LegalizeReform history
Data Protection Act 2018
32 versions
· 2018-05-23
2026-04-07
Data Protection Act 2018
2026-03-31
Data Protection Act 2018
2026-03-10
Data Protection Act 2018
Changes on 2026-03-10
@@ -156,7 +156,7 @@
##### 6
- (1) The definition of “controller” in Article 4(7) of the UK GDPR has effect subject to—
- (1) The definition of “controller” in Article 4(1)(7) of the UK GDPR has effect subject to—
- (a) subsection (2),
@@ -220,7 +220,7 @@
##### 8
In Article 6(1) of the UK GDPR (lawfulness of processing), the reference in point (e) to processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of the controller's official authority includes processing of personal data that is necessary for—
In Article 6(1) of the UK GDPR (lawfulness of processing), the reference in point (e) to processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of ... official authority includes processing of personal data that is necessary for—
- (a) the administration of justice,
@@ -326,53 +326,7 @@
##### 14
- (1) This section makes provision for the purposes of Article 22(2)(b) of the UK GDPR (exception from Article 22(1) of the UK GDPR for significant decisions based solely on automated processing that are required or authorised under the law of the United Kingdom or a part of the United Kingdom and subject to safeguards for the data subject's rights, freedoms and legitimate interests).
- (2) A decision is a “*significant decision*” for the purposes of this section if, in relation to a data subject, it—
- (a) produces legal effects concerning the data subject, or
- (b) similarly significantly affects the data subject.
- (3) A decision is a “*qualifying significant decision*” for the purposes of this section if—
- (a) it is a significant decision in relation to a data subject,
- (b) it is required or authorised by law, and
- (c) it does not fall within Article 22(2)(a) or (c) of the UK GDPR (decisions necessary to a contract or made with the data subject's consent).
- (4) Where a controller takes a qualifying significant decision in relation to a data subject based solely on automated processing—
- (a) the controller must, as soon as reasonably practicable, notify the data subject in writing that a decision has been taken based solely on automated processing, and
- (b) the data subject may, before the end of the period of 1 month beginning with receipt of the notification, request the controller to—
- (i) reconsider the decision, or
- (ii) take a new decision that is not based solely on automated processing.
- (5) If a request is made to a controller under subsection (4), the controller must, within the period described in Article 12(3) of the UK GDPR—
- (a) consider the request, including any information provided by the data subject that is relevant to it,
- (b) comply with the request, and
- (c) by notice in writing inform the data subject of—
- (i) the steps taken to comply with the request, and
- (ii) the outcome of complying with the request.
- (6) In connection with this section, a controller has the powers and obligations under Article 12 of the UK GDPR (transparency, procedure for extending time for acting on request, fees, manifestly unfounded or excessive requests etc) that apply in connection with Article 22 of the UK GDPR.
- (7) The Secretary of State may by regulations make such further provision as the Secretary of State considers appropriate to provide suitable measures to safeguard a data subject's rights, freedoms and legitimate interests in connection with the taking of qualifying significant decisions based solely on automated processing.
- (8) Regulations under subsection (7)—
- (a) may amend this section, and
- (b) are subject to the affirmative resolution procedure.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
### Exemptions etc
@@ -468,59 +422,21 @@
- “*the UK national accreditation body*” means the UK national accreditation body for the purposes of Article 4(1) of Regulation [(EC) No 765/2008](https://www.legislation.gov.uk/eur/2008/765) of the European Parliament and of the Council of 9 July 2008 setting out the requirements for accreditation and market surveillance relating to the marketing of products and repealing Regulation [(EEC) No 339/93](https://www.legislation.gov.uk/eur/1993/339).
### Transfers of personal data to third countries etc
### ...
#### Transfers of personal data to third countries etc
##### 18
- (1) The Secretary of State may by regulations specify, for the purposes of Article 49(1)(d) of the UK GDPR—
- (a) circumstances in which a transfer of personal data to a third country or international organisation is to be taken to be necessary for important reasons of public interest, and
- (b) circumstances in which a transfer of personal data to a third country or international organisation which is not required by an enactment is not to be taken to be necessary for important reasons of public interest.
- (2) The Secretary of State may by regulations restrict the transfer of a category of personal data to a third country or international organisation where—
- (a) the transfer cannot take place based on adequacy regulations (see section 17A), and
- (b) the Secretary of State considers the restriction to be necessary for important reasons of public interest.
- (3) Regulations under this section—
- (a) are subject to the made affirmative resolution procedure where the Secretary of State has made an urgency statement in respect of them;
- (b) are otherwise subject to the affirmative resolution procedure.
- (4) For the purposes of this section, an urgency statement is a reasoned statement that the Secretary of State considers it desirable for the regulations to come into force without delay.
