade8ccb3e6eee84a48777f39585c8e]: [S. 170](https://www.legislation.gov.uk/ukpga/2018/12/section/170) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-d20a5bbac083d6326fed8a927d61c864]: S. 155 in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-7e7837d48a533aecdf4b7c5313ae4618]: [S. 167](https://www.legislation.gov.uk/ukpga/2018/12/section/167) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-511284a393805eca048a20f809e0173f]: [S. 157](https://www.legislation.gov.uk/ukpga/2018/12/section/157) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-180620974414cfb91bb4327607514d61]: [S. 149](https://www.legislation.gov.uk/ukpga/2018/12/section/149) applied (with modifications) by S.I. 2016/696, Sch. 2 (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 406](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/406) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g) (with [reg. 4](https://www.legislation.gov.uk/uksi/2018/625/regulation/4)))
[^key-900f8521682258b0d596d985dbe9f03e]: [S. 155](https://www.legislation.gov.uk/ukpga/2018/12/section/155) applied (with modifications) by S.I. 2016/696, Sch. 2 (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 406](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/406) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g) (with [reg. 4](https://www.legislation.gov.uk/uksi/2018/625/regulation/4)))
[^key-a931c9ae51bd816f5bd69abcac767b27]: [S. 160](https://www.legislation.gov.uk/ukpga/2018/12/section/160) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-adfbef96b0118a4225f3bad68232b41a]: S. 152 applied (with modifications) by S.I. 2016/696, Sch. 2 (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 406](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/406) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g) (with [reg. 4](https://www.legislation.gov.uk/uksi/2018/625/regulation/4)))
[^key-25f5cd3f2a950e60e3b476b7f479cd1b]: [S. 180](https://www.legislation.gov.uk/ukpga/2018/12/section/180) applied (with modifications) by S.I. 2016/696, Sch. 2 (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 406](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/406) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g) (with [reg. 4](https://www.legislation.gov.uk/uksi/2018/625/regulation/4)))
[^key-59b565f9ed686b63dd17fb78a246be4b]: [S. 148](https://www.legislation.gov.uk/ukpga/2018/12/section/148) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-224beca082638e8b5e55543343cc38ac]: [S. 158](https://www.legislation.gov.uk/ukpga/2018/12/section/158) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-455544faa372ff78ca6254232208d956]: [S. 174](https://www.legislation.gov.uk/ukpga/2018/12/section/174) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-48eaeef4a832b970bc428de9cf37c88d]: [S. 175](https://www.legislation.gov.uk/ukpga/2018/12/section/175) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-01e2c7b93703ca0926a90ba42af57f20]: S. 149 in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-e61c7bcd6ea2ed4e56a76b4a860e3400]: S. 147 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-91292f1ac678c631895a6fc705289784]: S. 153 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-01c8aa692ac1cd2c6236e6f702efac74]: S. 143 applied (with modifications) by S.I. 2016/696, Sch. 2 (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 406](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/406) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g) (with [reg. 4](https://www.legislation.gov.uk/uksi/2018/625/regulation/4)))
[^key-46d58c93999a6ccd15dc9621c38b8ed4]: S. 143 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-62c235ddca5a0cb27ca4df42cbd759a4]: [S. 157](https://www.legislation.gov.uk/ukpga/2018/12/section/157) applied (with modifications) by S.I. 2016/696, Sch. 2 (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 406](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/406) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g) (with [reg. 4](https://www.legislation.gov.uk/uksi/2018/625/regulation/4)))
[^key-a620b16db08eef90c1f0f37327d49a73]: S. 180 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-538e811ac86cb902d868aaf9cf45611a]: S. 142 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-c8e2994c25fb458736a5c26eaf716e23]: S. 162 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-9ee94140e27340a92fd4c4fd178a766f]: [S. 142](https://www.legislation.gov.uk/ukpga/2018/12/section/142) applied (with modifications) by S.I. 2016/696, Sch. 2 (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 406](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/406) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g) (with [reg. 4](https://www.legislation.gov.uk/uksi/2018/625/regulation/4)))
[^key-c504c026d65767bbf2b883bf39aceac3]: S. 150 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-4c73d0711749ef1eeb74943403e49cb3]: S. 162 applied (with modifications) by S.I. 2016/696, Sch. 2 (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 406](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/406) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g) (with [reg. 4](https://www.legislation.gov.uk/uksi/2018/625/regulation/4)))
[^key-2cc9f8b6174ea05be43c4dacf00ef921]: S. 156 applied in part (with modifications) by S.I. 2016/696, Sch. 2 (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 406](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/406) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g) (with [reg. 4](https://www.legislation.gov.uk/uksi/2018/625/regulation/4)))
[^key-a4f4f60d6764a8d5c6bddc3db18e22e3]: S. 156 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-62a644dce407a3386689a4b81f7ffee5]: S. 163 applied (with modifications) by S.I. 2016/696, Sch. 2 (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 406](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/406) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g) (with [reg. 4](https://www.legislation.gov.uk/uksi/2018/625/regulation/4)))
[^key-735e937719bbf12adf678334047a3604]: S. 161 applied (with modifications) by S.I. 2016/696, Sch. 2 (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 406](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/406) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g) (with [reg. 4](https://www.legislation.gov.uk/uksi/2018/625/regulation/4)))
[^key-3125787f6f7e070d33d35e58baeae355]: S. 166 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-2f908b9fefb61f6ccda52c5f821ade6a]: S. 154 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-02bcce2e10103bfbb9cb6365677d233d]: S. 164 applied (with modifications) by S.I. 2016/696, Sch. 2 (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 406](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/406) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g) (with [reg. 4](https://www.legislation.gov.uk/uksi/2018/625/regulation/4)))
[^key-5139248c0ce96d1230621e3b23bfe0c0]: S. 165 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-80f9d0ff7c5e709d0a445c0557c16c6d]: S. 153 applied (with modifications) by S.I. 2016/696, Sch. 2 (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 406](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/406) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g) (with [reg. 4](https://www.legislation.gov.uk/uksi/2018/625/regulation/4)))
[^key-2b9674d7bfd3049679cc97dc1b298995]: S. 161 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-9efe500490f9ef72f3aa52e6e368a184]: S. 181 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-7c01eaf50d3b2809426af6898fe39f7b]: S. 160 applied (with modifications) by S.I. 2016/696, Sch. 2 (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 406](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/406) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g) (with [reg. 4](https://www.legislation.gov.uk/uksi/2018/625/regulation/4)))
[^key-c47c81caf2d389589a0b359bcda23554]: S. 152 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-06eb7ee18cdc73187d94775399b4cdeb]: S. 173 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-563c53581f305d8070e5ba30b52c58bc]: S. 171 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^M_C_acb96828-58d2-4805-bf80-bf063066b6f6]: Pt. 5 applied in part (with modifications) by [S.I. 2016/696](https://www.legislation.gov.uk/uksi/2016/696), [Sch. 2](https://www.legislation.gov.uk/uksi/2018/625/schedule/2) (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 406](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/406) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g) (with [reg. 4](https://www.legislation.gov.uk/uksi/2018/625/regulation/4)))
[^M_I_85c6af85-3c5b-4fbd-c7b8-108ae565afaa]: S. 124 not in force at Royal Assent; s. 124 in force at 23.7.2018, see [s. 212(3)(a)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/3/a)
[^M_I_dbff0119-ad04-4d61-c2ab-7987685c0a87]: S. 135 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_51e40d42-0bc3-4936-c409-4ba37fb8d392]: S. 136 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_d7a46bc7-03e6-43af-8b3f-4d1511595065]: S. 134 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_99ada6ee-1a59-4ec1-c0dc-a1a262bf806b]: S. 128 in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_b311615d-5d46-4d0b-91f3-005641cdaa9a]: S. 141 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_c35b648e-29da-4d8f-b8b5-d766fa15f309]: S. 115 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_74f14993-91f4-4e4c-8f80-8ec195a8c0c0]: S. 130 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_03f9ee2e-1a2c-418a-fe54-6a6ab65be4e0]: S. 119 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_bd8547b9-e284-49dd-d292-37f928af59b4]: S. 116 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_M_100d5e1f-b281-4bd6-b29d-52e0bf479375]: S. 118 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_653476cc-1a41-45f1-b5c3-ad36a0677ab0]: S. 139 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_9b2d8039-d460-4c1f-9ade-581d8391c9f7]: S. 117 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_3731d42f-2ac2-411c-9a8f-30c4750cee61]: S. 131 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_7f28586f-47dd-410e-82ee-d020fc1525cd]: S. 129 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_272cebd4-7857-4c20-df1f-1cab781f177c]: S. 140 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_0bc7b8cd-a4d9-4da3-a651-236a23f2efa5]: S. 137 in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_61ef4e07-599e-4639-a142-269485449416]: S. 114 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_047447c6-e238-4007-cc68-a9b0da3c6d4f]: S. 122 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_379b99b4-10fe-4499-b425-324bd6774d68]: S. 132 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_5d13ed80-0885-40f2-db46-1ab06757fca9]: S. 121 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_480e54e4-168b-46a4-8bf9-0fad0f769738]: S. 120 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_538749d2-cf7e-4f0c-aa26-6bbaef2a6f09]: S. 138 in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_c18776d6-0ab1-4277-d653-c25d51bf2774]: S. 133 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-dd0f181b5dd17d7042dc7e38ce07044c]: S. 111 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-28f473b60938488229022a08cd48e4ad]: S. 110 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-e25930aa3cf639fbe9dcbc865cf147f2]: S. 113 in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-2889cf5caada78513e3eb57b96eea5cc]: S. 112 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-deba1ccec93c5dcf33f3a26797f2173c]: S. 109 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^M_I_6e4ced79-902f-4770-e83a-88b5e6a453bb]: S. 106 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^M_I_da07269f-db52-4980-a0c1-b39b712f7b3a]: S. 107 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^M_I_7479f073-2b58-49f7-eead-ccd6b6136180]: S. 101 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^M_I_2abf9ee8-3f94-4177-c4bd-4daf3d65e5a3]: S. 97 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^M_I_c930fb6e-cfcd-4863-db90-daafa37940ab]: S. 98 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^M_I_fe20ae3a-ee70-40d2-93cd-0c62f663ac11]: S. 96 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^M_I_93990c54-c0ee-4ca7-f3a8-aea2cb642281]: S. 94 in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^M_I_c29ec2b5-23fc-42eb-ccc5-bd4e7c07653e]: S. 100 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^M_I_82b18c8b-cb16-4ad1-878c-8fd304610930]: S. 99 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^M_I_a37ef16d-2cd9-4e0f-e077-8c5d46152c20]: S. 95 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^M_I_7c1a4b6a-00b4-430b-d05d-c43749094035]: S. 92 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-d65cb3fcad9c8939122d0cbb34503a58]: Sch. 2 para. 25 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-0c751978e40386eae4052cb4130fea47]: Sch. 2 para. 20 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-9c101e97812e71a335520eb1c47a6ec6]: Sch. 2 para. 23 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-67f8177fb9af4ad26bb4c77960155a96]: Sch. 2 para. 21 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-7ccfab7aba2fe39c0b4ff439f2977e25]: Sch. 2 para. 24 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-26ded41f68d1f732b3865cc93e8d88fd]: Sch. 2 para. 19 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-5cb1fda1ca64fbdc787ce2cbaad14c5f]: Sch. 2 para. 18 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-7a8fc913f5df2ae9c65b684b305d36db]: Sch. 2 para. 22 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-3c2c46a40b01364a2f55ced34f0da62b]: Sch. 2 para. 17 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-1a7a05fc387b7e84dbf9b79775939593]: Sch. 2 para. 16 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_c3ecc2f3-1e54-4634-b1c6-9e30f80388ab]: Sch. 2 para. 10 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-da640f7e42c73ddf470ab5d98d90bf50]: Sch. 2 para. 7 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-e868e04485b48f84b758ff67c736c927]: Sch. 2 para. 6 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-7730d54842f8f87724cd20f0e96b45f9]: Sch. 2 para. 12 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-ea9d50e0b1e08135b83edb2cce36af85]: Sch. 2 para. 7 modified by S.I. 2007/1118, art. 5(1)(2) (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 324](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/324) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g))
[^key-76d8987f83cd23085268f88605eab012]: Sch. 2 para. 8 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-b67a57ad7f0934155bdc77e2a131f1fa]: Sch. 2 para. 7 modified by S.I. 1999/3145, art. 9(1)(2) (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 238](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/238) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g))
[^key-50a2425cd72f55451939e1ce6e996c28]: Sch. 2 para. 11 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-b62d921feb3097216f65a44384e7c28a]: Sch. 2 para. 7 modified by S.I. 1999/677, art. 7(1)(2) (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 237](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/237) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g))
[^key-a44536bac9a597320eab0a82eead9a1b]: Sch. 2 para. 9 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-d975bf9312ec73c1e21013621d4551b6]: Sch. 2 para. 14 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-9d92f7e2e56c743e71aeb2947d2c52d6]: Sch. 2 para. 13 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-4306e68c9bcde53b4480e1f50d20f060]: Sch. 2 para. 5 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-bf22d432153b349f92f7e7ffc7b19674]: Sch. 2 para. 1 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-15ad54b33e9a18e0de646bf81b983206]: Sch. 2 para. 4 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-28196368b63d10ff72b898a21cb24380]: Sch. 2 para. 3 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-b1e8e93d560c2becaa47fc4203fbab2f]: Sch. 2 para. 2 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-01e0b7c056d90098dda06c025884a600]: Sch. 1 para. 40 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-4f600a4a276f3ff129fe2e298c0337c3]: Sch. 1 para. 39 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-4eb5deb487f075bc565cf51e18a2d0f7]: Sch. 1 para. 41 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-9a443c5bd0f1d495d7eb959fe3c7dfdd]: Sch. 1 para. 38 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-048713be6754b1e793f21b40269622d9]: Sch. 1 para. 29 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-b50cc128cf93e81329e8f692740f94b8]: Sch. 1 para. 36 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-69f1f4e3df8cba86080a11e581cacbc7]: Sch. 1 para. 32 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-b809b11818db07b6251c81d14a36f7e5]: Sch. 1 para. 31 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-59da614434458460aa757b305cd350e7]: Sch. 1 para. 30 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-9b2171fdeed0aa91e80e081837891a4d]: Sch. 1 para. 33 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-1184aae7611f8dceba09b9e679d2f54c]: Sch. 1 para. 34 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-f3c33a1b55881622df1ea41ec30cb96c]: Sch. 1 para. 37 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-cd0fcadfa37c156db132b641258a55e0]: Sch. 1 para. 35 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-c0286c159abd916463bf0ef6a009374d]: [Sch. 1 para. 19](https://www.legislation.gov.uk/ukpga/2018/12/schedule/1/paragraph/19) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-710228ff8d8794d510393ca565e31582]: Sch. 1 para. 8 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-a6f29ae743c02d47e566e471ff2e85c0]: Sch. 1 para. 12 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-d1c4a5b8f04832edf2cb03e6ea265e7c]: Sch. 1 para. 17 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-c77367f91e1d7c046076b6ba11f17199]: Sch. 1 para. 22 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-5923789b39f2f85486d93c43d008a53e]: Sch. 1 para. 14 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-1622e2e636a8697beaac52d8c441e4ac]: Sch. 1 para. 20 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-d926ea66208808cf0ac6cd8080a79d94]: Sch. 1 para. 16 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-81deaf853b1516dd630825a728ac8038]: Sch. 1 para. 25 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-c6de1710ac870a50c6fae7c72c3e704e]: Sch. 1 para. 26 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-3cd4b21c486fb333c4f69a8f7f6ab0fa]: Sch. 1 para. 27 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-278bdb819fea7c369510f10a29ffbc41]: Sch. 1 para. 24 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-f13e34f57b68b2f3aa30277188bfcc15]: Sch. 1 para. 10 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-02fdb6fdb451c5d062bbc55d7023cc7b]: Sch. 1 para. 23 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-b01ad887f3d56c8021072a3f068fbcb6]: Sch. 1 para. 11 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-3d3c389152b7c8322a41c76aa2f421da]: Sch. 1 para. 15 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-b94b200a4666765f964f6b64e6e3d0b1]: Sch. 1 para. 13 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-a5f269dcf2171429f01e39e0cc667528]: Sch. 1 para. 28 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-43793f9ce196b4380bba69ea0333c340]: Sch. 1 para. 21 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-4d5bceecca89ad72be32168252e30a12]: Sch. 1 para. 18 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-3180f2fd1280321b20ee6e24d5d513cc]: Sch. 1 para. 9 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-c2ef1f00c16c6ae79e671982664ebcb6]: Sch. 1 para. 7 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-3e93ab39b36e0906482aa2864196a302]: Sch. 1 para. 6 modified by [S.I. 2007/1118](https://www.legislation.gov.uk/uksi/2007/1118), [art. 5(1)(2)](https://www.legislation.gov.uk/uksi/2007/1118/article/5/1/2) (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 324](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/324) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g))
[^key-476957a259953895973b48488fd85773]: Sch. 1 para. 6 modified by S.I. 1999/3145, art. 9(1)(2) (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 238](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/238) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g))
[^key-14ad0fde7b800982b4c427e3cb39df35]: Sch. 1 para. 6 modified by [S.I. 1999/677](https://www.legislation.gov.uk/uksi/1999/677), [art. 7(1)(2)](https://www.legislation.gov.uk/uksi/1999/677/article/7/1/2) (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 237](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/237) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g))
