LegalizeReform history
Data Protection Act 2018
32 versions
· 2018-05-23
2026-04-07
Data Protection Act 2018
2026-03-31
Data Protection Act 2018
2026-03-10
Data Protection Act 2018
2026-01-29
Data Protection Act 2018
2025-08-19
Data Protection Act 2018
Changes on 2025-08-19
@@ -928,6 +928,8 @@
- (1) This section defines certain other expressions used in this Part.
- (1A) “Consent” of the data subject to the processing of personal data means a freely given, specific, informed and unambiguous indication of the data subject’s wishes by which the data subject, by a statement or by a clear affirmative action, signifies agreement to the processing of the personal data (and see section 40A).
- (2) “*Employee*”, in relation to any person, includes an individual who holds a position (whether paid or unpaid) under the direction and control of that person.
- (3) “*Personal data breach*” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.
@@ -964,7 +966,9 @@
- (2) In addition—
- (a) each of sections 35, 36, 38 and 39 makes provision to supplement the principle to which it relates, and
- (a) each of sections 35, 36, 38 and 39 makes provision to supplement the principle to which it relates,
- (aa) section 40A makes provision about processing carried out in reliance on the consent of the data subject, and
- (b) sections 41 and 42 make provision about the safeguards that apply in relation to certain types of processing.
@@ -1766,13 +1770,13 @@
- (2) The logs of consultation must make it possible to establish—
- (a) the justification for, and date and time of, the consultation, and
- (a) the ... date and time of, the consultation, and
- (b) so far as possible, the identity of the person who consulted the data.
- (3) The logs of disclosure must make it possible to establish—
- (a) the justification for, and date and time of, the disclosure, and
- (a) the ... date and time of, the disclosure, and
- (b) so far as possible—
@@ -3786,39 +3790,7 @@
##### 141
- (1) This section applies in relation to a notice authorised or required by this Act to be given to a person by the Commissioner.
- (2) The notice may be given to an individual—
- (a) by delivering it to the individual,
- (b) by sending it to the individual by post addressed to the individual at his or her usual or last-known place of residence or business, or
- (c) by leaving it for the individual at that place.
- (3) The notice may be given to a body corporate or unincorporate—
- (a) by sending it by post to the proper officer of the body at its principal office, or
- (b) by addressing it to the proper officer of the body and leaving it at that office.
- (4) The notice may be given to a partnership in Scotland—
- (a) by sending it by post to the principal office of the partnership, or
- (b) by addressing it to that partnership and leaving it at that office.
- (5) The notice may be given to the person by other means, including by electronic means, with the person's consent.
- (6) In this section—
- “*principal office*”, in relation to a registered company, means its registered office;
- “*proper officer*”, in relation to any body, means the secretary or other executive officer charged with the conduct of its general affairs;
- “*registered company*” means a company registered under the enactments relating to companies for the time being in force in the United Kingdom.
- (7) This section is without prejudice to any other lawful method of giving a notice.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
## PART 6 — Enforcement
@@ -3830,9 +3802,9 @@
- (1) The Commissioner may, by written notice (an “information notice”)—
- (a) require a controller or processor to provide the Commissioner with information that the Commissioner reasonably requires for the purposes of carrying out the Commissioner's functions under the data protection legislation, or
- (b) require any person to provide the Commissioner with information that the Commissioner reasonably requires for the purposes of—
- (a) require a controller or processor to provide the Commissioner with information or documents that the Commissioner reasonably requires for the purposes of carrying out the Commissioner's functions under the data protection legislation, or
- (b) require any person to provide the Commissioner with information or documents that the Commissioner reasonably requires for the purposes of—
- (i) investigating a suspected failure of a type described in section 149(2) or a suspected offence under this Act, or
@@ -3842,17 +3814,17 @@
- (a) whether it is given under subsection (1)(a), (b)(i) or (b)(ii), and
- (b) why the Commissioner requires the information.
- (b) why the Commissioner requires the information or documents.
- (3) An information notice—
- (a) may specify or describe particular information or a category of information;
- (b) may specify the form in which the information must be provided;
- (c) may specify the time at which, or the period within which, the information must be provided;
- (d) may specify the place where the information must be provided;
- (a) may specify or describe particular information or documents or a category of information or documents;
- (b) may specify the form in which the information or documents must be provided;
- (c) may specify the time at which, or the period within which, the information or documents must be provided;
- (d) may specify the place where the information or documents must be provided;
(but see the restrictions in subsections (5) to (7)).
@@ -3862,17 +3834,17 @@
- (b) the rights under sections 162 and 164 (appeals etc).
- (5) An information notice may not require a person to provide information before the end of the period within which an appeal can be brought against the notice.
- (6) If an appeal is brought against an information notice, the information need not be provided pending the determination or withdrawal of the appeal.
- (5) An information notice may not require a person to provide information or documents before the end of the period within which an appeal can be brought against the notice.