### Specific processing situations
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
### ...
#### Processing for archiving, research and statistical purposes: safeguards
##### 19
- (1) This section makes provision about—
- (a) processing of personal data that is necessary for archiving purposes in the public interest,
- (b) processing of personal data that is necessary for scientific or historical research purposes, and
- (c) processing of personal data that is necessary for statistical purposes.
- (2) Such processing does not satisfy the requirement in Article 89(1) of the UK GDPR for the processing to be subject to appropriate safeguards for the rights and freedoms of the data subject if it is likely to cause substantial damage or substantial distress to a data subject.
- (3) Such processing does not satisfy that requirement if the processing is carried out for the purposes of measures or decisions with respect to a particular data subject, unless the purposes for which the processing is necessary include the purposes of approved medical research.
- (4) In this section—
- “*approved medical research*” means medical research carried out by a person who has approval to carry out that research from—a research ethics committee recognised or established by the Health Research Authority under Chapter 2 of Part 3 of the Care Act 2014, ora body appointed by any of the following for the purpose of assessing the ethics of research involving individuals—the Secretary of State, the Scottish Ministers, the Welsh Ministers, or a Northern Ireland department;a relevant NHS body;United Kingdom Research and Innovation or a body that is a Research Council for the purposes of the Science and Technology Act 1965;an institution that is a research institution for the purposes of Chapter 4A of Part 7 of the Income Tax (Earnings and Pensions) Act 2003 (see section 457 of that Act);
- “*relevant NHS body*” means—an NHS trust or NHS foundation trust in England,an NHS trust or Local Health Board in Wales,a Health Board or Special Health Board constituted under section 2 of the National Health Service (Scotland) Act 1978,the Common Services Agency for the Scottish Health Service, orany of the health and social care bodies in Northern Ireland falling within paragraphs (a) to (e) of section 1(5) of the Health and Social Care (Reform) Act (Northern Ireland) 2009 (c. 1 (N.I.)).
- (5) The Secretary of State may by regulations change the meaning of “*approved medical research*” for the purposes of this section, including by amending subsection (4).
- (6) Regulations under subsection (5) are subject to the affirmative resolution procedure.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
### Minor definition
@@ -628,9 +544,9 @@
- (iv) Article 21(1) (objections to processing);
- (c) in Chapter V of the UK GDPR, Articles 44 to 49 (transfers of personal data to third countries or international organisations);
- (ca) in Part 2 of this Act, sections 17A, 17B and 17C (transfers to third countries);
- (c) in Chapter V of the UK GDPR, Articles 44A to 49A (transfers of personal data to third countries or international organisations);
- (ca) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (cb) in Part 5 of this Act, section 119A (standard clauses for transfers to third countries);
@@ -664,6 +580,8 @@
- (b) Chapter IV (controller and processor);
- (ba) Chapter 8A (safeguards for processing for research, archiving or statistical purposes);
- (c) Chapter IX (specific processing situations).
- (5) A controller is not obliged to comply with Article 15(1) to (3) of the UK GDPR (right of access by the data subject) in relation to personal data to which the UK GDPR applies by virtue of Article 2(1A) if—
@@ -754,7 +672,7 @@
- (ii) Article 84 (penalties);
- (fa) in Part 2 of this Act, sections 17A, 17B and 17C (transfers to third countries);
- (fa) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (g) in Part 5 of this Act—
@@ -1030,9 +948,9 @@
- (1) The second data protection principle is that—
- (a) the law enforcement purpose for which personal data is collected on any occasion must be specified, explicit and legitimate, and
- (b) personal data so collected must not be processed in a manner that is incompatible with the purpose for which it was collected.
- (a) the law enforcement purpose for which personal data is collected (whether from the data subject or otherwise) must be specified, explicit and legitimate, and
- (b) personal data so collected must not be processed by or on behalf of a controller in a manner that is incompatible with the purpose for which the controller collected it.
- (2) Paragraph (b) of the second data protection principle is subject to subsections (3) and (4).
@@ -1100,7 +1018,7 @@
##### 41
- (1) This section applies in relation to the processing of personal data for a law enforcement purpose where the processing is necessary—
- (1) This section applies in relation to the processing of personal data for a law enforcement purpose where the processing is carried out—
- (a) for archiving purposes in the public interest,
@@ -1164,7 +1082,7 @@
- (c) confers rights on the data subject with respect to the rectification of personal data and the erasure of personal data or the restriction of its processing (see sections 46 to 48);
- (d) regulates automated decision-making (see sections 49 and 50);
- (d) regulates automated decision-making (see sections 50A to 50D);
- (e) makes supplementary provision (see sections 51 to 54).
@@ -1296,7 +1214,7 @@
- (e) protect the rights and freedoms of others.