[^key-bdb76943ea02d98f95919369d09bb043]: Sch. 1 para. 6 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-8e7dfedb656f3087cc752ddd2b3b4127]: Sch. 1 para. 5 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-dffa9388dd0ef050a0bc9980aa1f03ca]: Sch. 1 para. 3 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-814a1f152d26e451009dbffda902ef68]: Sch. 20 para. 44 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-98672c153973b4c37fe47a5be90b157b]: Sch. 20 para. 11 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-411bc56475ba755c5cf8ff8876e096ba]: Sch. 20 para. 38 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b14dd74941113a22c1d268f51eb9660d]: Sch. 20 para. 39 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-31dcfda5dcd4e66221acf33abd97bf04]: Sch. 20 para. 23 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-2a3a6de533c8c12b0494351998aa1271]: Sch. 20 para. 24 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-0b089b6e1c9a68b042bfb7d6decabe4a]: Sch. 20 para. 48 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-d89a6ff40d1b9a78fe4c101979ac8c96]: Sch. 20 para. 7 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-8aa8998b53e72cee3848ea89a3f8efcf]: Sch. 20 para. 27 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-95ee23ccfabc5e4a2c7fa00670a15fe8]: Sch. 20 para. 8 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-411ec4dab5ca54d4b44cf574e5fc47d3]: Sch. 20 para. 20 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-cb60abcf455a1fb39b192e2fb65b8e33]: Sch. 20 para. 21 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5277e76770029ad12ef38864a40b6300]: Sch. 20 para. 31 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5652c80df7fd4845a3ee74d7a2a77128]: Sch. 20 para. 58 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9135d5f0ba7a938b8e0908d3b822308e]: Sch. 20 para. 22 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e966768c7106fe0dc55d7c693755813e]: Sch. 20 para. 4 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-8deea6ad2e1ca2aa03a2df3af2489d28]: Sch. 20 para. 6 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-f287d086a4e8e739fe2ef37b6accb6d4]: Sch. 20 para. 36 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-6edafa118087c70ee53b6f5cf47d4bbf]: Sch. 20 para. 51 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-df4d3f41a1a238306f55678d6a3b9c30]: Sch. 20 para. 32 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-21cd06c381ae74c2c93a120a10d0d395]: Sch. 20 para. 2 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-f97af0b42168a85cdcc3daab4547ff7f]: Sch. 20 para. 30 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-69fb4ce7e6a859ec749bbbf85915a53f]: Sch. 20 para. 29 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a1145e70e881abbcff0d5dc04ab6272b]: Sch. 20 para. 56 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-de215a81f0a30f77df6c9d7b3aa62a84]: Sch. 20 para. 55 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b2c1ac345b2156d511d9a5e0cc32de4b]: Sch. 20 para. 19 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5d2229549ab7a2313028e02954440336]: Sch. 20 para. 5 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-0e87ceeaeb473d5c9e0fc5a4ea92b025]: Sch. 20 para. 28 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-0ebeabb9baa1c3270129deaf8098cef1]: Sch. 20 para. 37 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b4a7bbe1aa38cf9a236d3e2b976a4b43]: Sch. 20 para. 26 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-83b4b960f436c0a11f244dc3d71d2274]: Sch. 20 para. 60 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-bf6f2f5cefba8471451edb23ada87197]: Sch. 20 para. 42 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-eb4cab607306f7c1339e70bed947d88d]: Sch. 20 para. 15 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-48999b8605d1ea3efd892b0c8e872954]: [Sch. 20 para. 50](https://www.legislation.gov.uk/ukpga/2018/12/schedule/20/paragraph/50) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-1264e02d2746f589dbb26a2216658f84]: [Sch. 20 para. 18](https://www.legislation.gov.uk/ukpga/2018/12/schedule/20/paragraph/18) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c6eabe9620a932c80ccb60c149f39305]: Sch. 20 para. 57 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4095aaa2b37901eb26e6c02f6c373ef3]: Sch. 20 para. 59 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ca55331b740b2f84383f97045a5d7b5c]: Sch. 20 para. 25 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9b02a9bec8375c167bc31a5bc6416f2e]: Sch. 20 para. 9 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-04deb533ed57e15add641215ed3efabf]: Sch. 20 para. 46 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4ef43de1fd3d22fa65d544c29721ca53]: Sch. 20 para. 54 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ba50110eb56a510d248a092ced92efea]: Sch. 20 para. 10 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-1366acd7f95a9c1e06161794880e0719]: Sch. 20 para. 35 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4d91ae4f070d013ae3a148fca0b63010]: Sch. 20 para. 47 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-75fa556cead4d7860cebbae93d9ce5ea]: [Sch. 20 para. 43](https://www.legislation.gov.uk/ukpga/2018/12/schedule/20/paragraph/43) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-1aeb023a0722a101af167f5207dc0988]: [Sch. 20 para. 1](https://www.legislation.gov.uk/ukpga/2018/12/schedule/20/paragraph/1) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4ea9d291c5c49ed73079c73322821531]: [Sch. 20 para. 14](https://www.legislation.gov.uk/ukpga/2018/12/schedule/20/paragraph/14) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-6b42cc6bc33aa71da55b1f1394b715ff]: Sch. 20 para. 33 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5a993e31296f76eedd2958f4cd0fda2d]: Sch. 20 para. 41 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-3f625eda300a4caa4b2537beb0425bcb]: Sch. 20 para. 13 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ea72ba67e1f77d2bc922e8cd029f82de]: Sch. 20 para. 52 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4ade17abe3f68bf256bff4f2dbb59e3d]: Sch. 20 para. 53 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ee309db6643b4037ea2a506821cd0818]: Sch. 20 para. 3 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a5d5816e42d277460429b755f59aaec5]: Sch. 20 para. 16 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-8536ab473caeb847327e2f5e6d40132d]: Sch. 20 para. 49 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-398509b660879f90723134aa1a29ea11]: Sch. 20 para. 45 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-f34b44dec21e9a4484c77b8fbc58e937]: Sch. 20 para. 40 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c950a89def036cb9e2d4a761b45c11a0]: Sch. 20 para. 61 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-f9ed19a4487f8b68c8c2886e208463fe]: Sch. 20 para. 17 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-92a2fbba444a2180ed2d6977278c2304]: Sch. 20 para. 12 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c47d8b667ae682e06b898703297fc17f]: Sch. 20 para. 34 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-0ad994e390ded3737e0cf452dcb87c1c]: [Sch. 19 para. 88](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/88) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-537ddaa4e08f232eeb349cab5d9e3a51]: [Sch. 19 para. 91](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/91) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b3795eef097c1a571dd91a5a58fbb545]: [Sch. 19 para. 397](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/397) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-1b4ccf50fa29ed8677a8eda0173f00f9]: [Sch. 19 para. 349](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/349) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-03d2f3e7999eedf91b3cf7abed68d4f9]: [Sch. 19 para. 289](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/289) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-39fe8a9769c33999f0f1fbca041c1c1b]: [Sch. 19 para. 27](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/27) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b38545fc0af14c07ceef9e17b64ca5eb]: [Sch. 19 para. 336](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/336) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-26277b73a6ec8bb86d52ca4da18c621d]: [Sch. 19 para. 149](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/149) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-dab72f344c2223ac494a5ec5e4725a5a]: [Sch. 19 para. 153](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/153) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-d3e6a542361c641611591efb60fe9e38]: [Sch. 19 para. 137](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/137) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e65c667068c961c23636d717a9fe31b9]: [Sch. 19 para. 168](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/168) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-7c6e6bf1f7eda1d129edeabdb0d2866a]: [Sch. 19 para. 316](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/316) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-dd8583cf6b3633e3cd4398106baef5a8]: [Sch. 19 para. 249](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/249) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-d0f66d6d5861f68ffafba417b3b6cd8d]: [Sch. 19 para. 233](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/233) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-d9e75b820dadd4eac2b1032ec6c6a4da]: [Sch. 19 para. 258](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/258) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-6d2b09b7c66ecf1a2e1d1430a2abf217]: [Sch. 19 para. 158](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/158) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-da5474989e672f513cfd5369bd8c73d9]: [Sch. 19 para. 41](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/41) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c3878a9352147db7dfa9f90c863bf7d5]: [Sch. 19 para. 79](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/79) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-bf995fccad30924b62ebc61e36091eea]: [Sch. 19 para. 52](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/52) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-d90ea73c93bcf268873fb7da4680904a]: [Sch. 19 para. 165](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/165) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ccd32dfe47587c5622c9eb7238443189]: [Sch. 19 para. 273](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/273) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-66b40fbe2726cd954a7c535fce560656]: [Sch. 19 para. 408](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/408) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-fd0c1206a5d534731177f0955c0cc52b]: [Sch. 19 para. 173](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/173) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-23f48e53190001650ee581d5ea78c872]: [Sch. 19 para. 304](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/304) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-f97a9a1810af918b554cccf9af5908b8]: [Sch. 19 para. 345](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/345) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-fdbc640373aa15e11b3c435f27bfb9a5]: [Sch. 19 para. 98](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/98) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-6685d554b3e7ed58b3b529c29432b778]: [Sch. 19 para. 128](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/128) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-073279dc56c10b95d4fc1174d2bb9002]: [Sch. 19 para. 344](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/344) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-f07eab9e4a9bf6d612d592a97af71a89]: [Sch. 19 para. 159](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/159) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a4b40f818ce15c1720d09e302bf3f262]: [Sch. 19 para. 263](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/263) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-cb3108a589d4abf7f4623f8e5fbdc4b6]: [Sch. 19 para. 185](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/185) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-04a116e5e2b279f99e07bb7fc9c120bd]: [Sch. 19 para. 69](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/69) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b067cdd42587d1724117cfb8de72ee09]: [Sch. 19 para. 350](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/350) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b1be5893ae060407bd875c20d32c3938]: [Sch. 19 para. 30](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/30) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-0bfd00907b511398d0520d55dda1857c]: [Sch. 19 para. 140](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/140) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-814a6ce67a6a96c8ae4c9adc8a3d0941]: [Sch. 19 para. 242](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/242) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-bfe88656543ff8d5238b037df8a8af1b]: [Sch. 19 para. 433](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/433) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-85568ff5ac8fb1d7859fa5d6150a01c8]: [Sch. 19 para. 327](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/327) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c8842a494d6ce371ae2b0bfd423daf8a]: [Sch. 19 para. 244](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/244) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5d060454d3ffbec772dcf30d85306332]: [Sch. 19 para. 82](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/82) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5caab894dc42fb6245859f88114c6ccf]: [Sch. 19 para. 60](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/60) in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-18c493f49d96ae6ccb3c8cced0fddc5d]: [Sch. 19 para. 421](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/421) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-f122f0c0c7045d69f3934a6b984c03c8]: [Sch. 19 para. 195](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/195) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-192b65f20b37cd2b1425d8b8099bd30c]: [Sch. 19 para. 427](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/427) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e4d19bddc6c0328454f09fd547393db8]: [Sch. 19 para. 268](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/268) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-1751702947b03f5d997effe7d3559e00]: [Sch. 19 para. 59](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/59) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5294d6d9aa82b0309648f5ec4d8160db]: [Sch. 19 para. 346](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/346) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-eb49132cb8ec05a9ceaa0e3d7c7c1ad1]: [Sch. 19 para. 177](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/177) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9327a9e51950d697f6ab1419608e7b34]: [Sch. 19 para. 351](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/351) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-11ce3e1bdc55c65611f28c3a935d263d]: [Sch. 19 para. 95](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/95) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-fa68fe591f625d4636e74746e74ef749]: [Sch. 19 para. 432](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/432) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c356bafc244fdc4ace9be54cbc58a2b8]: [Sch. 19 para. 220](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/220) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-7fd06888fb048ef993ef93ef456b6b5a]: [Sch. 19 para. 186](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/186) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-78821949ef2cd79dbfb3b1bc8aedb9e2]: [Sch. 19 para. 17](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/17) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-f372ec304285c90f7943306b4b88d34f]: [Sch. 19 para. 16](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/16) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-3133faf8febe41406d2f9f821f7ee0d1]: [Sch. 19 para. 143](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/143) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-3b189075aee602d5dd61a066dc8f918f]: [Sch. 19 para. 43](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/43) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-af0b63f67e273e6e110ffcb6b31502f4]: [Sch. 19 para. 148](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/148) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9f924437bee18db808d47091eedf71e4]: [Sch. 19 para. 213](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/213) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-1148dc6616b45f92ec3191558e2d7f41]: [Sch. 19 para. 353](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/353) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-63210b57744fbf08d2edb285a0cd5902]: [Sch. 19 para. 415](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/415) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-de7ac3b59d15240bff2525e5f4ee0096]: [Sch. 19 para. 218](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/218) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c9dd5c6539aaab7b9c7d8c2530ffbb16]: [Sch. 19 para. 187](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/187) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b0997f585eed7e7038937ae450f7de4f]: [Sch. 19 para. 199](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/199) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-86afa8b38318d38d9a1c0a277db14ba1]: [Sch. 19 para. 247](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/247) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4ed31dd55586adedeb9b02282604b867]: [Sch. 19 para. 93](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/93) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b93822e6be019e9b1da50e3d149d0512]: [Sch. 19 para. 314](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/314) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-30f8f37f3351a58e02d6f5b4850e8f6a]: [Sch. 19 para. 299](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/299) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-7285958890d3383878df626a9c90418f]: [Sch. 19 para. 291](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/291) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-055760fc82e5e2786df333ac02e415f3]: [Sch. 19 para. 297](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/297) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a625401585854a4edacab4ebf6ddb133]: [Sch. 19 para. 156](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/156) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c55ae1876443a0b2fefba9ec810b9025]: [Sch. 19 para. 109](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/109) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-dc40b789ba49496fa957bb0b48f33a2b]: [Sch. 19 para. 77](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/77) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-2a00008589acb6f36983567b9fc6e820]: [Sch. 19 para. 120](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/120) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9b9087b9158da4ffd811465a30b1f973]: [Sch. 19 para. 146](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/146) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a685afd8e1ad0bb3dd291dc18372de28]: [Sch. 19 para. 400](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/400) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-279763c8e56d8c1e5cf0701b35542316]: [Sch. 19 para. 78](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/78) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ef6461538bedabe292afcef4ceaeb7e6]: [Sch. 19 para. 284](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/284) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-28eb7957e80be04910aa9b6ac58baaf7]: [Sch. 19 para. 141](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/141) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-36402eee3cdb8da6d3cb1e50ca39070b]: [Sch. 19 para. 310](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/310) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-2fdc0f7c7c058ffa2465d97115f722c5]: [Sch. 19 para. 286](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/286) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5800b6be778d654fa3ae9164633a9dee]: [Sch. 19 para. 36](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/36) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-0275322d4c3e9338c7982248c59afa08]: [Sch. 19 para. 26](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/26) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b54c57bf05b376d8d1296b1b3073711a]: [Sch. 19 para. 9](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/9) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5f231bc059b057c3be3a8b858c1237d0]: [Sch. 19 para. 293](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/293) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-6428f542028b4356211b4b2be7c0f045]: [Sch. 19 para. 18](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/18) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-17a7230647a2583246524911d5578f98]: [Sch. 19 para. 403](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/403) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-104c707c6a01b69f5d71d71da7c75c6d]: [Sch. 19 para. 101](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/101) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-8b31548a22fdf2062e26812b3f8a4cd8]: [Sch. 19 para. 261](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/261) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-df310fa6ee2a3dff0c63be234a5da9cb]: [Sch. 19 para. 383](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/383) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4066d18d7abda68a6bfb1fb3a9c5d7f0]: [Sch. 19 para. 406](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/406) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g) (with [reg. 4](https://www.legislation.gov.uk/uksi/2018/625/regulation/4))