- (6) If an appeal is brought against an information notice, the information or documents need not be provided pending the determination or withdrawal of the appeal.
- (7) If an information notice—
- (a) states that, in the Commissioner's opinion, the information is required urgently, and
- (a) states that, in the Commissioner's opinion, the information or documents are required urgently, and
- (b) gives the Commissioner's reasons for reaching that opinion,
subsections (5) and (6) do not apply but the notice must not require the information to be provided before the end of the period of 24 hours beginning when the notice is given.
subsections (5) and (6) do not apply but the notice must not require the information or documents to be provided before the end of the period of 24 hours beginning when the notice is given.
- (8) The Commissioner may cancel an information notice by written notice to the person to whom it was given.
@@ -3892,17 +3864,17 @@
- (i) has reasonable grounds for suspecting that such a determination could be made, and
- (ii) the information is required for the purposes of making such a determination.
- (2) An information notice does not require a person to give the Commissioner information to the extent that requiring the person to do so would involve an infringement of the privileges of either House of Parliament.
- (3) An information notice does not require a person to give the Commissioner information in respect of a communication which is made—
- (ii) the information or documents are required for the purposes of making such a determination.
- (2) An information notice does not require a person to give the Commissioner information or documents to the extent that requiring the person to do so would involve an infringement of the privileges of either House of Parliament.
- (3) An information notice does not require a person to give the Commissioner information or documents to the extent that requiring the person to do so would result in the disclosure of a communication which is made—
- (a) between a professional legal adviser and the adviser's client, and
- (b) in connection with the giving of legal advice to the client with respect to obligations, liabilities or rights under the data protection legislation.
- (4) An information notice does not require a person to give the Commissioner information in respect of a communication which is made—
- (4) An information notice does not require a person to give the Commissioner information or documents to the extent that requiring the person to do so would result in the disclosure of a communication which is made—
- (a) between a professional legal adviser and the adviser's client or between such an adviser or client and another person,
@@ -3912,7 +3884,7 @@
- (5) In subsections (3) and (4), references to the client of a professional legal adviser include references to a person acting on behalf of the client.
- (6) An information notice does not require a person to provide the Commissioner with information if doing so would, by revealing evidence of the commission of an offence expose the person to proceedings for that offence.
- (6) An information notice does not require a person to provide the Commissioner with information or documents if doing so would, by revealing evidence of the commission of an offence expose the person to proceedings for that offence.
- (7) The reference to an offence in subsection (6) does not include an offence under—
@@ -3950,17 +3922,17 @@
- (2) The court may make an order requiring the person to provide to the Commissioner some or all of the following—
- (a) information referred to in the information notice;
- (b) other information which the court is satisfied the Commissioner requires, having regard to the statement included in the notice in accordance with section 142(2)(b).
- (a) information referred to in the information or documents notice;
- (b) other information or documents which the court is satisfied the Commissioner requires, having regard to the statement included in the notice in accordance with section 142(2)(b).
- (3) The order—
- (a) may specify the form in which the information must be provided,
- (b) must specify the time at which, or the period within which, the information must be provided, and
- (c) may specify the place where the information must be provided.
- (a) may specify the form in which the information or documents must be provided,
- (b) must specify the time at which, or the period within which, the information or documents must be provided, and
- (c) may specify the place where the information or documents must be provided.
### Assessment notices
@@ -4088,7 +4060,7 @@
- (1) This section applies where a person—
- (a) has been given an information notice requiring the person to provide the Commissioner with information, or
- (a) has been given an information or a document notice requiring the person to provide the Commissioner with information, or
- (b) has been given an assessment notice requiring the person to direct the Commissioner to a document, equipment or other material or to assist the Commissioner to view information.
@@ -4476,7 +4448,7 @@
- (3) In relation to information notices, the guidance must include—
- (a) provision specifying factors to be considered in determining the time at which, or the period within which, information is to be required to be provided;
- (a) provision specifying factors to be considered in determining the time at which, or the period within which, information or documents are to be required to be provided;
- (b) provision about the circumstances in which the Commissioner would consider it appropriate to give an information notice to a person in reliance on section 142(7) (urgent cases);
@@ -10519,11 +10491,11 @@
- (2) If the information notice—
- (a) states that, in the Commissioner's opinion, the information is required for the purposes of the relevant review, and
- (a) states that, in the Commissioner's opinion, the information or documents are required for the purposes of the relevant review, and
- (b) gives the Commissioner's reasons for reaching that opinion,
subsections (5) and (6) of section 142 do not apply but the notice must not require the information to be provided before the end of the period of 24 hours beginning when the notice is given.
subsections (5) and (6) of section 142 do not apply but the notice must not require the information or documents to be provided before the end of the period of 24 hours beginning when the notice is given.