- (5) Where the rights of a data subject under subsection (1) are restricted under subsection (4), wholly or partly, the controller must inform the data subject in writing without undue delay—
- (5) Where the rights of a data subject under subsection (1) are restricted under subsection (4), wholly or partly, the controller must inform the data subject in writing without undue delay and in any event before the end of the applicable time period (as to which see section 54)—
- (a) that the rights of the data subject have been restricted,
@@ -1418,55 +1336,13 @@
##### 49
- (1) A controller may not take a significant decision based solely on automated processing unless that decision is required or authorised by law.
- (2) A decision is a “significant decision” for the purpose of this section if, in relation to a data subject, it—
- (a) produces an adverse legal effect concerning the data subject, or
- (b) significantly affects the data subject.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### Automated decision-making authorised by law: safeguards
##### 50
- (1) A decision is a “*qualifying significant decision*” for the purposes of this section if—
- (a) it is a significant decision in relation to a data subject, and
- (b) it is required or authorised by law.
- (2) Where a controller takes a qualifying significant decision in relation to a data subject based solely on automated processing—
- (a) the controller must, as soon as reasonably practicable, notify the data subject in writing that a decision has been taken based solely on automated processing, and
- (b) the data subject may, before the end of the period of 1 month beginning with receipt of the notification, request the controller to—
- (i) reconsider the decision, or
- (ii) take a new decision that is not based solely on automated processing.
- (3) If a request is made to a controller under subsection (2), the controller must, before the end of the period of 1 month beginning with receipt of the request—
- (a) consider the request, including any information provided by the data subject that is relevant to it,
- (b) comply with the request, and
- (c) by notice in writing inform the data subject of—
- (i) the steps taken to comply with the request, and
- (ii) the outcome of complying with the request.
- (4) The Secretary of State may by regulations make such further provision as the Secretary of State considers appropriate to provide suitable measures to safeguard a data subject's rights, freedoms and legitimate interests in connection with the taking of qualifying significant decisions based solely on automated processing.
- (5) Regulations under subsection (4)—
- (a) may amend this section, and
- (b) are subject to the affirmative resolution procedure.
- (6) In this section “*significant decision*” has the meaning given by section 49(2).
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
### Supplementary
@@ -1510,27 +1386,27 @@
##### 52
- (1) The controller must take reasonable steps to ensure that any information that is required by this Chapter to be provided to the data subject is provided in a concise, intelligible and easily accessible form, using clear and plain language.
- (1) The controller must take reasonable steps to ensure that any information that is required by or under this Chapter to be provided to the data subject is provided in a concise, intelligible and easily accessible form, using clear and plain language.
- (2) Subject to subsection (3), the information may be provided in any form, including electronic form.
- (3) Where information is provided in response to a request by the data subject under section 45, 46, 47 or 50, the controller must provide the information in the same form as the request where it is practicable to do so.
- (4) Where the controller has reasonable doubts about the identity of an individual making a request under section 45, 46 or 47, the controller may—
- (3) Where information is provided in response to a request made by the data subject under or by virtue of any of sections 45, 46, 47, 50C or 50D, the controller must provide the information in the same form as the request where it is practicable to do so.
- (4) Where the controller has reasonable doubts about the identity of an individual making a request under or by virtue of any of sections 45, 46, 47, 50C or 50D, the controller may—
- (a) request the provision of additional information to enable the controller to confirm the identity, and
- (b) delay dealing with the request until the identity is confirmed.
- (5) Subject to section 53, any information that is required by this Chapter to be provided to the data subject must be provided free of charge.
- (6) The controller must facilitate the exercise of the rights of the data subject under sections 45 to 50.
- (5) Subject to section 53, any information that is required by or under this Chapter to be provided to the data subject must be provided free of charge.
- (6) The controller must facilitate the exercise of the rights of the data subject arising under or by virtue of sections 45 to 50D.
#### Manifestly unfounded or excessive requests by the data subject
##### 53
- (1) Where a request from a data subject under section 45, 46, 47 or 50 is manifestly unfounded or excessive, the controller may—
- (1) Where a request made by a data subject under or by virtue of any of sections 45, 46, 47, 50C or 50D is manifestly unfounded or excessive, the controller may—
- (a) charge a reasonable fee for dealing with the request, or
@@ -1538,7 +1414,7 @@
- (2) An example of a request that may be excessive is one that merely repeats the substance of previous requests.
- (3) In any proceedings where there is an issue as to whether a request under section 45, 46, 47 or 50 is manifestly unfounded or excessive, it is for the controller to show that it is.
- (3) In any proceedings where there is an issue as to whether a request described in subsection (1) is manifestly unfounded or excessive, it is for the controller to show that it is.
- (4) The Secretary of State may by regulations specify limits on the fees that a controller may charge in accordance with subsection (1)(a).
@@ -1548,15 +1424,27 @@
- (b) specify what the guidance must include.