[^key-08f0dc8ee77a2e679c674a1653b65e89]: [Sch. 19 para. 44](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/44) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e19adfb1f3c5862f38fc50a0d9f8f97e]: [Sch. 19 para. 160](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/160) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b66bfe28770e7c763a748c72fa460f03]: [Sch. 19 para. 318](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/318) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-fb61e29e24493921fc39e369e4a42620]: [Sch. 19 para. 357](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/357) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-692a388eef2538c711e9de2ed9af16bc]: [Sch. 19 para. 152](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/152) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a94119cccf820588c348cc565b00173b]: [Sch. 19 para. 47](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/47) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4ebd65ab97e317d6c230a09c8743e730]: [Sch. 19 para. 226](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/226) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-15749221f368fbb105364a1b67ee891c]: [Sch. 19 para. 38](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/38) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-18239a18e3bd9a603de2281708e6151d]: [Sch. 19 para. 241](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/241) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-fc6a8eec58cbdca916769f66c1fcf95d]: [Sch. 19 para. 209](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/209) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-82e6d6ee170d0749ef39b3a4e333d6d6]: [Sch. 19 para. 235](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/235) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-fef37e8482c3f3bf900f2bc9a1255f17]: [Sch. 19 para. 74](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/74) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-60c010d25f11f1914bccbc6d06e219b9]: [Sch. 19 para. 359](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/359) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-57ceaf6d57e9fed63f3260667888e89b]: [Sch. 19 para. 429](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/429) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-7fb49ddb4c78e0617a283d46b8fd297a]: [Sch. 19 para. 360](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/360) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-27e1ea602a2a134d5052b4c1e8e3440c]: [Sch. 19 para. 413](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/413) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ea395bf42beb4786205aad06d93444ef]: [Sch. 19 para. 130](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/130) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-759e72068bf5cf175f5d6b8e09afd019]: [Sch. 19 para. 62](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/62) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c4aa80bf6800be1023988219c3bbbb5b]: [Sch. 19 para. 248](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/248) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-49c6c21a8f1c4f4ca1ccfff6d70d38c9]: [Sch. 19 para. 184](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/184) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e2cbe8e7c3f7b29a3482667eec7169ce]: [Sch. 19 para. 3](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/3) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-445f17fb666df6c1f9cf69c559a379b6]: [Sch. 19 para. 230](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/230) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-cfa904e383c8454f90dcaaceeb630997]: [Sch. 19 para. 54](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/54) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-2d89ded5d2f38b02918f66bf72aa9a67]: [Sch. 19 para. 34](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/34) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-0cd28f0f5d93804597b7bab43c86f5e2]: [Sch. 19 para. 401](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/401) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-8737925ef099c354b79a2dee4ef45379]: [Sch. 19 para. 144](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/144) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-8f1f87eac9c9e51e89136342ce6694ad]: [Sch. 19 para. 94](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/94) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-bd7353c4ff1428096418d9207dd0851a]: [Sch. 19 para. 75](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/75) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a3ce48c816fb2bf06559889b7357e5f6]: [Sch. 19 para. 330](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/330) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ccac30bcd9ef201935aa8d55dd2c7179]: [Sch. 19 para. 4](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/4) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ca96e304fa8efb2d21e87e6971b2da03]: [Sch. 19 para. 428](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/428) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-00432701eea2cde637ac5d287f4837c8]: [Sch. 19 para. 333](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/333) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ad561b17280fb2bb04693918a0e33719]: [Sch. 19 para. 194](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/194) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-f01cfdd076622c51d98828fe590750f4]: [Sch. 19 para. 73](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/73) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5596802d5ca5ee15d01f2a0e77ed94e9]: [Sch. 19 para. 236](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/236) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-1e98d97332c9829fa200bf50f75866b5]: [Sch. 19 para. 63](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/63) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-38b76457e1736087523fe425b9baf70a]: [Sch. 19 para. 371](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/371) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-cb9887b74f9ddbd87db8262dc983986d]: [Sch. 19 para. 89](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/89) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-479c0bc37322fff5ab05a964ed5802b3]: [Sch. 19 para. 162](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/162) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-90adc6d9082b6906eaaeb77d1ce53b7f]: [Sch. 19 para. 142](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/142) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a0b98661e146b804075a34298587c3ff]: [Sch. 19 para. 174](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/174) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a4aa35db6bea2e2d38df00cf0ecfb4af]: [Sch. 19 para. 282](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/282) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-dc44819fb13fa8e6ea18a61ad3fab776]: [Sch. 19 para. 276](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/276) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-bdca30164de5570a8928702ed862e347]: [Sch. 19 para. 256](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/256) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-2100b3196361a95d8557db2f9b70e820]: [Sch. 19 para. 381](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/381) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-83da7441fd879e24ad1e9bf9355724bc]: [Sch. 19 para. 189](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/189) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-88a3135321752bf6d4a55db7f2e0cf2f]: [Sch. 19 para. 352](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/352) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-dd2b3c609b732e6c74f06eac3ec5403a]: [Sch. 19 para. 387](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/387) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-63477ad6b0f04b0dec5c0e7403800ffa]: [Sch. 19 para. 108](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/108) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-619fd5f08f26b2ca35135ceac03355dc]: [Sch. 19 para. 197](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/197) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-21fced2ab0bcbddc5fc58b17d5e47dcf]: [Sch. 19 para. 287](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/287) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c088d98cf8145c1a34b102fd333f5481]: [Sch. 19 para. 113](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/113) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-6419b8d564dad36243ede4ccbdddf886]: [Sch. 19 para. 301](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/301) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-3381b8ddd4ef0abf6790266e0cb8ac00]: [Sch. 19 para. 228](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/228) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-7d8cce3dcb21f22fda7befab54189f3b]: [Sch. 19 para. 309](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/309) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-14aa686d4a0f1f82327479d58921ab37]: [Sch. 19 para. 331](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/331) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-1051e17c49a81d00262c51a04b7fce43]: [Sch. 19 para. 127](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/127) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-38c99db18cd5c194cee9495ce48403e8]: [Sch. 19 para. 223](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/223) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5f09a0ec7fe4d04e41a74ebc4ea7a57a]: [Sch. 19 para. 288](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/288) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9a96e2a08106565ada79467503826cb4]: [Sch. 19 para. 7](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/7) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-211221de3dc056053a4c24f48f61a5c6]: [Sch. 19 para. 110](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/110) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-019c61443b227cfc431617e576673df8]: [Sch. 19 para. 368](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/368) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c5ee47c63d27ac9ec02a5ee22620d081]: [Sch. 19 para. 170](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/170) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-6d54424c74ebcfa6482c38a597b6f8cd]: [Sch. 19 para. 417](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/417) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-7f611cef7c9785e78160c449fcd3cf59]: [Sch. 19 para. 166](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/166) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-02c9392ccbfe5d518f4e56dba15b087b]: [Sch. 19 para. 139](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/139) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e7ffa3e81bd3a810e9d34eb945cfc66c]: [Sch. 19 para. 163](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/163) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-2b2224275f44680ddca2bfd57fbc2416]: [Sch. 19 para. 250](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/250) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b448f0542b76286bd7b6f08b1eba41a2]: [Sch. 19 para. 332](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/332) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b19644c907c1538c9f4a2b6db6529dea]: [Sch. 19 para. 274](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/274) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-d389ab58efdc2e62d3686cf163bc479c]: [Sch. 19 para. 296](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/296) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-7e5daf372d0ee7c8c9274a054f9d68a4]: [Sch. 19 para. 229](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/229) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-0447af8ae299a204a2630922dc53e872]: [Sch. 19 para. 270](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/270) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-8fee20a32a0c94dd1be0c59c92f7d22d]: [Sch. 19 para. 28](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/28) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-608b2f9cf0fe71bd575fc86bce176a4f]: [Sch. 19 para. 361](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/361) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-cc268dff7489493500857e0da3d30cf8]: [Sch. 19 para. 281](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/281) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-0ee3310713d1629ddd39380fe64cbd00]: [Sch. 19 para. 42](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/42) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-dfd4e8a4ee7d2bdd2b63992d585ea975]: [Sch. 19 para. 234](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/234) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-d28d939c5b88e9d83db1ae875c3e2f99]: [Sch. 19 para. 35](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/35) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-82b2319cae98bf9d18d415b5900b1b8d]: [Sch. 19 para. 83](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/83) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-783664aa6922d312a1494de208ee446e]: [Sch. 19 para. 57](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/57) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9191ac97c4be79c02fb2a00b6516f9c4]: [Sch. 19 para. 356](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/356) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-92a1d6beec195a72e4c0ded237db7052]: [Sch. 19 para. 322](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/322) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-979aacc7d31ac8899ef8e697205ff797]: [Sch. 19 para. 382](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/382) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5f28dceb83a8870e7b45bbab2176be18]: [Sch. 19 para. 254](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/254) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a5eeff55dde4d6b88a20de1eb7c39000]: [Sch. 19 para. 378](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/378) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e1adfd83503e23bb12c37b264f983157]: [Sch. 19 para. 430](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/430) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-6b3dd5366b8aa656104793ad8fbda6d1]: [Sch. 19 para. 178](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/178) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9acb6d4351d4656b387adbd902b93e6e]: [Sch. 19 para. 39](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/39) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9ab84fd20d8959180ad4f38e2b805461]: [Sch. 19 para. 25](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/25) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-0e22a095e41e8693fa7318f4c45ed9e9]: [Sch. 19 para. 19](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/19) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-31302a37f9c6f4ae81079d8a479c0dc1]: [Sch. 19 para. 169](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/169) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c928d8c9711cfedfaf94e5e46642337c]: [Sch. 19 para. 292](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/292) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-d8543783ecce9fc324879502be7a7702]: [Sch. 19 para. 398](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/398) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-0ca2154432d523e9349716a80c0650a7]: [Sch. 19 para. 222](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/222) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-24b3bbdc5e59d705d0210a6f74674451]: [Sch. 19 para. 33](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/33) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-22e89107ecf415c850b5a6f0b9b59302]: [Sch. 19 para. 232](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/232) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-707883b75ea25f6b0172d7b5ee3087c2]: [Sch. 19 para. 414](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/414) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4b9e6d497580985481a70ac53ffb3760]: [Sch. 19 para. 71](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/71) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-7e1a7fbb2a9c83863114daca737a02ce]: [Sch. 19 para. 133](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/133) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-09ad4c27f1d1f5107104ceb3233831b0]: [Sch. 19 para. 104](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/104) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-d7f3b3ea581183119f32ef174c1446a7]: [Sch. 19 para. 396](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/396) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e62033720942b217198c1dfe98c8e731]: [Sch. 19 para. 347](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/347) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-2acdeca126a2ebe1ce6a4586947c1173]: [Sch. 19 para. 306](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/306) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-bf35de83a0f437b87a9cef54c610a040]: [Sch. 19 para. 172](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/172) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-92d6e74f37be3e97e68bdee8fdc6cda3]: [Sch. 19 para. 319](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/319) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-1b3210620a45e848232ab9e47619a0b4]: [Sch. 19 para. 134](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/134) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-0876256c5ad3d60e361b782c4058e808]: [Sch. 19 para. 224](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/224) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-8ad456033e37cf5339189b447f441ea7]: [Sch. 19 para. 238](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/238) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-6d4f96ed12c59e68bdff321d38d2d21f]: [Sch. 19 para. 90](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/90) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-f2e7bbf27eee985d9a2bb76f58d3deb1]: [Sch. 19 para. 219](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/219) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-d50b2691f5d850d9368511bef6e62dee]: [Sch. 19 para. 321](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/321) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-49b5b8891d09db8683757e7b32a72562]: [Sch. 19 para. 1](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/1) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-2bae9f70ba5cbd2b51246898aabb15e1]: [Sch. 19 para. 376](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/376) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a8f58512cb57f396c3a6b2d0a2120804]: [Sch. 19 para. 179](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/179) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-536ca137c3e35cd31b66970c3841bf62]: [Sch. 19 para. 392](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/392) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-213b489d8cd0817f932abf8b31c43adb]: [Sch. 19 para. 2](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/2) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-78db76102146a4973fbe100f48e3ab2d]: [Sch. 19 para. 422](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/422) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-bd4de8f85f3e7210b241c119815eb03b]: [Sch. 19 para. 125](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/125) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-31415131204b8cc0dde6edf55660411f]: [Sch. 19 para. 46](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/46) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4fdda46f1a69130f122c5704602c094d]: [Sch. 19 para. 379](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/379) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c68c32f2f423229e644dabde516e73e8]: [Sch. 19 para. 92](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/92) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4e053f303d63b7b74a499c4480735616]: [Sch. 19 para. 409](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/409) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-20637b6951bd30d789aabe29602a4eb2]: [Sch. 19 para. 97](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/97) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-d2fd9c6100b620310997d76d277b9f80]: [Sch. 19 para. 99](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/99) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b8bb776d4ce7a80859a0cd4e072721de]: [Sch. 19 para. 72](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/72) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5e45ce56358543510889bcd1e8168c6a]: [Sch. 19 para. 67](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/67) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-72d1e7bc8a1a8cdb24823c5c186808fa]: [Sch. 19 para. 364](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/364) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e99403db3867a4daaebe4da8128b05b5]: [Sch. 19 para. 369](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/369) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b477b7ab6ad0e09aca8432fb6d5825ec]: [Sch. 19 para. 181](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/181) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-df726e993c279c8b9f39a174ac48a970]: [Sch. 19 para. 56](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/56) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-d3c84fd6416aecc51ba5440265479cbe]: [Sch. 19 para. 365](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/365) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-262a153ed6a3f20ecbab0d2e9c49834e]: [Sch. 19 para. 405](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/405) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-75e47e526bd371fad97da14f5ce0b720]: [Sch. 19 para. 426](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/426) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ae7474f0c3ecc17e0da102de1e22069d]: [Sch. 19 para. 337](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/337) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-be21e957c0ac10ddafc37dd24c11484d]: [Sch. 19 para. 105](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/105) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-45472bbd00a393b549f1e72fd153ac3f]: [Sch. 19 para. 119](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/119) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-0c925c155f884ff322d1f06c0cf09a74]: [Sch. 19 para. 239](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/239) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-d7f2eb02ca7f034aafd56f74b579aba9]: [Sch. 19 para. 161](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/161) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-562d08cd2dcb5be04009f471b7f9552f]: [Sch. 19 para. 200](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/200) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-cf7b12fa6e29df3664f564217fb41aec]: [Sch. 19 para. 320](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/320) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a63390fc5b556409349772fb7f0ec1d4]: [Sch. 19 para. 145](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/145) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5b3acd4e0294355b8e9efe356efa7aa4]: [Sch. 19 para. 272](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/272) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-2e016290a3bce07321b5932b8b9442cb]: [Sch. 19 para. 10](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/10) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-11c07ee11f2167bbb1763bd246448e85]: [Sch. 19 para. 217](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/217) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-7bccbbbdba88ddb2e2eba7451840f2a4]: [Sch. 19 para. 