#### Assessment notices
@@ -17332,6 +17304,10 @@
[^key-00c31acc0526af8b197626c45f603186]: S. 103 in force at 16.9.2019 by [S.I. 2019/1188](https://www.legislation.gov.uk/uksi/2019/1188), [reg. 2(c)](https://www.legislation.gov.uk/uksi/2019/1188/regulation/2/c)
[^key-00c758a7ac86c77eefdd5f1b71cbb8bf]: [S. 141A](https://www.legislation.gov.uk/ukpga/2018/12/section/141A) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 96(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/96/3), [142(3)(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/c)
[^key-0151e6e5fb83621e5135c6a115a3b8a7]: Words in [s. 145(2)(b)](https://www.legislation.gov.uk/ukpga/2018/12/section/145/2/b) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(4)(a)(ii)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/4/a/ii), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-019c61443b227cfc431617e576673df8]: [Sch. 19 para. 368](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/368) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-01e0b7c056d90098dda06c025884a600]: Sch. 1 para. 40 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
@@ -17348,6 +17324,8 @@
[^key-02c9392ccbfe5d518f4e56dba15b087b]: [Sch. 19 para. 139](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/139) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-02eed618ae57b0b75a35be24947c98f7]: Words in [s. 142(2)(b)](https://www.legislation.gov.uk/ukpga/2018/12/section/142/2/b) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(2)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/2/b), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-03a41268b1f986aee847dad7f0702a19]: Words in Sch. 2 para. 26(9)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(21)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/21/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-03be80b9d01d85e387feb8f4beaf6d2f]: [Sch. 19 para. 32](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/32) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -17364,6 +17342,8 @@
[^key-04a116e5e2b279f99e07bb7fc9c120bd]: [Sch. 19 para. 69](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/69) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-04cca2bcdf064e1c878b25ce5564c73c]: Words in [s. 142(1)(a)](https://www.legislation.gov.uk/ukpga/2018/12/section/142/1/a) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(2)(a)(i)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/2/a/i), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-04deb533ed57e15add641215ed3efabf]: Sch. 20 para. 46 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-055760fc82e5e2786df333ac02e415f3]: [Sch. 19 para. 297](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/297) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -17388,6 +17368,8 @@
[^key-078834edf1fff161c9e6fa81ce234817]: Words in s. 183(2)(d) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 78(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/78/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-07dd60af0f18471b7222d90e518ad588]: Words in [s. 143(1)(b)(ii)](https://www.legislation.gov.uk/ukpga/2018/12/section/143/1/b/ii) substituted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(3)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/3/a), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-07dee8d69012da87b02291e4c8e3d699]: Sch. 2 para. 11 table modified (28.1.2021 for specified purposes, 30.7.2022 in so far as not already in force) by [The Financial Services and Markets Act 2000 (Regulated Activities) (Amendment) Order 2021 (S.I. 2021/90)](https://www.legislation.gov.uk/uksi/2021/90), [arts. 1(2)](https://www.legislation.gov.uk/uksi/2021/90/article/1/2)[(3)](https://www.legislation.gov.uk/uksi/2021/90/article/1/3), [15(2)](https://www.legislation.gov.uk/uksi/2021/90/article/15/2)
[^key-07e5424a1ee2d09e154dd4e8255595ea]: Words in s. 73(3)(c) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 40(3)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/40/3/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -17562,6 +17544,8 @@
[^key-1c131e673e4b114091bed8a61ac7815e]: [Sch. 9 para. 3](https://www.legislation.gov.uk/ukpga/2018/12/schedule/9/paragraph/3) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-1c7da355aeeff85be527b5f792bfd29e]: Words in [Sch. 17 para. 2(2)](https://www.legislation.gov.uk/ukpga/2018/12/schedule/17/paragraph/2/2) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(7)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/7/b), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-1cc22440a757c75d6a761e14e8508d42]: Sch. 20 para. 18(8) inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 101(4)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/101/4/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)) (as amended by [S.I. 2020/1586](https://www.legislation.gov.uk/uksi/2020/1586), [regs. 1(2)](https://www.legislation.gov.uk/uksi/2020/1586/regulation/1/2), [5(3)](https://www.legislation.gov.uk/uksi/2020/1586/regulation/5/3)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-1ccd56afc99d98d997ea26936d814e5e]: [Sch. 7 para. 35](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/35) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
@@ -18012,6 +17996,8 @@
[^key-4ade17abe3f68bf256bff4f2dbb59e3d]: Sch. 20 para. 53 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4b642711f954150ccf908648bde13d63]: Words in [s. 148(1)(a)](https://www.legislation.gov.uk/ukpga/2018/12/section/148/1/a) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/5), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-4b9e6d497580985481a70ac53ffb3760]: [Sch. 19 para. 71](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/71) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4bf0023fc0abe3a6fe28e97ae0db6c8a]: [Sch. 19 para. 96](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/96) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -18042,6 +18028,8 @@
[^key-4e06da20a4ee2b31f0f19b9c470f9b8d]: Words in Sch. 1 para. 2(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 91(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/91/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-4e6c9c54c594cef5e10f575175d7fcbd]: Words in [s. 62(3)(a)](https://www.legislation.gov.uk/ukpga/2018/12/section/62/3/a) omitted (19.8.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 82(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/82/b), [142(3)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/b)