386](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/386) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-22a9c9e8dbf86322bdf3b841fb939851]: [Sch. 19 para. 122](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/122) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-37cacf20bf249c74413aada2c52be2c5]: [Sch. 19 para. 325](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/325) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-18c04c183259e8b8dda524fe72d1db0a]: [Sch. 19 para. 328](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/328) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-34fe6f107e4f7bc7983506ee6a91cf35]: [Sch. 19 para. 434](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/434) in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-d035aebb324ef6e0087dfa27a2360edd]: [Sch. 19 para. 394](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/394) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-2df4d20a1557bfe80bf3be5e338ab1e3]: [Sch. 19 para. 87](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/87) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-187011edc25500f0e9ac9f2a1b42e1b3]: [Sch. 19 para. 180](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/180) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b85964a87061e13a255bedfd6fa9b9c3]: [Sch. 19 para. 278](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/278) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-281d4e6540db13c15fe85d6b8cfcaa7f]: [Sch. 19 para. 205](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/205) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-028cd06e6f950f4558cd72890b7ed743]: [Sch. 19 para. 257](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/257) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-6ff2d0b34df3416330022d509ad57eb3]: [Sch. 19 para. 338](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/338) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-89ae400598f2d597e634bb358b6bd862]: [Sch. 19 para. 53](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/53) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9f5c56edc1342d98195ad1b32fab06cb]: [Sch. 19 para. 8](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/8) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9554afd386ff1a76b263966b60fc1907]: [Sch. 19 para. 132](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/132) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e22a317e4dc955876132ce146811edf9]: [Sch. 19 para. 340](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/340) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4cf3e7d466f11b7e40ea1d651a44da91]: [Sch. 19 para. 277](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/277) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-8be42a9b4ca72b465ef3e53b07fce39f]: [Sch. 19 para. 343](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/343) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-7d89094841f817acd1c11f3f6eb706bd]: [Sch. 19 para. 107](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/107) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-acd9c1db11c3f2dc87e850a09432977c]: [Sch. 19 para. 390](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/390) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ebc3859cb98a52a9be07b9734f108537]: [Sch. 19 para. 407](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/407) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-435242e13aafe834143b8d1833684521]: [Sch. 19 para. 425](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/425) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-16c6bec2c0f932b75e6e897d0d0214e1]: [Sch. 19 para. 300](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/300) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-35558747b8c46c8ff03f147f0a7482a4]: [Sch. 19 para. 341](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/341) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ee8d24ff7579d381bcf3447e849bb137]: [Sch. 19 para. 303](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/303) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-357515c65e8f9ab1a677364595663442]: [Sch. 19 para. 395](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/395) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-712146671e659734df04e3c276c8a6ec]: [Sch. 19 para. 175](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/175) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-32f6f942b277dbd276b96d5b0984e118]: [Sch. 19 para. 157](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/157) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-26e02e31432cdbfaad7525568f904f96]: [Sch. 19 para. 280](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/280) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-547275c503d1622ed745a1844aa3c05c]: [Sch. 19 para. 231](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/231) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-541c32cbb194df275a3b189f928f6db1]: [Sch. 19 para. 21](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/21) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-65f6cf7df6085a9cdaea6d8c8baf70c3]: [Sch. 19 para. 420](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/420) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-700cdd34340327bf52d7691ef5189d8f]: [Sch. 19 para. 22](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/22) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-1ee641f3c321f91dfed1e82cc0461f56]: [Sch. 19 para. 135](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/135) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-bef50065785b938e25237c6aa68a6597]: [Sch. 19 para. 285](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/285) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-7c87c5571d73717e0f69793bd63591ac]: [Sch. 19 para. 81](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/81) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-da4d8d7b0fe43481acfe3f79e34c5771]: [Sch. 19 para. 188](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/188) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-2626514eaa370e042778c491444aee9c]: [Sch. 19 para. 11](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/11) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e51209f96eafbb1ab258e63be1650a81]: [Sch. 19 para. 136](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/136) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c1d3f43f097f9a6407e04871a09dba04]: [Sch. 19 para. 335](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/335) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-cc7111f2b8b984b394cb92bb7c3a96cd]: [Sch. 19 para. 58](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/58) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-aa6af2689d3c8dbcfd3393c5949edec1]: [Sch. 19 para. 410](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/410) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e72064e13dd75d5efe7864fb56a44ab9]: [Sch. 19 para. 298](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/298) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c2993c748626851ac752a159c968c2f3]: [Sch. 19 para. 68](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/68) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9d710e651e6d63fff04c93e4807f2c24]: [Sch. 19 para. 100](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/100) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-3327a481d30c9bdff556a8b76ded69cb]: [Sch. 19 para. 123](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/123) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-071d1dd7492c1a08829b1e12514d44f6]: [Sch. 19 para. 393](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/393) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c2ac2fbd7eae86c3237b0fea08970942]: [Sch. 19 para. 147](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/147) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-296a24e4c876580d5b86d4ca2becc824]: [Sch. 19 para. 151](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/151) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-33106c6218135aa1517b7c246074feb9]: [Sch. 19 para. 6](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/6) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-678a3382174b5eef118f049a8e0135a3]: [Sch. 19 para. 154](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/154) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-efe014bf4df1ec9b8d35acaeae8ff3e1]: [Sch. 19 para. 431](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/431) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a2536056f71e77d12ec0552af9cdb0ae]: [Sch. 19 para. 14](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/14) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-8665babc9bd153c4dbd66185ba2f8336]: [Sch. 19 para. 372](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/372) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-64534ca8115b4440f659353e7c70f148]: [Sch. 19 para. 391](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/391) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-af704cdbd7c856f0edbefe85c657cb92]: [Sch. 19 para. 24](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/24) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c1385fd85cc9aa1ac18e428d1255229e]: [Sch. 19 para. 208](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/208) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9e24f8af50209b0af1b4ff26a0525e0e]: [Sch. 19 para. 279](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/279) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-6770db32f81e36acabebbe3e140fc8b9]: [Sch. 19 para. 15](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/15) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e75907eba429315009a11c3d22ff06fd]: [Sch. 19 para. 202](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/202) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9a7c2d42c9b42f2c440d1a7e097379dc]: [Sch. 19 para. 5](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/5) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ae62c8e2190203abcf6e1d2577cb264d]: [Sch. 19 para. 37](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/37) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ab92c540c3a132992c2519ccffece33d]: [Sch. 19 para. 216](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/216) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-35344b59ed8359babcc5cd6308a3eb8d]: [Sch. 19 para. 66](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/66) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-580c2e8451662cbcb05f7efdbd413557]: [Sch. 19 para. 311](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/311) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-83378423b48f16d54ba90d2ae9044d24]: [Sch. 19 para. 129](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/129) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-dd757ab40e97ddf846173abfa98de010]: [Sch. 19 para. 70](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/70) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b590a9087442280960754e373c622ce8]: [Sch. 19 para. 373](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/373) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a68e38da2bdfa2ea3680d54d36ce44b5]: [Sch. 19 para. 419](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/419) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-7d8bb035bbc8f61fa799d1e1688f3235]: [Sch. 19 para. 255](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/255) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4bf0023fc0abe3a6fe28e97ae0db6c8a]: [Sch. 19 para. 96](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/96) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a623e2942e804444c750d65ec618366c]: [Sch. 19 para. 402](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/402) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-deebf9ef3b2556d2b0b7321f2152e6b2]: [Sch. 19 para. 315](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/315) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-54ed69a52979c0101f95691b880e8d86]: [Sch. 19 para. 114](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/114) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-075130ba76e3c3f27cf76df70ec522b8]: [Sch. 19 para. 204](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/204) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-6a4270838a15ea82cab691dc84af38d8]: [Sch. 19 para. 348](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/348) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-2c7e00ac1f688e12ca2bcc445e3ef4a8]: [Sch. 19 para. 192](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/192) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-25346aaf6bc9db597d7da83585c8bc2f]: [Sch. 19 para. 118](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/118) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9fd4ec495d0150d2a876611d7d18844f]: [Sch. 19 para. 85](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/85) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-98fa005db175e358483a9c7e427babf0]: [Sch. 19 para. 29](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/29) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-eecbeef6e50cfe3fc02d1b95f68648e7]: [Sch. 19 para. 86](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/86) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e4afbc3f11ae48f0f055c87060290428]: [Sch. 19 para. 385](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/385) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a59f8dde3068bf877b888306045bdfab]: [Sch. 19 para. 424](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/424) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a6ea8b0e80d6677a025f42dbe552b801]: [Sch. 19 para. 171](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/171) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-70a8bfc934b51491b5e05c60a48c0fcd]: [Sch. 19 para. 124](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/124) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-acb0285e2b1938c540581efba74d8844]: [Sch. 19 para. 367](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/367) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-6c97145e9bea286f39b3cebee1e809b4]: [Sch. 19 para. 138](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/138) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-6c11b02f4cf2412155ba5dd487de5f5d]: [Sch. 19 para. 271](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/271) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-f251ec0fb7d1f9d415237244a6167b7b]: [Sch. 19 para. 237](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/237) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b1fceaf86c42fac53cc007de0358f87e]: [Sch. 19 para. 251](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/251) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-2e0041ef43a73fe0769dd148a0a2f935]: [Sch. 19 para. 411](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/411) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-413d7a05865475abd36b30f3fc486102]: [Sch. 19 para. 45](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/45) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-d30e265bd0e7290a2fd7d7064c8670b8]: [Sch. 19 para. 262](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/262) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-984b46e4d04043311d1864dca246bc02]: [Sch. 19 para. 150](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/150) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-cdf6ef8adaf644a19027e1ed1cdb2254]: [Sch. 19 para. 355](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/355) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-51071121f70681b71cab6d579e3ad89a]: [Sch. 19 para. 61](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/61) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-86c0f2e4ef516da39d4241866b656e32]: [Sch. 19 para. 65](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/65) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-de38b60ee34fb320e926b3a6a4bfa2b2]: [Sch. 19 para. 183](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/183) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-fd0986f7738e6fad0a16aeb00a034882]: [Sch. 19 para. 155](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/155) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-6758384614c1ad6fc83cce92f7ba1fb5]: [Sch. 19 para. 370](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/370) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ff63110f11b2b9882390f31a36181e9a]: [Sch. 19 para. 80](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/80) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-61adeb92f11f45e0ec84df45e73f76e0]: [Sch. 19 para. 126](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/126) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b6fec47aa194969dfe8a3a6fea4187d8]: [Sch. 19 para. 64](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/64) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b6ee800cbbca868e5b81fc389982dfb8]: [Sch. 19 para. 225](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/225) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-1a7305813bab945662593ecbbd86a3cc]: [Sch. 19 para. 267](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/267) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ddb24038c52777eed313664ed44d18e8]: [Sch. 19 para. 212](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/212) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-652e061bb56fb9b4f220ffae3d0a3b7c]: [Sch. 19 para. 259](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/259) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9415718b0fd9928accda1024defbb8f1]: [Sch. 19 para. 246](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/246) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ebbf8e6619bc3e211728d99978469935]: [Sch. 19 para. 326](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/326) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5fdefaa38a586680a2225de272d78a95]: [Sch. 19 para. 164](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/164) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-3a7f17dddd435cdc7527fdbd1c2a1015]: [Sch. 19 para. 215](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/215) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-54ccbd5063e3754088932793be4ce0f9]: [Sch. 19 para. 264](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/264) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-2b9b3d8589286b3b26ca6b92d1868c01]: [Sch. 19 para. 404](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/404) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9752e1069ab46baa7cce26833ac60d44]: [Sch. 19 para. 117](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/117) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-be1bf0983596986c0b786e77ad4ce52e]: [Sch. 19 para. 275](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/275) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-faa82338427aa33729b4502a5d841e1d]: [Sch. 19 para. 266](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/266) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-73e6fdaac8c2a2ceb6b3e1ac469fcfb7]: [Sch. 19 para. 245](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/245) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c4616ae590a3753a8f2fa526f5ab1598]: [Sch. 19 para. 412](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/412) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a00ae0d976446db156c56d104bf8a46d]: [Sch. 19 para. 221](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/221) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-23171ba5132253c85a145de87e1054c5]: [Sch. 19 para. 207](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/207) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a108ccc8090ee178d30cecfaf943e5e8]: [Sch. 19 para. 20](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/20) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4974e4683c63a2295b4c8e367be9b4bd]: [Sch. 19 para. 384](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/384) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-cfd00f9390a56e61349aa5a1f9a1ffa9]: [Sch. 19 para. 240](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/240) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-1fb38bce83de1fe5b681b8cdde5ff129]: [Sch. 19 para. 111](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/111) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-98f916de1fd0822bc276904898d720c5]: [Sch. 19 para. 312](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/312) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-f9e750f4945678cf8a4558a867d56cf2]: [Sch. 19 para. 389](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/389) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-12f86fac951fc73c0140d571a31e9292]: [Sch. 19 para. 210](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/210) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-be0e43ced31d335546a8059944d317db]: [Sch. 19 para. 50](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/50) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-2d48534b027b25a30a2b80c2a510dd6b]: [Sch. 19 para. 243](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/243) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-0c2efecad359220e6a37b89dba30fb47]: [Sch. 19 para. 334](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/334) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-d00de55d7e460f218dbfdfc1cc28e86a]: [Sch. 19 para. 84](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/84) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-11e7c66b8939b2e6758255eed50c6b54]: [Sch. 19 para. 305](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/305) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-8293f14cb956099346b10c81f37389f6]: [Sch. 19 para. 206](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/206) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-fe184c23ee47121bd5d9ccc551211b0c]: [Sch. 19 para. 191](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/191) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-91f7b5de6c9148c918065d61457bce4a]: [Sch. 19 para. 418](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/418) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-6fe4bc9b35fbbeee514f5574560f3e08]: [Sch. 19 para. 203](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/203) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-403f2e7140850b3e5a4883ebe1dfba4a]: [Sch. 19 para. 40](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/40) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-3ab92aa41a35b7fca7dfb7bb9e94ab09]: [Sch. 19 para. 176](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/176) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-3c0bda84559a635149b77d2604f5e78b]: [Sch. 19 para. 308](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/308) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-55f19b5dfeae5274c86b20d257ee5abf]: [Sch. 19 para. 324](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/324) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-3f98c0a7a2654c2ef537f15b5f7eb22f]: [Sch. 19 para. 423](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/423) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-69b650c8b8cd0a9f9c00303439bac5ac]: [Sch. 19 para. 377](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/377) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-f1ea12c4ad88d4f388ce1587dd4bb8fa]: [Sch. 19 para. 116](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/116) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-0ec738b14348d17f3e62b70513465a13]: [Sch. 19 para. 55](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/55) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-7477a257b589b1a659d9da8bb1f814ee]: [Sch. 19 para. 260](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/260) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-8eacd628fdb59503091436d5cc4e3698]: [Sch. 19 para. 380](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/380) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-03be80b9d01d85e387feb8f4beaf6d2f]: [Sch. 19 para. 32](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/32) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4d956270edecbf7135abf8cbbd045529]: [Sch. 19 para. 399](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/399) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-3369d46a2dc6feb2b919520a08308048]: [Sch. 19 para. 103](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/103) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e1a399ea8db8f0e966700b51a7708047]: [Sch. 19 para. 265](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/265) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ef34a89ba28c172143123866dc86ac69]: [Sch. 19 para. 307](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/307) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-39a16e9f2a37e4b260ddb9752a4bc3ad]: [Sch. 19 para. 363](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/363) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-18a50fc05df7fa3cf98132d81799b519]: [Sch. 19 para. 196](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/196) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-8378189986c623d4592091758ed051d5]: [Sch. 19 para. 362](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/362) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c444d824a5b6f20e42cd95b28ec028cb]: [Sch. 19 para. 13](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/13) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-592385c2bfb47df43a31d621a3e907ca]: [Sch. 19 para. 253](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/253) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-17124b67fbec472842be06ef4430da1f]: [Sch. 19 para. 416](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/416) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-df76da218b4fc287b7df92688b5b906a]: [Sch. 19 para. 115](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/115) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-35c840436ea427bbc6b05f90d6e943f1]: [Sch. 19 para. 131](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/131) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-40ea538764fb252a2c1885eea6cf2028]: [Sch. 19 para. 290](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/290) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-1d18615dcf9a20c1820111b3a81f31c2]: [Sch. 19 para. 302](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/302) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4fabde886f7f8ff4ffdec98db5a5a329]: [Sch. 19 para. 317](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/317) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-51e5c70be67119667b759e829b6ec310]: [Sch. 19 para. 342](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/342) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a3e5b77cf0824d21fde09cd713fdccb5]: [Sch. 19 para. 190](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/190) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9b5992e47d071cdf4bc62d00218e439f]: [Sch. 19 para. 193](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/193) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e89782710f07812828650321cc604aa4]: [Sch. 19 para. 358](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/358) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-f13bf41e503097cc8d4107dadef0c470]: [Sch. 19 para. 375](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/375) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-6545233b44f61feb3cdd2c63700b450b]: [Sch. 19 para. 388](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/388) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-77ee27866c6c95ed5687861f463894f2]: [Sch. 19 para. 366](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/366) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5f4247df5bc97fcbb47d705dd5c5d78d]: [Sch. 19 para. 295](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/295) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-265056c26b76a20e1dbc856fb69e9468]: [Sch. 19 para. 121](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/121) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-422675a4f99ccd66679390d411532525]: [Sch. 19 para. 102](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/102) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-f106395db15e7bf5a355770eae3d3f6a]: [Sch. 19 para. 329](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/329) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c56e46dc215f18e71b09f349196ffd4c]: [Sch. 19 para. 31](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/31) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-15470efb9363c5548c4b065c183e0df8]: [Sch. 19 para. 214](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/214) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-edf909958009b94eaba7a07f5cb7d3ab]: [Sch. 19 para. 374](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/374) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-0d271530c429f861f97bd026d99487d6]: [Sch. 19 para. 48](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/48) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-43046246cf3f27e7ff102d3f13a65766]: [Sch. 19 para. 252](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/252) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-8f06068680301e2c3ed98acf8976fc95]: [Sch. 19 para. 167](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/167) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-80aece53fcb0b6da0c128b207cec4326]: [Sch. 19 para. 51](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/51) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e81956df0d06f6110c0b4ac40cb98a27]: [Sch. 19 para. 269](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/269) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-72cb372c18446331d54d7581b2844122]: [Sch. 19 para. 283](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/283) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ea6f11d03e5cf9bb39766c30d73c6169]: [Sch. 19 para. 23](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/23) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9807634b4b75f4054b7300d638b00f9f]: [Sch. 19 para. 323](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/323) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5161df839eddc2224f1ac8381d920e73]: [Sch. 19 para. 294](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/294) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-fde9fcf105d0042f1bda9820bf84606a]: [Sch. 19 para. 112](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/112) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9a7f415b585bcfbceb5337eb67913880]: [Sch. 19 para. 354](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/354) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-8bd408574505811db2c82cae1b36a826]: [Sch. 19 para. 198](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/198) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-fb676c41b528ba898415453b8d0f7a90]: [Sch. 19 para. 182](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/182) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-456760319c42feac9a7898e5f44b1b19]: [Sch. 19 para. 12](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/12) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-1e29eba27e76c7408aaff2905df122df]: [Sch. 19 para. 313](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/313) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b00c0f26a2d6a3755a47ccea8a91b596]: [Sch. 19 para. 339](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/339) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-27acdc78f2593bdf3b923e0a174dcec0]: [Sch. 19 para. 106](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/106) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-54086af838f352beb57ce9315250ba27]: Sch. 18 para. 1 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-3f0ea1f9d567c045eda245c4dee09ce8]: Sch. 18 para. 5 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9fc9c1129257b84bdefd9d4c3e56e706]: [Sch. 18 para. 4](https://www.legislation.gov.uk/ukpga/2018/12/schedule/18/paragraph/4) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-773e7ccae10930819162576c11ead096]: Sch. 18 para. 3 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5fc36683a14c05bd90165c9828617de2]: Sch. 18 para. 6 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-7e5af03968fdea50821c2a9e04d4cb7f]: Sch. 18 para. 2 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^M_I_6b25091d-f95a-49dc-af77-daa527fdefdc]: Sch. 17 para. 2 in force at 23.7.2018, see [s. 212(3)(d)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/3/d)
[^M_I_b309e3cd-87fd-499e-e10a-8fcbdb13e144]: Sch. 17 para. 3 in force at 23.7.2018, see [s. 212(3)(d)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/3/d)
[^M_I_57447cf7-8ba0-44f8-cfaa-e84f882e8cb3]: Sch. 17 para. 4 in force at 23.7.2018, see [s. 212(3)(d)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/3/d)
[^M_I_567c4630-0496-412d-a23f-202d19bddefa]: Sch. 17 para. 1 in force at 23.7.2018, see [s. 212(3)(d)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/3/d)
[^key-0c64f94808e62ce8c06e20ffbc5b1116]: [Sch. 16 para. 4](https://www.legislation.gov.uk/ukpga/2018/12/schedule/16/paragraph/4) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-235e6b33584803340fe72ec9d6854d43]: [Sch. 16 para. 3](https://www.legislation.gov.uk/ukpga/2018/12/schedule/16/paragraph/3) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-642964559e6e98411f41113d5d311b98]: [Sch. 16 para. 6](https://www.legislation.gov.uk/ukpga/2018/12/schedule/16/paragraph/6) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-b9fb3ca41d32a811b10aaa5281713ab0]: [Sch. 16 para. 7](https://www.legislation.gov.uk/ukpga/2018/12/schedule/16/paragraph/7) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-f96988967581766c70c8c1dec2b2775e]: [Sch. 16 para. 8](https://www.legislation.gov.uk/ukpga/2018/12/schedule/16/paragraph/8) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-0d28ce61d602ad2e767e31293c260e43]: [Sch. 16](https://www.legislation.gov.uk/ukpga/2018/12/schedule/16) applied (with modifications) by [S.I. 2016/696](https://www.legislation.gov.uk/uksi/2016/696), [Sch. 2](https://www.legislation.gov.uk/uksi/2016/696/schedule/2) (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 406](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/406) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g) (with [reg. 4](https://www.legislation.gov.uk/uksi/2018/625/regulation/4)))
[^key-b0db01543b0050f576c5393cc63112bd]: [Sch. 16 para. 2](https://www.legislation.gov.uk/ukpga/2018/12/schedule/16/paragraph/2) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-9898e0a5f30638665e4860f70c0daca0]: [Sch. 16 para. 1](https://www.legislation.gov.uk/ukpga/2018/12/schedule/16/paragraph/1) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-88c6eca9edbc9735a9c60756508aaa04]: [Sch. 16 para. 9](https://www.legislation.gov.uk/ukpga/2018/12/schedule/16/paragraph/9) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-f61b1c41d1ef400486d9a7c32e3ef26b]: [Sch. 16 para. 5](https://www.legislation.gov.uk/ukpga/2018/12/schedule/16/paragraph/5) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-efefe38304f75aba67a62c87caf4f25e]: [Sch. 15 para. 17](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/17) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-2f0e9d2ad7758b3d8eeaabe264498df0]: [Sch. 15 para. 11](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/11) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-c546bf86c8f31d0e9c29c51ed58b7835]: [Sch. 15 para. 19](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/19) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-4dd14d64a5ac75aa8ddd3bd00ead5989]: [Sch. 15 para. 9](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/9) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-22d803690c292d06381ab7cc715f03f9]: [Sch. 15 para. 6](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/6) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-ef69a37372aa6c408b351020173dbdf9]: [Sch. 15 para. 4](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/4) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-29e6a8adebc12062d8e7bbdbb4f20243]: [Sch. 15 para. 2](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/2) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-703e2e342cfcb4603846990fa8e2b775]: [Sch. 15 para. 7](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/7) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-265015252b5915c275c3cce0e5a160d7]: [Sch. 15](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15) applied (with modifications) by [S.I. 2016/696](https://www.legislation.gov.uk/uksi/2016/696), [Sch. 2](https://www.legislation.gov.uk/uksi/2016/696/schedule/2) (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 406](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/406) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g) (with [reg. 4](https://www.legislation.gov.uk/uksi/2018/625/regulation/4)))
[^key-71991999d3f30393eac1b24ed8828c51]: [Sch. 15 para. 12](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/12) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-6301e98c2aa45525d7a62b4737ed9b86]: [Sch. 15 para. 5](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/5) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-c08398fac9ea431bbf20d8d55cdcc986]: [Sch. 15 para. 13](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/13) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-8d9d7cdf97e575d2a5c03f8e3c76a63d]: [Sch. 15 para. 10](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/10) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-d7d2530b8c04272f421e5f13fc49a57f]: [Sch. 15 para. 15](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/15) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-9bc333ae2f3f8bcbd3a38bc3a810fb5a]: [Sch. 15 para. 3](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/3) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-abec216a11c53d30529d354f6e83a50f]: [Sch. 15 para. 18](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/18) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-68468e63dc949bef1473171d5c80732e]: [Sch. 15 para. 14](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/14) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-ec0464280a18691fbcb6515bd0852c75]: [Sch. 15 para. 1](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/1) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-5719f4546efdf9f702b40b2a5e775b53]: [Sch. 15 para. 16](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/16) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-c95234e363a715e0b865be6ac18a3963]: [Sch. 15 para. 8](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/8) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-9ea718a16294435c0d8a3ba0a059be17]: [Sch. 14 para. 4](https://www.legislation.gov.uk/ukpga/2018/12/schedule/14/paragraph/4) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-043f7bc14d22fdcbfb448881e634bb29]: [Sch. 14 para. 9](https://www.legislation.gov.uk/ukpga/2018/12/schedule/14/paragraph/9) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-91a5085b745156ed57ea4f055828d80e]: [Sch. 14 para. 2](https://www.legislation.gov.uk/ukpga/2018/12/schedule/14/paragraph/2) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-7edbfe20fdfb17c08b5476ec862c2702]: [Sch. 14 para. 8](https://www.legislation.gov.uk/ukpga/2018/12/schedule/14/paragraph/8) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-e598c7d85d9458389a99ba84bc966aa5]: [Sch. 14 para. 5](https://www.legislation.gov.uk/ukpga/2018/12/schedule/14/paragraph/5) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-d21cee9d28e7ef117ac498fbed58738e]: [Sch. 14 para. 10](https://www.legislation.gov.uk/ukpga/2018/12/schedule/14/paragraph/10) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-14b4703aea49e936bdc2c5f3554cd402]: [Sch. 14 para. 3](https://www.legislation.gov.uk/ukpga/2018/12/schedule/14/paragraph/3) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-88136afa0ef1df300a43059fe5b24e85]: [Sch. 14 para. 6](https://www.legislation.gov.uk/ukpga/2018/12/schedule/14/paragraph/6) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-753f1687fbeaa53726164aa1e83b0e09]: [Sch. 14 para. 7](https://www.legislation.gov.uk/ukpga/2018/12/schedule/14/paragraph/7) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-3e3952d162173b68e091db4060f9b393]: [Sch. 14 para. 1](https://www.legislation.gov.uk/ukpga/2018/12/schedule/14/paragraph/1) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-1fef7e66182de00ab308293cffb72a92]: Sch. 13 para. 2 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-faff0ea5ed35159f697f04d89c76e997]: [Sch. 13 para. 1](https://www.legislation.gov.uk/ukpga/2018/12/schedule/13/paragraph/1) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-3e6972aa3a9dfa4f0e492dff37885f2e]: [Sch. 13 para. 3](https://www.legislation.gov.uk/ukpga/2018/12/schedule/13/paragraph/3) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-66ab9d1de4957bbacf62b04943c91e47]: [Sch. 12 para. 8](https://www.legislation.gov.uk/ukpga/2018/12/schedule/12/paragraph/8) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-2041ee869046f0555101f3c828389214]: [Sch. 12 para. 12](https://www.legislation.gov.uk/ukpga/2018/12/schedule/12/paragraph/12) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-fea2840db43536e89fbad12e76ee7857]: [Sch. 12 para. 11](https://www.legislation.gov.uk/ukpga/2018/12/schedule/12/paragraph/11) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-0a86b7ac7f6cd28ad8594499bf962105]: [Sch. 12 para. 4](https://www.legislation.gov.uk/ukpga/2018/12/schedule/12/paragraph/4) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-36599635eca521fc080bdf0f265f7284]: [Sch. 12 para. 10](https://www.legislation.gov.uk/ukpga/2018/12/schedule/12/paragraph/10) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-64bc08d1985519824ec0dd32abbcec66]: [Sch. 12 para. 7](https://www.legislation.gov.uk/ukpga/2018/12/schedule/12/paragraph/7) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-664583bd72ffa43f978cc1b9b28ad53d]: [Sch. 12 para. 5](https://www.legislation.gov.uk/ukpga/2018/12/schedule/12/paragraph/5) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-bf1901e085f9376f525dcebcaece26ab]: [Sch. 12 para. 6](https://www.legislation.gov.uk/ukpga/2018/12/schedule/12/paragraph/6) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-af00bc19e71787fbc67e62544709eb1b]: [Sch. 12 para. 9](https://www.legislation.gov.uk/ukpga/2018/12/schedule/12/paragraph/9) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-59a0badca91ad9baca06c67733e4b029]: [Sch. 12 para. 1](https://www.legislation.gov.uk/ukpga/2018/12/schedule/12/paragraph/1) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-9dd7994c42a80efb90cbfa1a45252e1d]: [Sch. 12 para. 2](https://www.legislation.gov.uk/ukpga/2018/12/schedule/12/paragraph/2) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-7b7a7abcbe377f85ee79df3619288d0c]: [Sch. 12 para. 3](https://www.legislation.gov.uk/ukpga/2018/12/schedule/12/paragraph/3) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-32de75b19001af6b4273053c3b092e07]: [Sch. 11 para. 7](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/7) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-c16f610c170d5b1d37b2f712191af2cc]: [Sch. 11 para. 12](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/12) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-ec4c69b934ac57e2e43214a23dcbb96d]: [Sch. 11 para. 9](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/9) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-9b4888918161ced5908cf5b16e33b46f]: [Sch. 11 para. 11](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/11) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-a6604195d497ecc3ddea17c2bd854a34]: [Sch. 11 para. 5](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/5) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-6db365e85b52911a728021f65ea4c98a]: [Sch. 11 para. 1](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/1) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-e36726ddad796892b59de71bc71fac9c]: [Sch. 11 para. 4](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/4) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-b69d717e1e9c428be52a8405917b6a47]: [Sch. 11 para. 14](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/14) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-c3db4b87743d73511206b4ae86bb0bbf]: [Sch. 11 para. 2](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/2) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-134fd5e04dd25c969baf7cb8da305ebf]: [Sch. 11 para. 10](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/10) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-6888ac65f30f092ac6490e4894483c5f]: [Sch. 11 para. 6](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/6) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-d5814a5c9f9acb766d2ce56a6703bb8e]: [Sch. 11 para. 8](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/8) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-ad7fdedeb20c593a8a57d11ce1f3e37e]: [Sch. 11 para. 13](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/13) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-4ac91bf85ec11b5b09d2cffc0834e330]: [Sch. 11 para. 3](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/3) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-85d06a39ca0878ef9dbbbb42d71fbd78]: [Sch. 10 para. 9](https://www.legislation.gov.uk/ukpga/2018/12/schedule/10/paragraph/9) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-0d717e014e2ac42d02e0b61cef256e2c]: [Sch. 10 para. 5](https://www.legislation.gov.uk/ukpga/2018/12/schedule/10/paragraph/5) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-83a763dd81dbb8571ef5ab019fcdb125]: [Sch. 10 para. 3](https://www.legislation.gov.uk/ukpga/2018/12/schedule/10/paragraph/3) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-431929efc48cfd1c7e9f739cdd057f77]: [Sch. 10 para. 4](https://www.legislation.gov.uk/ukpga/2018/12/schedule/10/paragraph/4) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-7a5a1fef2d738d7c657db0fb599f1871]: [Sch. 10 para. 1](https://www.legislation.gov.uk/ukpga/2018/12/schedule/10/paragraph/1) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-742f3892a7615fbe038b411efd2afeab]: [Sch. 10 para. 2](https://www.legislation.gov.uk/ukpga/2018/12/schedule/10/paragraph/2) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-551a5acb36329559fb8567a347c30867]: [Sch. 10 para. 8](https://www.legislation.gov.uk/ukpga/2018/12/schedule/10/paragraph/8) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-440e3de22d9a2fac78e668ed17f56a46]: [Sch. 10 para. 7](https://www.legislation.gov.uk/ukpga/2018/12/schedule/10/paragraph/7) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-28d4daa78be4e5d33285e5535b47873d]: [Sch. 10 para. 6](https://www.legislation.gov.uk/ukpga/2018/12/schedule/10/paragraph/6) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-294f9f790bda664a2188b1b513ce0b8a]: [Sch. 9 para. 1](https://www.legislation.gov.uk/ukpga/2018/12/schedule/9/paragraph/1) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-1c131e673e4b114091bed8a61ac7815e]: [Sch. 9 para. 3](https://www.legislation.gov.uk/ukpga/2018/12/schedule/9/paragraph/3) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-0d4b111311777831fdffba581e848ea6]: [Sch. 9 para. 5](https://www.legislation.gov.uk/ukpga/2018/12/schedule/9/paragraph/5) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-16bde097283134ad53e67bc7eced6507]: [Sch. 9 para. 2](https://www.legislation.gov.uk/ukpga/2018/12/schedule/9/paragraph/2) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-efeacacfef60e8ff1a67439770fe3b48]: [Sch. 9 para. 4](https://www.legislation.gov.uk/ukpga/2018/12/schedule/9/paragraph/4) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-56a85299b8061657d3e11b677b355c71]: [Sch. 9 para. 6](https://www.legislation.gov.uk/ukpga/2018/12/schedule/9/paragraph/6) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-e25dd9b1b973623ef52f15cab26e68cb]: [Sch. 8 para. 8](https://www.legislation.gov.uk/ukpga/2018/12/schedule/8/paragraph/8) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-dc321b64fd0fcd1ec60ef61441b8fafc]: [Sch. 8 para. 6](https://www.legislation.gov.uk/ukpga/2018/12/schedule/8/paragraph/6) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-274e371213d21f8c518714836a7fd931]: [Sch. 8 para. 2](https://www.legislation.gov.uk/ukpga/2018/12/schedule/8/paragraph/2) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-eb657c142c3f50225154d09ddb60518c]: [Sch. 8 para. 9](https://www.legislation.gov.uk/ukpga/2018/12/schedule/8/paragraph/9) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-43bc0992bbfa072aa58b065a6a0dbcb2]: [Sch. 8 para. 7](https://www.legislation.gov.uk/ukpga/2018/12/schedule/8/paragraph/7) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-187293003be44c5bcbbaa54a11235709]: [Sch. 8 para. 1](https://www.legislation.gov.uk/ukpga/2018/12/schedule/8/paragraph/1) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-e277a02441fd6aacb99d8f3da6909db8]: [Sch. 8 para. 4](https://www.legislation.gov.uk/ukpga/2018/12/schedule/8/paragraph/4) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-edcda9a310fb95ba168f7aa1cb086887]: [Sch. 8 para. 5](https://www.legislation.gov.uk/ukpga/2018/12/schedule/8/paragraph/5) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-88ce0d1dbc7fe3a0c4496cb8423c1963]: [Sch. 8 para. 3](https://www.legislation.gov.uk/ukpga/2018/12/schedule/8/paragraph/3) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-782907df884cc218df28335e04f9b6bc]: [Sch. 7 para. 4](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/4) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-394f7b7301975b7000579ddf95606947]: [Sch. 7 para. 10](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/10) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-145f005fd8042c51b0664ff136e39957]: [Sch. 7 para. 18](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/18) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-c36bb938b5c589478fc26017aba6c037]: [Sch. 7 para. 1](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/1) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-4cb750ea4557f2baffcc01c9e44b677f]: [Sch. 7 para. 50](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/50) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-351ec702d4e1f2a9e1b9458310accfc5]: [Sch. 7 para. 46](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/46) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-c914990c72253d6c460805018090a05a]: [Sch. 7 para. 53](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/53) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-a3c0ce05bf3da8355e376954eddca53f]: [Sch. 7 para. 52](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/52) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-0a47f233acc9d54f244d68e5e7b97287]: [Sch. 7 para. 7](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/7) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-92602c48b03bd64557bffe924a7a3393]: [Sch. 7 para. 39](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/39) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-d246561fbd24e4e3fc88730fdaad884d]: [Sch. 7 para. 51](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/51) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-5657721de3c458b0710026de5d0b03c1]: [Sch. 7 para. 16](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/16) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-d9ef046124282afd82fbdc97d2c50598]: [Sch. 7 para. 38](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/38) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-f36e3f8d2e9c3f68d669cb6b0bbd97d6]: [Sch. 7 para. 3](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/3) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-dce28071963c6ace834d117354904185]: [Sch. 7 para. 14](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/14) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-377a1b0604cd68d461b2246e995e46e0]: [Sch. 7 para. 17](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/17) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-9ac63ff5136041fd04722844c4c6f7c9]: [Sch. 7 para. 45](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/45) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-8fbe292ba1de6fbf2a9d7d97a4bad919]: [Sch. 7 para. 29](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/29) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-111f1a1c71e0256436529fc90b060e72]: [Sch. 7 para. 26](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/26) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-d4f3fe3c5fbdf78dd7e443f27080c092]: [Sch. 7 para. 44](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/44) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-8bdf2f9115303fb799f509ce612d36e1]: [Sch. 7 para. 48](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/48) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-a2dc7867f7754a11a35a6a348b1c9035]: [Sch. 7 para. 56](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/56) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-33844decc2c84b21970a5264085c1f39]: [Sch. 7 para. 27](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/27) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-e9b848f9dfd63036d3e70f0dd8886750]: [Sch. 7 para. 34](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/34) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-ccb74de70cc7a0e82e0af0edf88a190e]: [Sch. 7 para. 8](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/8) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-ee913b1171c2f96081016642901d4393]: [Sch. 7 para. 37](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/37) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-6b973a6a6c7ca62745d334f519a01218]: [Sch. 7 para. 55](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/55) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-c51b193aa656263473481500b9b47e2b]: [Sch. 7 para. 24](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/24) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-ce8f58e41e39345fa68025d5f759b383]: [Sch. 7 para. 20](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/20) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-56536b33263227125ad45c4609bbea48]: [Sch. 7 para. 33](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/33) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-1ccd56afc99d98d997ea26936d814e5e]: [Sch. 7 para. 35](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/35) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-63549367591b91b245c18fd99b767a4c]: [Sch. 7 para. 9](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/9) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-1d193e02860f55c99db471219ec3f06e]: [Sch. 7 para. 47](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/47) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-239c68a5d49bddfad7b7c6cbedee418b]: [Sch. 7 para. 6](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/6) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-5ae2292fa42aa74f4748479a28697330]: [Sch. 7 para. 40](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/40) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-69f9a7a9d26266ca1b42b20f77139add]: [Sch. 7 para. 36](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/36) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-1891a577bed40a948968a85d66637a93]: [Sch. 7 para. 11](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/11) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-fed272c8d1c4b1280f93db05392dbbfd]: [Sch. 7 para. 22](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/22) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-60e4a152cf94a583f140fc84ff119a86]: [Sch. 7 para. 12](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/12) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-daf9e0252da094394cda1b40a87dfe22]: [Sch. 7 para. 49](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/49) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-ce78857695492590423f593605c8ec36]: [Sch. 7 para. 32](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/32) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-7fcae51576d2c15f60236eee6cb91fa1]: [Sch. 7 para. 23](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/23) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-f9037392e04ce91d10ca238c50493e35]: [Sch. 7 para. 21](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/21) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-57812c32673391de107302cc043c6950]: [Sch. 7 para. 19](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/19) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-f3f9b2e5f89457aeaa4f41a30c82f461]: [Sch. 7 para. 41](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/41) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-449c1a7ed7588ac58e65dadd14c1c1b4]: [Sch. 7 para. 30](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/30) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-9b05bb1b29d1ffb55d5c9c114578c937]: [Sch. 7 para. 15](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/15) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-18f5225df519ce6258d663cbb0e9a035]: [Sch. 7 para. 42](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/42) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-1be29581136bd4c18ff6bb98bfbee461]: [Sch. 7 para. 28](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/28) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-ac0d3ccf4233244b994c97cd184120b6]: [Sch. 7 para. 43](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/43) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-6b73746ba6f7dc8aef1c83cf22349b69]: [Sch. 7 para. 31](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/31) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-0d0f728e9f8b4a55db8deb669c342540]: [Sch. 7 para. 13](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/13) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-bfa38f6ea2f2d1ae4ff2e67570068933]: [Sch. 7 para. 54](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/54) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-8c3774348306ed27397be307974b45b9]: [Sch. 7 para. 25](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/25) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-39e0ce1bd3a8467f4ceae07a33f920c5]: [Sch. 7 para. 5](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/5) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-224603786e8386f2203555d1040fa06f]: [Sch. 7 para. 2](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/2) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-9fd3a6288be2ec53bf25b4aff659793b]: [Sch. 6 para. 74](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/74) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-0c24ce47b768f0d5d561aab6662af947]: [Sch. 6 para. 73](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/73) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-997a5dc94dd75d898c862e671be7fc11]: [Sch. 6 para. 75](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/75) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-6c9e5c473c920b13a41b4877f285d908]: [Sch. 6 para. 53](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/53) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-4f7e5e1b3a09fbb27bd91c68367d6b43]: [Sch. 6 para. 13](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/13) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-f3b0f272bceb945c26653c6924afbcdf]: [Sch. 6 para. 29](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/29) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-4f8beb00f4eeeb4bed0fb35b8a0bf085]: [Sch. 6 para. 38](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/38) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-9cb54e84ba8a70a773edb3fcf4f5d8c0]: [Sch. 6 para. 64](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/64) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-73ca3271795927c3926a031aa1c94bd0]: [Sch. 6 para. 44](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/44) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-2ea4de5d8f77ae34d863f5f1fde1e870]: [Sch. 6 para. 36](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/36) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-96f62267dfbe6ef59255f91fe862f4ae]: [Sch. 6 para. 68](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/68) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-5b8e875f696e03c6679434a9574dfb2d]: [Sch. 6 para. 35](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/35) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-ec0f045b12f57c9ffdcad379fffb586f]: [Sch. 6 para. 61](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/61) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-638de5c8b6ef46e2e9e024ecdeb330de]: [Sch. 6 para. 24](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/24) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-757f37e760a5a8e2a4b26d35a8c43dea]: [Sch. 6 para. 2](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/2) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-6f21a204dfeb0d507b1c7d29ce4ee901]: [Sch. 6 para. 7](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/7) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-a34b1ea1caa9cbc2fc4fa2961b800a76]: [Sch. 6 para. 66](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/66) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-6b05e3e3ddf4a542faef4042803e91b5]: [Sch. 6 para. 18](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/18) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-2edd0175b0b1c887b1c3934ecb6a4f24]: [Sch. 6 para. 41](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/41) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-f45a9e011e8f2b09161f3d0587857d41]: [Sch. 6 para. 33](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/33) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-eaf4ef384ea87dadcea965e01055135a]: [Sch. 6 para. 45](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/45) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-a07770d2bfa296f198247404c720bcaa]: [Sch. 6 para. 51](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/51) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-ae3790f57860aac750113e6b88e3c8ce]: [Sch. 6 para. 72](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/72) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-3a0b737aac41ed340774e70cc3dd5e02]: [Sch. 6 para. 49](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/49) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-b834480afa8fbd537d229927442b7e1e]: [Sch. 6 para. 67](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/67) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-1d82221a9dfb6aa985b37bc8010577d6]: [Sch. 6 para. 59](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/59) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-8303f91708ff7d8bb363ba1a1e1d6348]: [Sch. 6 para. 15](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/15) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-66f56f7f0516bb8d1ab7f109a985fd0d]: [Sch. 6 para. 43](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/43) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-331ef21c5f4be0cda6d9fa44f6003115]: [Sch. 6 para. 27](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/27) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-045d4d4d2ff592b21bf7921f01e1eaff]: [Sch. 6 para. 32](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/32) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-6707ee66f15faae70bfa693cf84cf508]: [Sch. 6 para. 4](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/4) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-80245cfdb9d43f60bb43658461d4a2ff]: [Sch. 6 para. 10](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/10) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-6041b96fe48db6142be2fe577c86ed08]: [Sch. 6 para. 65](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/65) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-3d655cfad90eac167bdf0ff8be51be64]: [Sch. 6 para. 60](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/60) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-29aeed3d696344923ad75abf43c25883]: [Sch. 6 para. 30](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/30) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-40c84835fc452ff8278417e601fc4bc8]: [Sch. 6 para. 56](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/56) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-9251dd76e769bd87428cbb1644115aaa]: [Sch. 6 para. 17](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/17) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-eb379a658d9bd87884a5b7c4969a67ba]: [Sch. 6 para. 70](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/70) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-27dfaf3945eb8dae4d8010fdd69e5308]: [Sch. 6 para. 25](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/25) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-fd01cf77f9217dd8ddadfd589dd77c05]: [Sch. 6 para. 58](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/58) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-11f88859a9fcc84245d6893779c4b979]: [Sch. 6 para. 19](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/19) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-7184c28bd031c4e7e43f04dd79fd2164]: [Sch. 6 para. 21](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/21) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-7522626a1377fba69dffd0ccc75465fc]: [Sch. 6 para. 11](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/11) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-c114482cd094c0bbe7ff9a8273b38d97]: [Sch. 6 para. 9](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/9) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-6b556015706523092ac864c3b3d97544]: [Sch. 6 para. 46](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/46) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-b59ae9d0101ee9bd15f798554b23b45c]: [Sch. 6 para. 1](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/1) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-120808c8890db07a7a8ba69492b29f7b]: [Sch. 6 para. 28](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/28) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-17c1f85c35dc5d08162467be05ef798c]: [Sch. 6 para. 40](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/40) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-ec50dc07e643e1c425acbbc34151d5f9]: [Sch. 6 para. 69](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/69) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-57ffad8d82a0785126a23fd2f9abd546]: [Sch. 6 para. 22](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/22) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-f771627cdac173fb43f4b74366e41224]: [Sch. 6 para. 