[^key-4ebd65ab97e317d6c230a09c8743e730]: [Sch. 19 para. 226](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/226) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4ed31dd55586adedeb9b02282604b867]: [Sch. 19 para. 93](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/93) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -18156,6 +18144,8 @@
[^key-5a464370d8822b40169ec522a8d773a6]: Words in s. 13(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 16](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/16) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-5a6036fabcdc44d7c894770800035004]: Words in [s. 142(6)](https://www.legislation.gov.uk/ukpga/2018/12/section/142/6) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(2)(e)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/2/e), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-5a993e31296f76eedd2958f4cd0fda2d]: Sch. 20 para. 41 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5aa83acfda81d5aca3a7d879d20c8168]: Words in s. 206 Table omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 86(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/86/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -18166,6 +18156,8 @@
[^key-5b3acd4e0294355b8e9efe356efa7aa4]: [Sch. 19 para. 272](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/272) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5b858014ae13f9f37bb30ecd8f277dba]: Words in [s. 160(3)(a)](https://www.legislation.gov.uk/ukpga/2018/12/section/160/3/a) substituted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/6), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-5bc0406a73661aa1415e2904b278ad74]: Words in s. 10(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 13(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/13/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-5c6ae5dec8a8b08bfa71e298026863d0]: S. 67(8) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 39](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/39) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -18178,6 +18170,8 @@
[^key-5caab894dc42fb6245859f88114c6ccf]: [Sch. 19 para. 60](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/60) in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5cb1dff5661525c0e4a57dfb72b1cf97]: Words in [s. 143(6)](https://www.legislation.gov.uk/ukpga/2018/12/section/143/6) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(3)(e)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/3/e), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-5cc8c98ed927a29271aa9009a37c3a98]: Words in Sch. 3 para. 7(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(10)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/10) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-5cca3ac8ac29e135e7479d669dca2466]: S. 21(5)(c) and word inserted (25.1.2023) by [Advanced Research and Invention Agency Act 2022 (c. 4)](https://www.legislation.gov.uk/ukpga/2022/4), [s. 13(1)](https://www.legislation.gov.uk/ukpga/2022/4/section/13/1), [Sch. 3 para. 15(2)(b)](https://www.legislation.gov.uk/ukpga/2022/4/schedule/3/paragraph/15/2/b); [S.I. 2023/58](https://www.legislation.gov.uk/uksi/2023/58), [reg. 2](https://www.legislation.gov.uk/uksi/2023/58/regulation/2)
@@ -18236,6 +18230,8 @@
[^key-61adeb92f11f45e0ec84df45e73f76e0]: [Sch. 19 para. 126](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/126) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-622f567d3f7f53ef9ee3fbcfe0629b1c]: Words in [s. 145(2)(a)](https://www.legislation.gov.uk/ukpga/2018/12/section/145/2/a) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(4)(a)(i)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/4/a/i), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-624b7f167b9be0eda00270c5e40aba6b]: Words in s. 15(4) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 19(10)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/19/10/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-624e37c2f534f473861144715410cd20]: Words in s. 33(7) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 37](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/37) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -18482,6 +18478,8 @@
[^key-7aac6a775a9db704483930b3b42f67b9]: Words in Sch. 2 para. 26(9)(c) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(21)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/21/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-7abc0fd05fa7ad3cbe8449b31011c957]: Words in [s. 143(2)](https://www.legislation.gov.uk/ukpga/2018/12/section/143/2) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(3)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/3/b), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-7acebc72466e110599be1c7c05f2d8a7]: Words in s. 5(7) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 6(6)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/6/6/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-7b7a7abcbe377f85ee79df3619288d0c]: [Sch. 12 para. 3](https://www.legislation.gov.uk/ukpga/2018/12/schedule/12/paragraph/3) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
@@ -18540,6 +18538,8 @@
[^key-7fd06888fb048ef993ef93ef456b6b5a]: [Sch. 19 para. 186](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/186) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-806566818913034ab4045ef294f2448c]: Words in [s. 142(3)(b)](https://www.legislation.gov.uk/ukpga/2018/12/section/142/3/b) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(2)(c)(ii)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/2/c/ii), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-8073dd715b8ba844756ab6ffb34393c2]: Words in s. 207(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 87(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/87/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-80aece53fcb0b6da0c128b207cec4326]: [Sch. 19 para. 51](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/51) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -18586,6 +18586,8 @@