8](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/8) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-3f65e834c1bb18356f2c1ef109752459]: [Sch. 6 para. 6](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/6) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-3560c4ff70e7aa4b0b744039cac5dc5d]: [Sch. 6 para. 63](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/63) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-31151d42382aee72e91cd2e15855597a]: [Sch. 6 para. 31](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/31) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-8aaf34475f0ae144f2b76c63361c0345]: [Sch. 6 para. 5](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/5) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-708a1aa23d9f66fde7f5c7a6f22ebbd5]: [Sch. 6 para. 16](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/16) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-e21a0b350a5da4b08af48e7f51a99db4]: [Sch. 6 para. 20](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/20) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-4490086d34530f24e0a59a3faefdd6bd]: [Sch. 6 para. 23](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/23) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-8d1a62d52c565654e7d9c8d4b63ba4d1]: [Sch. 6 para. 48](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/48) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-ddf498559948b99e47b7971326145e31]: [Sch. 6 para. 37](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/37) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-5f55b395ed90a9183cd81e3519673a01]: [Sch. 6 para. 54](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/54) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-0e419c254b4f661e051bec0f92ce9f9f]: [Sch. 6 para. 39](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/39) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-bb8ad6517433ad3240e1b24a7e748353]: [Sch. 6 para. 3](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/3) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-08569e25eaa0e5cd3903a732d07592b1]: [Sch. 6 para. 14](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/14) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-64d1d267f1a2e7135c108e3ffc51eafd]: [Sch. 6 para. 52](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/52) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-19cb91f0db14991d135ff19091dd6c6f]: [Sch. 6 para. 57](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/57) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-b8cec7eca2bbcaf83a75c02eb2c92b9f]: [Sch. 6 para. 42](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/42) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-3324da49fa7b9fdff58a141c1483a845]: [Sch. 6 para. 12](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/12) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-b6bc7858f5f6be1bbcc2dba4719b9913]: [Sch. 6 para. 34](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/34) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-a7099e2a1c25e90bf7341fa67e0c1070]: [Sch. 6 para. 47](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/47) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-924151270495bf320d905b60c0293143]: [Sch. 6 para. 71](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/71) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-ede8e5489bfcc26dbb89f3ed25e3d8e6]: [Sch. 6 para. 26](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/26) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-65cf9a389417635b9248be49302b2199]: [Sch. 6 para. 55](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/55) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-cc2b93fe8195fb15258885aea2fb6812]: [Sch. 6 para. 50](https://www.legislation.gov.uk/ukpga/2018/12/schedule/6/paragraph/50) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-40f0a9ec887e8f82ce6a39bc14027c7f]: [Sch. 5 para. 1](https://www.legislation.gov.uk/ukpga/2018/12/schedule/5/paragraph/1) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-67c2d07c6b756193ae777321980fbada]: Sch. 5 para. 3 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-192a1bf9519afe99b825d17615dfc26e]: Sch. 5 para. 7 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-1a90a3eab20b0234d22967568d8f95e6]: [Sch. 5 para. 6](https://www.legislation.gov.uk/ukpga/2018/12/schedule/5/paragraph/6) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-d2ab903fec483b11ddcbb071e3ef3ab0]: Sch. 5 para. 2 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-61187dd7a3e1c1e7fb0580816d8b4c9d]: Sch. 5 para. 5 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-2f350698774b35568aabee9ff5444da4]: [Sch. 5 para. 4](https://www.legislation.gov.uk/ukpga/2018/12/schedule/5/paragraph/4) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-4e8fe253a0c227937680b83ebd92b80b]: Sch. 3 para. 21 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-b465e86c8c1c06e714d3d2827dbebf59]: Sch. 3 para. 14 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-812f736d922e3056b472b473c1393f22]: Sch. 3 para. 16 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-8ce5bb6f0c231dc068b12c90fde35190]: [Sch. 3 para. 19](https://www.legislation.gov.uk/ukpga/2018/12/schedule/3/paragraph/19) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-5614b756eac3d8dc2bdaf822684cd82d]: Sch. 3 para. 15 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-a3e5aec1f29a24d1eaf3ac27bcb0f574]: Sch. 3 para. 13 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-f412ad8f5c025fab9461ce6d906a8b3d]: [Sch. 3 para. 17](https://www.legislation.gov.uk/ukpga/2018/12/schedule/3/paragraph/17) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-a38e5f963a5cc490b6486ba844675c17]: [Sch. 3 para. 20](https://www.legislation.gov.uk/ukpga/2018/12/schedule/3/paragraph/20) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-1be9e273ac0b64d03506cf32210c1a57]: Sch. 3 para. 18 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-f3eefe30bfa4029bd8194d0f8d6a0191]: [Sch. 3 para. 11](https://www.legislation.gov.uk/ukpga/2018/12/schedule/3/paragraph/11) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-b47928de3ad984bd7b4dd3f71d788598]: Sch. 3 para. 8(1)(o) modified by S.I. 1999/677, art. 7(1)(2) (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 237](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/237) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g))
[^key-5cee107d2b615bc782c1b451bf02a558]: [Sch. 3 para. 8(1)(o)](https://www.legislation.gov.uk/ukpga/2018/12/schedule/3/paragraph/8/1/o) modified by S.I. 1999/3145, art. 9(1)(2) (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 238](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/238) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g))
[^key-2caed7998517246d438fb7426131f7c6]: [Sch. 3 para. 12](https://www.legislation.gov.uk/ukpga/2018/12/schedule/3/paragraph/12) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-b452ea5807870d8b5ed178682e71a1c9]: Sch. 3 para. 9 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-d2992e1a702c7fd6a6c636a5bb840e57]: Sch. 3 para. 10 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-6f0c718157d78c6ddf4702c682a254af]: [Sch. 3 para. 7](https://www.legislation.gov.uk/ukpga/2018/12/schedule/3/paragraph/7) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-d0dceb44e3808f208cbe89f1254ea198]: Sch. 3 para. 8(1)(o) modified by S.I. 2007/1118, art. 5(1)(2) (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 324](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/324) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g))
[^key-6e02174faaada0c35838f1398366cb37]: Sch. 3 para. 8 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-40c02ffd5c56ee606a2856be6b10caa9]: [Sch. 3 para. 2](https://www.legislation.gov.uk/ukpga/2018/12/schedule/3/paragraph/2) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-707007c80984c665a4e2335e099cc6be]: [Sch. 3 para. 5](https://www.legislation.gov.uk/ukpga/2018/12/schedule/3/paragraph/5) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-d142e8d668e46fcefe4fda5df5ec3327]: Sch. 3 para. 3 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-cb938c33652544b70282c332301024a6]: [Sch. 3 para. 6](https://www.legislation.gov.uk/ukpga/2018/12/schedule/3/paragraph/6) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-cb488232f6394d8ef31bca7d0e16a533]: Sch. 3 para. 4 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-0b53074897f1059036b56bf170311375]: Sch. 3 para. 1 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
##### 74A
- (1) The Secretary of State may by regulations specify any of the following which the Secretary of State considers ensures an adequate level of protection of personal data—
- (a) a third country,
- (b) a territory or one or more sectors within a third country,
- (c) an international organisation, or
- (d) a description of such a country, territory, sector or organisation.
- (2) For the purposes of this Part of this Act, a transfer of personal data to a third country or an international organisation is based on adequacy regulations if, at the time of the transfer, regulations made under this section are in force which specify, or specify a description which includes—
- (a) in the case of a third country, the country or a relevant territory or sector within the country, and
- (b) in the case of an international organisation, the organisation,
and such a transfer does not require specific authorisation.
- (3) Regulations under this section may specify that the Secretary of State considers that an adequate level of protection of personal data is ensured only for a transfer specified or described in the regulations and, if they do so, only such a transfer may rely on those regulations for the purposes of subsection (2).
- (4) When assessing the adequacy of the level of protection for the purposes of this section or section 74B, the Secretary of State must, in particular, take account of—
- (a) the rule of law, respect for human rights and fundamental freedoms, relevant legislation, both general and sectoral, including concerning public security, defence, national security and criminal law and the access of public authorities to personal data, as well as the implementation of such legislation, data protection rules, professional rules and security measures, including rules for the onward transfer of personal data to another third country or international organisation, which are complied with in that country or international organisation, case-law, as well as effective and enforceable data subject rights and effective administrative and judicial redress for the data subjects whose personal data is transferred,
- (b) the existence and effective functioning of one or more independent supervisory authorities in the third country or to which an international organisation is subject, with responsibility for ensuring and enforcing compliance with data protection rules, including adequate enforcement powers, for assisting and advising data subjects in exercising their rights and for cooperation with the Commissioner, and
- (c) the international commitments the third country or international organisation concerned has entered into, or other obligations arising from legally binding conventions or instruments as well as from its participation in multilateral or regional systems, in particular in relation to the protection of personal data.
- (5) Regulations under this section—
- (a) where they relate to a third country, must specify their territorial and sectoral application;
- (b) where applicable, must specify the independent supervisory authority or authorities referred to in subsection (4)(b).
- (6) Regulations under this section may, among other things—
- (a) provide that, in relation to a country, territory, sector, organisation or territory specified, or falling within a description specified, in the regulations, section 74B(1) has effect as if it required the reviews described there to be carried out at such shorter intervals as are specified in the regulations;
- (b) identify a transfer of personal data by any means, including by reference to the controller or processor, the recipient, the personal data transferred or the means by which the transfer is made or by reference to relevant legislation, lists or other documents, as they have effect from time to time;
- (c) confer a discretion on a person.
- (7) Regulations under this section are subject to the negative resolution procedure.
##### 74B
- (1) For so long as regulations under section 74A are in force which specify, or specify a description which includes, a third country, a territory or sector within a third country or an international organisation, the Secretary of State must carry out a review of whether the country, territory, sector or organisation ensures an adequate level of protection of personal data at intervals of not more than 4 years.
- (2) Each review under subsection (1) must take into account all relevant developments in the third country or international organisation.
- (3) The Secretary of State must, on an ongoing basis, monitor developments in third countries and international organisations that could affect decisions to make regulations under section 74A or to amend or revoke such regulations.
- (4) Where the Secretary of State becomes aware that a country, territory, sector or organisation specified, or falling within a description specified, in regulations under section 74A no longer ensures an adequate level of protection of personal data, whether as a result of a review under this section or otherwise, the Secretary of State must, to the extent necessary, amend or revoke the regulations.
- (5) Where regulations under section 74A are amended or revoked in accordance with subsection (4), the Secretary of State must enter into consultations with the third country or international organisation concerned with a view to remedying the lack of an adequate level of protection.
- (6) The Secretary of State must publish—
- (a) a list of the third countries, territories and specified sectors within a third country and international organisations, and the descriptions of such countries, territories, sectors and organisations, which are for the time being specified in regulations under section 74A, and
- (b) a list of the third countries, territories and specified sectors within a third country and international organisations, and the descriptions of such countries, territories, sectors and organisations, which have been but are no longer specified in such regulations.
- (7) In the case of regulations under section 74A which specify that an adequate level of protection of personal data is ensured only for a transfer specified or described in the regulations—
- (a) the duty under subsection (1) is only to carry out a review of the level of protection ensured for such a transfer, and
- (b) the lists published under subsection (6) must specify or describe the relevant transfers.
##### 119A
- (1) The Commissioner may issue a document specifying standard data protection clauses which the Commissioner considers provide appropriate safeguards for the purposes of transfers of personal data to a third country or an international organisation in reliance on Article 46 of the UK GDPR (and see also section 17C).
- (2) The Commissioner may issue a document that amends or withdraws a document issued under subsection (1).
- (3) A document issued under this section—
- (a) must specify when it comes into force,
- (b) may make different provision for different purposes, and
- (c) may include transitional provision or savings.
- (4) Before issuing a document under this section, the Commissioner must consult the Secretary of State and such of the following as the Commissioner considers appropriate—
- (a) trade associations;
- (b) data subjects;
- (c) persons who appear to the Commissioner to represent the interests of data subjects.
- (5) After a document is issued under this section—
- (a) the Commissioner must send a copy to the Secretary of State, and
- (b) the Secretary of State must lay it before Parliament.
- (6) If, within the 40-day period, either House of Parliament resolves not to approve the document then, with effect from the end of the day on which the resolution is passed, the document is to be treated as not having been issued under this section (so that the document, and any amendment or withdrawal made by the document, is to be disregarded for the purposes of Article 46(2)(d) of the UK GDPR).
- (7) Nothing in subsection (6)—
- (a) affects any transfer of personal data previously made in reliance on the document, or
- (b) prevents a further document being laid before Parliament.
- (8) The Commissioner must publish—
- (a) a document issued under this section, and
- (b) a notice identifying any document which, under subsection (6), is treated as not having been issued under this section.
- (9) The Commissioner must keep under review the clauses specified in a document issued under this section for the time being in force.
- (10) In this section, “*the 40-day period*” means—
- (a) if the document is laid before both Houses of Parliament on the same day, the period of 40 days beginning with that day, or
- (b) if the document is laid before the Houses of Parliament on different days, the period of 40 days beginning with the later of those days.
- (11) In calculating the 40-day period, no account is to be taken of any period during which Parliament is dissolved or prorogued or during which both Houses of Parliament are adjourned for more than 4 days.
- (12) In this section, “*trade association*” includes a body representing controllers or processors.
## SCHEDULE 21
## Part 1 — Interpretation
#### The applied GPDR
##### 1
In this Schedule, “*the applied GDPR*” means the EU GDPR as applied by Chapter 3 of Part 2 before IP completion day.
## Part 2 — Continuation of existing acts etc
##### 2
- (1) On and after IP completion day, references in an enactment to the UK GDPR (including the reference in the definition of “the data protection legislation” in section 3(9)) include—
- (a) the EU GDPR as it was directly applicable to the United Kingdom before IP completion day, read with Chapter 2 of Part 2 of this Act as it had effect before IP completion day, and
- (b) the applied GDPR, read with Chapter 3 of Part 2 of this Act as it had effect before IP completion day.
- (2) On and after IP completion day, references in an enactment to, or to a provision of, Chapter 2 of Part 2 of this Act (including general references to this Act or to Part 2 of this Act) include that Chapter or that provision as applied by Chapter 3 of Part 2 of this Act as it had effect before IP completion day.
- (3) Sub-paragraphs (1) and (2) have effect—
- (a) in relation to references in this Act, except as otherwise provided;
- (b) in relation to references in other enactments, unless the context otherwise requires.
##### 3
- (1) Anything done in connection with the EU GDPR as it was directly applicable to the United Kingdom before IP completion day, the applied GDPR or this Act—
- (a) if in force or effective immediately before IP completion day, continues to be in force or effective on and after IP completion day, and
- (b) if in the process of being done immediately before IP completion day, continues to be done on and after IP completion day.
- (2) References in this paragraph to anything done include references to anything omitted to be done.
## Part 3 — Transfers to third countries and international organisations
##### 4
- (1) On and after IP completion day, for the purposes of the UK GDPR and Part 2 of this Act, a transfer of personal data to a third country or an international organisation is based on adequacy regulations if, at the time of the transfer, paragraph 5 specifies, or specifies a description which includes—
- (a) in the case of a third country, the country or a relevant territory or sector within the country, or
- (b) in the case of an international organisation, the organisation.
- (2) Sub-paragraph (1) has effect subject to provision in paragraph 5 providing that only particular transfers to the country, territory, sector or organisation may rely on a particular provision of paragraph 5 for the purposes of sub-paragraph (1).
- (3) The Secretary of State may by regulations—
- (a) repeal sub-paragraphs (1) and (2) and paragraph 5;
- (b) amend paragraph 5 so as to omit a third country, territory, sector or international organisation specified, or of a description specified, in that paragraph;
- (c) amend paragraph 5 so as to replace a reference to, or description of, a third country, territory, sector or organisation with a narrower reference or description, including by specifying or describing particular transfers of personal data and making provision described in sub-paragraph (2).
- (4) Regulations under this paragraph may, among other things——
- (a) identify a transfer of personal data by any means, including by reference to the controller or processor, the recipient, the personal data transferred or the means by which the transfer is made or by reference to relevant legislation, lists or other documents, as they have effect from time to time;
- (b) confer a discretion on a person.
- (5) Regulations under this paragraph are subject to the negative resolution procedure.
- (6) Sub-paragraphs (1) and (2) have effect in addition to section 17A(2) and (3).
##### 5
- (1) The following are specified for the purposes of paragraph 4(1)—
- (a) an EEA state;
- (b) Gibraltar;
- (c) a Union institution, body, office or agency set up by, or on the basis of, the Treaty on the European Union, the Treaty on the Functioning of the European Union or the Euratom Treaty;
- (d) an equivalent institution, body, office or agency set up by, or on the basis of, the Treaties establishing the European Economic Area;
- (e) a third country which is the subject of a decision listed in sub-paragraph (2), other than a decision that, immediately before IP completion day, had been repealed or was suspended;
- (f) a third country, territory or sector within a third country or international organisation which is the subject of an adequacy decision made by the European Commission before IP completion day on the basis of Article 45(3) of the EU GDPR, other than a decision that, immediately before IP completion day, had been repealed or was suspended.
- (2) The decisions mentioned in sub-paragraph (1)(e) are the following—
- (a) Commission Decision [2000/518/EC](https://www.legislation.gov.uk/eudn/2000/518) of 26th July 2000 pursuant to Directive [95/46/EC](https://www.legislation.gov.uk/eudr/1995/46) of the European Parliament and of the Council on the adequate protection of personal data provided in Switzerland;
- (b) Commission Decision [2002/2/EC](https://www.legislation.gov.uk/eudn/2002/2) of 20th December 2001 pursuant to Directive [95/46/EC](https://www.legislation.gov.uk/eudr/1995/46) of the European Parliament and of the Council on the adequate protection of personal data provided by the Canadian Personal Information Protection and Electronic Documents Act;
- (c) Commission Decision [2003/490/EC](https://www.legislation.gov.uk/eudn/2003/490) of 30th June 2003 pursuant to Directive [95/46/EC](https://www.legislation.gov.uk/eudr/1995/46) of the European Parliament and of the Council on the adequate protection of personal data in Argentina;
- (d) Commission Decision [2003/821/EC](https://www.legislation.gov.uk/eudn/2003/821) of 21st November 2003 on the adequate protection of personal data in Guernsey;
- (e) Commission Decision [2004/411/EC](https://www.legislation.gov.uk/eudn/2004/411) of 28th April 2004 on the adequate protection of personal data in the Isle of Man;
- (f) Commission Decision [2008/393/EC](https://www.legislation.gov.uk/eudn/2008/393) of 8th May 2008 pursuant to Directive [95/46/EC](https://www.legislation.gov.uk/eudr/1995/46) of the European Parliament and of the Council on the adequate protection of personal data in Jersey;
- (g) Commission Decision 2010/146/EU of 5th March 2010 pursuant to Directive [95/46/EC](https://www.legislation.gov.uk/eudr/1995/46) of the European Parliament and of the Council on the adequate protection provided by the Faeroese Act on processing of personal data;
- (h) Commission Decision 2010/625/EU of 19th October 2010 pursuant to Directive [95/46/EC](https://www.legislation.gov.uk/eudr/1995/46) of the European Parliament and of the Council on the adequate protection of personal data in Andorra;
- (i) Commission Decision 2011/61/EU of 31st January 2011 pursuant to Directive [95/46/EC](https://www.legislation.gov.uk/eudr/1995/46) of the European Parliament and of the Council on the adequate protection of personal data by the State of Israel with regard to automated processing of personal data;
- (j) Commission Implementing Decision 2012/484/EU of 21st August 2012 pursuant to Directive [95/46/EC](https://www.legislation.gov.uk/eudr/1995/46) of the European Parliament and of the Council on the adequate protection of personal data by the Eastern Republic of Uruguay with regard to automated processing of personal data;
- (k) Commission Implementing Decision 2013/65/EU of 19th December 2012 pursuant to Directive [95/46/EC](https://www.legislation.gov.uk/eudr/1995/46) of the European Parliament and of the Council on the adequate protection of personal data by New Zealand;
- (m) Commission Implementing Decision (EU) 2019/419 of 23rd January 2019 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by Japan under the Act on the Protection of Personal Information.
- (3) Where a decision described in sub-paragraph (1)(e) or (f) states that an adequate level of protection of personal data is ensured only for a transfer specified or described in the decision, only such a transfer may rely on that provision and that decision for the purposes of paragraph 4(1).
- (4) The references to a decision in sub-paragraphs (1)(e) and (f) and (2) are to the decision as it had effect in EU law immediately before IP completion day, subject to sub-paragraphs (5) and (6).
- (5) For the purposes of this paragraph, where a reference to legislation, a list or another document in a decision described in sub-paragraph (1)(e) or (f) is a reference to the legislation, list or document as it has effect from time to time, it is to be treated as a reference to the legislation, list or other document as it has effect at the time of the transfer.
- (6) For the purposes of this paragraph, where a decision described in sub-paragraph (1)(e) or (f) relates to—
- (a) transfers from the European Union (or the European Community) or the European Economic Area, or
- (b) transfers to which the EU GDPR applies,
it is to be treated as relating to equivalent transfers to or from the United Kingdom or transfers to which the UK GDPR applies (as appropriate).
##### 6
- (1) In the provisions listed in sub-paragraph (2)—
- (a) references to regulations made under section 17A (other than references to making such regulations) include the provision made in paragraph 5;
- (b) references to the revocation of such regulations include the repeal of all or part of paragraph 5.
- (2) Those provisions are—
- (a) Articles 13(1)(f), 14(1)(f), 45(1) and (7), 46(1) and 49(1) of the UK GDPR;
- (b) sections 17B(1), (3), (6) and (7) and 18(2) of this Act.
##### 7
- (1) Subject to paragraph 8, the appropriate safeguards referred to in Article 46(1) of the UK GDPR may be provided for on and after IP completion day as described in this paragraph.
- (2) The safeguards may be provided for by any standard data protection clauses included in an arrangement which, if the arrangement had been entered into immediately before IP completion day, would have provided for the appropriate safeguards referred to in Article 46(1) of the EU GDPR by virtue of Article 46(2)(c) or (d) or (5) of the EU GDPR.
- (3) The safeguards may be provided for by a version of standard data protection clauses described in sub-paragraph (2) incorporating changes where—
- (a) all of the changes are made in consequence of the withdrawal of the United Kingdom from the EU or provision made by regulations under section 8 or 23 of the European Union (Withdrawal) Act 2018 (or both), and
- (b) none of the changes alters the effect of the clauses.
- (4) The following changes are to be treated as falling within sub-paragraph (3)(a) and (b)—
- (a) changing references to adequacy decisions made by the European Commission into references to equivalent provision made by regulations under section 17A or by or under paragraphs 4 to 6 of this Schedule;
- (b) changing references to transferring personal data outside the European Union or the European Economic Area into references to transferring personal data outside the United Kingdom.
- (5) In the case of a transfer of personal data made under arrangements entered into before IP completion day, the safeguards may be provided for on and after IP completion day by standard data protection clauses not falling within sub-paragraph (2) which—
- (a) formed part of the arrangements immediately before IP completion day, and
- (b) at that time, provided for the appropriate safeguards referred to in Article 46(1) of the EU GDPR by virtue of Article 46(2)(c) or (d) or (5) of the EU GDPR.
- (6) The Secretary of State and the Commissioner must keep the operation of this paragraph under review.
- (7) In this paragraph, “*adequacy decision*” means a decision made on the basis of—
- (a) Article 45(3) of the EU GDPR, or
- (b) Article 25(6) of Directive [95/46/EC](https://www.legislation.gov.uk/eudr/1995/46) of the European Parliament and of the Council of 24th October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.
- (8) This paragraph has effect in addition to Article 46(2) and (3) of the UK GDPR.
##### 8
- (1) Paragraph 7 does not apply to the extent that it has been disapplied by—
- (a) regulations made by the Secretary of State, or
- (b) a document issued by the Commissioner.
- (2) Regulations under this paragraph are subject to the negative resolution procedure.
- (3) Subsections (3) to (8) and (10) to (12) of section 119A apply in relation to a document issued by the Commissioner under this paragraph as they apply to a document issued by the Commissioner under section 119A(2).
##### 9
- (1) The appropriate safeguards referred to in Article 46(1) of the UK GDPR may be provided for on and after IP completion day as described sub-paragraphs (2) to (4), subject to sub-paragraph (5).
- (2) The safeguards may be provided for by any binding corporate rules authorised by the Commissioner which, immediately before IP completion day, provided for the appropriate safeguards referred to in Article 46(1) of the EU GDPR by virtue of Article 46(5) of the EU GDPR.
- (3) The safeguards may be provided for by a version of binding corporate rules described in sub-paragraph (2) incorporating changes where—
- (a) all of the changes are made in consequence of the withdrawal of the United Kingdom from the EU or provision made by regulations under section 8 or 23 of the European Union (Withdrawal) Act 2018 (or both), and
- (b) none of the changes alters the effect of the rules.
- (4) The following changes are to be treated as falling within sub-paragraph (3)(a) and (b)—
- (a) changing references to adequacy decisions made by the European Commission into references to equivalent provision made by regulations under section 17A or by or under paragraphs 4 to 6 of this Schedule;
- (b) changing references to transferring personal data outside the European Union or the European Economic Area into references to transferring personal data outside the United Kingdom.
- (5) Sub-paragraphs (2) to (4) cease to apply in relation to binding corporate rules if, on or after IP completion day, the Commissioner withdraws the authorisation of the rules (or, where sub-paragraph (3) is relied on, the authorisation of the rules mentioned in sub-paragraph (2)).
- (5A) For the purposes of sub-paragraph (2), binding corporate rules which, immediately before IP completion day, provided for the appropriate safeguards referred to in Article 46(1) of the EU GDPR by virtue of Article 46(5) of the EU GDPR but which were authorised other than by the Commissioner are to be treated as authorised by the Commissioner where—
- (a) a valid notification of the rules has been made to the Commissioner,
- (b) the Commissioner has approved them, and
- (c) that approval has not been withdrawn.
- (5B) A notification is valid if it—
- (a) is made by a controller or processor established in the United Kingdom,
- (b) is made to the Commissioner before the end of the period of 6 months beginning with IP completion day, and
- (c) includes—
- (i) the name and contact details of the data protection officer or other contact point for the controller or processor, and
- (ii) such other information as the Commissioner may reasonably require.
- (5C) Where a valid notification is made the Commissioner must, without undue delay—
- (a) decide whether or not to approve the rules, and
- (b) notify the controller or processor of that decision.
- (6) The Commissioner must keep the operation of this paragraph under review.
- (7) In this paragraph—
- “*adequacy decision*” means a decision made on the basis of—Article 45(3) of the EU GDPR, orArticle 25(6) of Directive [95/46/EC](https://www.legislation.gov.uk/eudr/1995/46) of the European Parliament and of the Council of 24th October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data;
- “*binding corporate rules*” has the meaning given in Article 4(20) of the UK GDPR.
- (8) This paragraph has effect in addition to Article 46(2) and (3) of the UK GDPR.
##### 10
- (1) On and after IP completion day, for the purposes of Part 3 of this Act, a transfer of personal data to a third country or an international organisation is based on adequacy regulations if, at the time of the transfer, paragraph 11 specifies, or specifies a description which includes—
- (a) in the case of a third country, the country or a relevant territory or sector within the country, or
- (b) in the case of an international organisation, the organisation.
- (2) Sub-paragraph (1) has effect subject to provision in paragraph 11 providing that only particular transfers to the country, territory, sector or organisation may rely on a particular provision of paragraph 11 for the purposes of sub-paragraph (1).
- (3) The Secretary of State may by regulations—
- (a) repeal sub-paragraphs (1) and (2) and paragraph 11;
- (b) amend paragraph 11 so as to omit a third country, territory, sector or international organisation specified, or of a description specified, in that paragraph;
- (c) amend paragraph 11 so as to replace a reference to, or description of, a third country, territory, sector or organisation with a narrower reference or description, including by specifying or describing particular transfers of personal data and by making provision described in sub-paragraph (2).
- (4) Regulations under this paragraph may, among other things—
- (a) identify a transfer of personal data by any means, including by reference to the controller or processor, the recipient, the personal data transferred or the means by which the transfer is made or by reference to relevant legislation, lists or other documents, as they have effect from time to time;
- (b) confer a discretion on a person.
- (5) Regulations under this paragraph are subject to the negative resolution procedure.
- (6) Sub-paragraphs (1) and (2) have effect in addition to section 74A(2) and (3).
##### 11
- (1) The following are specified for the purposes of paragraph 10(1)—
- (a) an EEA state;
- (aa) Switzerland;
- (b) Gibraltar;
- (c) a third country, a territory or sector within a third country or an international organisation which is the subject of an adequacy decision made by the European Commission before IP completion day on the basis of Article 36(3) of the Law Enforcement Directive, other than a decision that, immediately before IP completion day, had been repealed or was suspended.
- (2) Where a decision described in sub-paragraph (1)(c) states that an adequate level of protection of personal data is ensured only for a transfer specified or described in the decision, only such a transfer may rely on that provision and that decision for the purposes of paragraph 10(1).
- (3) The reference to a decision in sub-paragraph (1)(c) is to the decision as it had effect in EU law immediately before IP completion day, subject to sub-paragraphs (4) and (5).
- (4) For the purposes of this paragraph, where a reference to legislation, a list or another document in a decision described in sub-paragraph (1)(c) is a reference to the legislation, list or document as it has effect from time to time, it is to be treated as a reference to the legislation, list or other document as it has effect at the time of the transfer.
- (5) For the purposes of this paragraph, where a decision described in sub-paragraph (1)(c) relates to—
- (a) transfers from the European Union (or the European Community) or the European Economic Area, or
- (b) transfers to which the Law Enforcement Directive applies,
it is to be treated as relating to equivalent transfers from the United Kingdom or transfers to which Part 3 of this Act applies (as appropriate).
##### 12
In section 74B(1), (3), (6) and (7)—
- (a) references to regulations made under section 74A (other than references to making such regulations) include the provision made in paragraph 11;
- (b) references to the revocation of such regulations include the repeal of all or part of paragraph 11.
## Part 4 — Repeal of provisions in Chapter 3 of Part 2
##### 13
- (1) Regulations made under section 23 before IP completion day continue in force until they are revoked, despite the repeal of that section by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019.
- (2) The provisions listed in section 186(3) include regulations made under section 23 before IP completion day (and not revoked).
- (3) Sub-paragraphs (1) and (2) do not have effect so far as otherwise provided by the law of England and Wales, Scotland or Northern Ireland.
##### 14
- (1) This paragraph applies to a certificate issued under section 27 of this Act which has effect immediately before IP completion day.
- (2) A reference in the certificate to a provision of the applied GDPR has effect, on and after IP completion day, as it if were a reference to the corresponding provision of the UK GDPR or this Act.
## Part 5 — The Information Commissioner
##### 15
The repeal of section 132(2)(d) by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 has effect only in relation to a disclosure of information made on or after IP completion day.
## Part 6 — Enforcement
##### 16
In relation to an infringement, before IP completion day, of a provision of the EU GDPR (as it was directly applicable to the United Kingdom) or the applied GDPR—
- (a) Article 83(5) and (6) of the UK GDPR and section 157(5)(a) and (b) of this Act have effect as if for “£17,500,000” there were substituted “ 20 million Euros ”;
- (b) Article 83(4) of the UK GDPR and section 157(6)(a) and (b) of this Act have effect as if for “£8,700,000” there were substituted “ 10 million Euros ”;
- (c) the maximum amount of a penalty in sterling must be determined by applying the spot rate of exchange set by the Bank of England on the day on which the penalty notice is given under section 155 of this Act.
#### GDPR: right to an effective remedy against the Commissioner
##### 17
- (1) This paragraph applies where—
- (a) proceedings are brought against a decision made by the Commissioner before IP completion day, and
- (b) the Commissioner's decision was preceded by an opinion or decision of the European Data Protection Board in accordance with the consistency mechanism referred to in Article 63 of the EU GDPR.
- (2) The Commissioner must forward the Board's opinion or decision to the court or tribunal dealing with the proceedings.
2020-09-30
Data Protection Act 2018
2020-02-14
Data Protection Act 2018
2019-12-02
Data Protection Act 2018
2019-09-16
Data Protection Act 2018
2019-07-21
Data Protection Act 2018
2019-05-23
Data Protection Act 2018
2019-03-29
Data Protection Act 2018
2018-07-23
Data Protection Act 2018
2018-05-25
Data Protection Act 2018
2018-05-23
Data Protection Act 2018
original version
Text at this date