[^key-847feaddc6148bc37c46c1a3e5b8905c]: Words in s. 17(1)(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 22(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/22/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-848884f60920ce824d9015773f496208]: Words in [s. 145(3)(c)](https://www.legislation.gov.uk/ukpga/2018/12/section/145/3/c) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(4)(b)(iii)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/4/b/iii), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-84eda6b71dbe3fa5e5686e74405328d3]: Words in [s. 129(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/129/1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 54](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/54) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-8536ab473caeb847327e2f5e6d40132d]: Sch. 20 para. 49 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -18680,6 +18682,8 @@
[^key-8fbe292ba1de6fbf2a9d7d97a4bad919]: [Sch. 7 para. 29](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/29) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-8fbe77f2f80f9eac71718adbbe021cbb]: Words in [s. 142(3)(c)](https://www.legislation.gov.uk/ukpga/2018/12/section/142/3/c) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(2)(c)(iii)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/2/c/iii), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-8fee20a32a0c94dd1be0c59c92f7d22d]: [Sch. 19 para. 28](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/28) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-905f3924a8759d0b5e86546e2ec79c8f]: Words in Sch. 18 para. 5(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 99(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/99/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -18712,6 +18716,8 @@
[^key-9327a9e51950d697f6ab1419608e7b34]: [Sch. 19 para. 351](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/351) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-93d483f8c1d9155ed4a8cdff56addef5]: Words in [s. 143(3)](https://www.legislation.gov.uk/ukpga/2018/12/section/143/3) substituted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(3)(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/3/c), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-9415718b0fd9928accda1024defbb8f1]: [Sch. 19 para. 246](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/246) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-946d65c9a908a33d2a45bde886433013]: Words in Sch. 5 para. 1(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 95(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/95/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -18722,6 +18728,8 @@
[^key-94dd0e117ae91630c416e9e8439ee602]: Words in Sch. 1 para. 1(3) substituted (15.12.2021) by [The UK Statistics (Amendment etc.) (EU Exit) Regulations 2021 (S.I. 2021/1300)](https://www.legislation.gov.uk/uksi/2021/1300), [regs. 1](https://www.legislation.gov.uk/uksi/2021/1300/regulation/1), [2](https://www.legislation.gov.uk/uksi/2021/1300/regulation/2)
[^key-9504f4a8ac0dcfd6ec9b9e414b62fd67]: Words in s. 206 Table substituted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 69(5)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/69/5/b), [142(3)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/a)
[^key-953b9df49e10ea57d7c67ec16df9d1c0]: Act excluded (30.9.2020) by [The Channel Tunnel (Arrangements with the Kingdom of the Netherlands) Order 2020 (S.I. 2020/916)](https://www.legislation.gov.uk/uksi/2020/916), [arts. 1(2)(b)](https://www.legislation.gov.uk/uksi/2020/916/article/1/2/b)[4(4)](https://www.legislation.gov.uk/uksi/2020/916/article/4/4)
[^key-9554afd386ff1a76b263966b60fc1907]: [Sch. 19 para. 132](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/132) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -18766,6 +18774,8 @@
[^key-98fa005db175e358483a9c7e427babf0]: [Sch. 19 para. 29](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/29) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-99ab7faa88ca562f58efadf0dd63b7d5]: [S. 34(2)(aa)](https://www.legislation.gov.uk/ukpga/2018/12/section/34/2/aa) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 69(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/69/3), [142(3)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/a)
[^key-9a01dffe8e031e6fd2dba2087a13223d]: Words in Sch. 18 para. 5(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 99(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/99/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-9a443c5bd0f1d495d7eb959fe3c7dfdd]: Sch. 1 para. 38 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
@@ -18778,6 +18788,8 @@
[^key-9a8be2cf53d7c39ed62f2d07d32d1c20]: Words in s. 1(4) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 2(4)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/2/4) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-9a8f19c35bf0a7a834eef9f953183f3e]: Words in [s. 143(4)](https://www.legislation.gov.uk/ukpga/2018/12/section/143/4) substituted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/3/d), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-9a96e2a08106565ada79467503826cb4]: [Sch. 19 para. 7](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/7) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9a9736041c34fdc367335955850c35ae]: Words in s. 159(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 65](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/65) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -18850,6 +18862,8 @@
[^key-a1c35c4d9fb9c6b8432b9c99b83faa06]: S. 104 in force at 16.9.2019 by [S.I. 2019/1188](https://www.legislation.gov.uk/uksi/2019/1188), [reg. 2(d)](https://www.legislation.gov.uk/uksi/2019/1188/regulation/2/d)
[^key-a209783a627c40caac27342bcc5a561d]: [S. 33(1A)](https://www.legislation.gov.uk/ukpga/2018/12/section/33/1A) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 69(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/69/2), [142(3)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/a)
[^key-a2536056f71e77d12ec0552af9cdb0ae]: [Sch. 19 para. 14](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/14) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a2c39c1b8f50d64d3eab992537ab337c]: Words in s. 5(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 6(4)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/6/4) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -18858,6 +18872,8 @@
[^key-a3763554b09060538700226200e56386]: S. 205: power to amend conferred (19.6.2025 for specified purposes) by Regulation (EU) 679/2016, Art. 11A(3) (as inserted by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 74(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/74/1), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h))
[^key-a3a1a5f2e7f8e2b0b3f53919b3ac198d]: [S. 40A](https://www.legislation.gov.uk/ukpga/2018/12/section/40A) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 69(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/69/4), [142(3)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/a)
[^key-a3c0ce05bf3da8355e376954eddca53f]: [Sch. 7 para. 52](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/52) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-a3ce48c816fb2bf06559889b7357e5f6]: [Sch. 19 para. 330](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/330) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -18910,6 +18926,8 @@
[^key-a72ed094e92b1e77b75e2da52e1bc7c9]: Word in Sch. 20 para. 14(2) substituted (5.5.2023) by [The Data Protection Act 2018 (Transitional Provision) Regulations 2023 (S.I. 2023/414)](https://www.legislation.gov.uk/uksi/2023/414), [regs. 1(1)](https://www.legislation.gov.uk/uksi/2023/414/regulation/1/1), [2(2)](https://www.legislation.gov.uk/uksi/2023/414/regulation/2/2)
[^key-a739cdcdc195e4fb2edfded1346676b6]: Words in s. 206 Table substituted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 69(5)(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/69/5/c), [142(3)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/a)
[^key-a8f58512cb57f396c3a6b2d0a2120804]: [Sch. 19 para. 179](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/179) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a92af31a14937e990ce7e02e2e9d9f29]: Words in s. 10(5) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 13(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/13/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -18954,6 +18972,8 @@
[^key-af0b63f67e273e6e110ffcb6b31502f4]: [Sch. 19 para. 148](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/148) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-af57db229127ba08efca2914d468d760]: Words in [s. 206](https://www.legislation.gov.uk/ukpga/2018/12/section/206) Table inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 69(5)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/69/5/a), [142(3)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/a)
[^key-af704cdbd7c856f0edbefe85c657cb92]: [Sch. 19 para. 24](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/24) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b00c0f26a2d6a3755a47ccea8a91b596]: [Sch. 19 para. 339](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/339) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -19036,6 +19056,8 @@
[^key-b6fec47aa194969dfe8a3a6fea4187d8]: [Sch. 19 para. 64](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/64) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b74eac71c37329b024002780a5fef5e4]: Words in [s. 145(3)(b)](https://www.legislation.gov.uk/ukpga/2018/12/section/145/3/b) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(4)(b)(ii)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/4/b/ii), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-b7ec9fe5f8e02209dbf599741d3c734a]: Words in s. 187(1)(a) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 81(3)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/81/3/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-b809b11818db07b6251c81d14a36f7e5]: Sch. 1 para. 31 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
@@ -19134,6 +19156,8 @@
[^key-c2ac2fbd7eae86c3237b0fea08970942]: [Sch. 19 para. 147](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/147) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c2e61291573249529347dd623ad3293e]: Words in [s. 62(2)(a)](https://www.legislation.gov.uk/ukpga/2018/12/section/62/2/a) omitted (19.8.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 82(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/82/a), [142(3)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/b)
[^key-c2ef1f00c16c6ae79e671982664ebcb6]: Sch. 1 para. 7 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-c356bafc244fdc4ace9be54cbc58a2b8]: [Sch. 19 para. 220](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/220) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -19220,6 +19244,8 @@
[^key-cba88e2b39b826968769027cc29370be]: Words in [s. 135(4)](https://www.legislation.gov.uk/ukpga/2018/12/section/135/4) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 56](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/56) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-cbd94f2658bc57fc8fc318640494c0a5]: Words in [s. 142(1)(b)](https://www.legislation.gov.uk/ukpga/2018/12/section/142/1/b) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(2)(a)(ii)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/2/a/ii), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-cc268dff7489493500857e0da3d30cf8]: [Sch. 19 para. 281](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/281) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-cc7111f2b8b984b394cb92bb7c3a96cd]: [Sch. 19 para. 58](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/58) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -19258,6 +19284,8 @@
[^key-cfd37790b8a4ffc332af6e54afe597a3]: Words in s. 187(1) substituted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 81(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/81/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-d00ce2fcbaade283e75e389abfb338a5]: Words in [s. 142(7)(a)](https://www.legislation.gov.uk/ukpga/2018/12/section/142/7/a) substituted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(2)(f)(i)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/2/f/i), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-d00de55d7e460f218dbfdfc1cc28e86a]: [Sch. 19 para. 84](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/84) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-d035aebb324ef6e0087dfa27a2360edd]: [Sch. 19 para. 394](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/394) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -19276,6 +19304,10 @@
[^key-d1c4a5b8f04832edf2cb03e6ea265e7c]: Sch. 1 para. 17 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-d1e521f76cff5bf58b8f1dc7a0d91bc7]: Words in [s. 142(3)(d)](https://www.legislation.gov.uk/ukpga/2018/12/section/142/3/d) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(2)(c)(iv)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/2/c/iv), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-d20f31dc69bcc1af64583a26735ded5d]: Words in [s. 142(7)](https://www.legislation.gov.uk/ukpga/2018/12/section/142/7) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(2)(f)(ii)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/2/f/ii), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-d215058b7b57e3a9731a7ad5e4301724]: Words in s. 11(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 14](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/14) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-d21cee9d28e7ef117ac498fbed58738e]: [Sch. 14 para. 10](https://www.legislation.gov.uk/ukpga/2018/12/schedule/14/paragraph/10) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
@@ -19344,6 +19376,8 @@
[^key-d975bf9312ec73c1e21013621d4551b6]: Sch. 2 para. 14 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-d984e406ba6c8bd6120e59d9431cf357]: Words in [s. 145(3)(a)](https://www.legislation.gov.uk/ukpga/2018/12/section/145/3/a) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(4)(b)(i)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/4/b/i), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-d9d4a5328d371f45edc310525d5e56ca]: S. 195 in force at 23.7.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 3(l)](https://www.legislation.gov.uk/uksi/2018/625/regulation/3/l)
[^key-d9e75b820dadd4eac2b1032ec6c6a4da]: [Sch. 19 para. 258](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/258) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -19366,6 +19400,8 @@
[^key-dbdad71b9ade64a8f7fdfc45c071f848]: Words in Sch. 3 para. 17(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(15)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/15) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-dbf19877200981f2490768f60ea3c413]: Words in [s. 142(3)(a)](https://www.legislation.gov.uk/ukpga/2018/12/section/142/3/a) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(2)(c)(i)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/2/c/i), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-dc321b64fd0fcd1ec60ef61441b8fafc]: [Sch. 8 para. 6](https://www.legislation.gov.uk/ukpga/2018/12/schedule/8/paragraph/6) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-dc40b789ba49496fa957bb0b48f33a2b]: [Sch. 19 para. 77](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/77) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -19448,6 +19484,8 @@
[^key-e2dd47d0a543b3e922e9c971f2a8baa4]: Words in s. 24(5) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 32(5)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/32/5/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-e338aaf5150d0a7060979adcdbf6939c]: Words in [s. 142(5)](https://www.legislation.gov.uk/ukpga/2018/12/section/142/5) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(2)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/2/d), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-e36726ddad796892b59de71bc71fac9c]: [Sch. 11 para. 4](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/4) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-e36f3d79dc2160326592a45b956bcee2]: Words in s. 80(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 46(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/46/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -19542,6 +19580,8 @@
[^key-ec4c69b934ac57e2e43214a23dcbb96d]: [Sch. 11 para. 9](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/9) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-ecd963be2d9ad18f7a9f6e41564e4d88]: [S. 141](https://www.legislation.gov.uk/ukpga/2018/12/section/141) omitted (19.8.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 96(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/96/2), [142(3)(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/c)
[^key-eced7daf0a93577817bcb97bd3948271]: S. 21 cross-heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 28](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/28) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-ed498558e2f05ed1eacf387d181f2ea5]: Words in Sch. 3 para. 20 cross-heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(18)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/18) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -19590,6 +19630,8 @@
[^key-f1ea12c4ad88d4f388ce1587dd4bb8fa]: [Sch. 19 para. 116](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/116) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-f20feb5a7d640516e02fd28df4b58c7a]: Words in [Sch. 17 para. 2(2)(a)](https://www.legislation.gov.uk/ukpga/2018/12/schedule/17/paragraph/2/2/a) substituted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(7)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/7/a), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-f251ec0fb7d1f9d415237244a6167b7b]: [Sch. 19 para. 237](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/237) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-f26231d3616eb287b3ee33c4cae88815]: Words in Sch. 20 Pt. 3 heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 101(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/101/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -19736,8 +19778,6 @@
[^M_I_0540997b-4e51-47d5-e2c2-f361a535020a]: Sch. 5 para. 4 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_058f5ee4-0c32-422e-d9f3-b212d036db5e]: S. 141 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_06b96688-7c53-468d-c866-e9a1041b7743]: S. 78 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_081cd2df-3e5a-48e3-eb7d-b50353ce04d1]: Sch. 2 para. 11 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
@@ -20822,7 +20862,7 @@
- (5) In this section, “*pre-commencement enactment*” means an enactment so far as passed or made before the day on which section 106(4) of the Data (Use and Access) Act 2025 comes into force, other than an enactment contained in, or made under, a provision listed in section 186(2) or (3).
#### Overview
#### Protection of personal data
### Relevant international law
@@ -20846,9 +20886,9 @@
- (6) In this section, “*treaty*” and “*ratified*” have the same meaning as in Part 2 of the Constitutional Reform and Governance Act 2010 (see section 25 of that Act).
#### Special categories of personal data etc: supplementary
#### Manual unstructured data used in longstanding historical research
#### Limits on fees that may be charged by controllers
#### National security and defence exemption
##### 42A
@@ -21204,7 +21244,7 @@
## Schedule 12A
#### Status
#### Number of members
##### 1
@@ -21606,6 +21646,82 @@
- (b) references to the payment of pensions, allowances or gratuities to or in respect of a person include references to the making of payments towards the provision of pensions, allowances or gratuities to be paid to or in respect of a person.
#### The applied GPDR
#### Merger of the directly applicable GDPR and the applied GDPR
#### GDPR: right to an effective remedy against the Commissioner
##### 40A
- (1) This section is about processing of personal data that is carried out in reliance on the consent of the data subject.
- (2) The controller must be able to demonstrate that the data subject consented to the processing.
- (3) If the data subject’s consent is given in writing as part of a document which also concerns other matters, the request for consent must be made—
- (a) in a manner which clearly distinguishes the request from the other matters,
- (b) in an intelligible and easily accessible form, and
- (c) in clear and plain language.
- (4) Any part of a document described in subsection (3) which constitutes an infringement of this Part is not binding.
- (5) The data subject may withdraw the consent at any time (but the withdrawal of consent does not affect the lawfulness of processing in reliance on the consent before its withdrawal).
- (6) Processing may only be carried out in reliance on consent if—
- (a) before the consent is given, the controller or processor informs the data subject of the right to withdraw it, and
- (b) it is as easy for the data subject to withdraw the consent as to give it.
- (7) When assessing whether consent is freely given, account must be taken of, among other things, whether the provision of a service is conditional on consent to the processing of personal data that is not necessary for the provision of that service.
##### 141A
- (1) This section applies in relation to a notice authorised or required by this Act to be given to a person by the Commissioner.
- (2) The notice may be given to the person by—
- (a) delivering it by hand to a relevant individual,
- (b) leaving it at the person’s proper address,
- (c) sending it by post to the person at that address, or
- (d) sending it by email to the person’s email address.
- (3) A “*relevant individual*” means—
- (a) in the case of a notice to an individual, that individual;
- (b) in the case of a notice to a body corporate (other than a partnership), an officer of that body;
- (c) in the case of a notice to a partnership, a partner in the partnership or a person who has the control or management of the partnership business;
- (d) in the case of a notice to an unincorporated body (other than a partnership), a member of its governing body.
- (4) For the purposes of subsection (2)(b) and (c), and section 7 of the Interpretation Act 1978 (services of documents by post) in its application to those provisions, a person’s proper address is—
- (a) in a case where the person has specified an address as one at which the person, or someone acting on the person’s behalf, will accept service of notices or other documents, that address;
- (b) in any other case, the address determined in accordance with subsection (5).
- (5) The address is—
- (a) in a case where the person is a body corporate with a registered office in the United Kingdom, that office;
- (b) in a case where paragraph (a) does not apply and the person is a body corporate, partnership or unincorporated body with a principal office in the United Kingdom, that office;
- (c) in any other case, an address in the United Kingdom at which the Commissioner believes, on reasonable grounds, that the notice will come to the attention of the person.
- (6) A person’s email address is—
- (a) an email address published for the time being by that person as an address for contacting that person, or
- (b) if there is no such published address, an email address by means of which the Commissioner believes, on reasonable grounds, that the notice will come to the attention of that person.
- (7) A notice sent by email is treated as given 48 hours after it was sent, unless the contrary is proved.
- (8) In this section, “*officer*”, in relation to a body corporate, means a director, manager, secretary or other similar officer of the body.
- (9) This section does not limit other lawful means of giving a notice.
2025-06-19
Data Protection Act 2018
2025-04-01
Data Protection Act 2018
2024-12-13
Data Protection Act 2018
2024-03-08
Data Protection Act 2018
2024-01-01
Data Protection Act 2018
2023-12-31
Data Protection Act 2018
2023-12-26
Data Protection Act 2018
2023-05-05
Data Protection Act 2018
2023-02-01
Data Protection Act 2018
2022-11-30
Data Protection Act 2018
2022-07-30
Data Protection Act 2018
2022-03-18
Data Protection Act 2018
2022-01-31
Data Protection Act 2018
2021-12-17
Data Protection Act 2018
2021-12-15
Data Protection Act 2018
2021-01-28
Data Protection Act 2018
2020-12-31
Data Protection Act 2018
2020-09-30
Data Protection Act 2018
2020-02-14
Data Protection Act 2018
2019-12-02
Data Protection Act 2018
2019-09-16
Data Protection Act 2018
2019-07-21
Data Protection Act 2018
2019-05-23
Data Protection Act 2018
2019-03-29
Data Protection Act 2018
2018-07-23
Data Protection Act 2018
2018-05-25
Data Protection Act 2018
2018-05-23
Data Protection Act 2018
original version
Text at this date