- (5) Regulations under subsection (4) are subject to the negative resolution procedure.
- (5) Regulations under this section are subject to the negative resolution procedure.
- (6) If, in reliance on subsection (1)(b), the controller does not take action on the request, the controller must inform the data subject of—
- (a) the reasons for not doing so, and
- (b) the data subject’s right to lodge a complaint with the Commissioner.
- (7) The controller must comply with subsection (6)—
- (a) without undue delay, and
- (b) in any event, before the end of the applicable time period (as to which see section 54).
#### Meaning of “applicable time period”
##### 54
- (1) This section defines “*the applicable time period*” for the purposes of sections 45(3)(b) and 48(2)(b).
- (2) “*The applicable time period*” means the period of 1 month, or such longer period as may be specified in regulations, beginning with the relevant time.
- (1) This section defines “*the applicable time period*” for the purposes of sections 45(3)(b) and (5) , 48(2)(b) and 53(7).
- (2) “*The applicable time period*” means the period of one month beginning with the relevant time , subject to subsection (3A).
- (3) “*The relevant time*” means the latest of the following—
@@ -1566,11 +1454,35 @@
- (c) when the fee (if any) charged in connection with the request under section 53 is paid.
- (4) The power to make regulations under subsection (2) is exercisable by the Secretary of State.
- (5) Regulations under subsection (2) may not specify a period which is longer than 3 months.
- (6) Regulations under subsection (2) are subject to the negative resolution procedure.
- (3A) The controller may, by giving notice to the data subject, extend the applicable time period by two further months where that is necessary by reason of—
- (a) the complexity of requests made by the data subject, or
- (b) the number of such requests.
- (3B) A notice under subsection (3A) must—
- (a) be given before the end of the period of one month beginning with the relevant time, and
- (b) state the reasons for the delay.
- (3C) Where the controller reasonably requires further information in order to identify the information or processing activities to which a request under section 45(1) relates—
- (a) the controller may ask the data subject to provide the further information, and
- (b) the period beginning with the day on which the controller makes the request and ending with the day on which the controller receives the information does not count towards—
- (i) the applicable time period, or
- (ii) the period described in subsection (3B)(a).
- (3D) An example of a case in which a controller may reasonably require further information is where the controller processes a large amount of information concerning the data subject.
- (4) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (5) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (6) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
### CHAPTER 4 — Controller and processor
@@ -2064,7 +1976,7 @@
- (a) sections 73 to 76 set out the general conditions that apply;
- (b) section 77 sets out the special conditions that apply where the intended recipient of personal data is not a relevant authority in a third country or an international organisation;
- (b) section 77 sets out additional conditions that apply in certain cases where the intended recipient of personal data is not a relevant authority in a third country or an international organisation (see section 73(4)(b));
- (c) section 78 makes special provision about subsequent transfers of personal data.
@@ -2076,35 +1988,45 @@
##### 73
- (1) A controller may not transfer personal data to a third country or to an international organisation unless—
- (a) the three conditions set out in subsections (2) to (4) are met, and
- (b) in a case where the personal data was originally transmitted or otherwise made available to the controller or another competent authority by a member State ..., that member State, or any person based in that member State which is a competent authority for the purposes of the Law Enforcement Directive, has authorised the transfer in accordance with the law of the member State.
- (A1) This section applies in relation to a transfer of personal data to a third country or international organisation for a law enforcement purpose.
- (1) The controller in relation to the transfer must secure that the transfer takes place only if—
- (a) the three conditions set out in subsections (2) to (4) are met, ...
- (b) in a case where the personal data was originally transmitted or otherwise made available to the controller or another competent authority by a member State ..., that member State, or any person based in that member State which is a competent authority for the purposes of the Law Enforcement Directive, has authorised the transfer in accordance with the law of the member State , and—
- (c) the transfer is carried out in accordance with the other provisions of this Part.
- (2) Condition 1 is that the transfer is necessary for any of the law enforcement purposes.
- (3) Condition 2 is that the transfer—
- (a) is based on adequacy regulations (see section 74A),
- (b) if not based on adequacy regulations, is based on there being appropriate safeguards (see section 75), or
- (c) if not based on adequacy regulations or on there being appropriate safeguards, is based on special circumstances (see section 76).
- (a) is approved by regulations under section 74AA that are in force at the time of the transfer,
- (b) is made subject to appropriate safeguards (see section 75), or
- (c) is based on special circumstances (see section 76).
- (4) Condition 3 is that—
- (a) the intended recipient is a relevant authority in a third country or an international organisation that is a relevant international organisation, or
- (a) the intended recipient is a relevant authority in a third country or an international organisation that is a relevant international organisation,
- (aa) the intended recipient is a person in a third country who—
- (i) is not a person described in paragraph (a), but
- (ii) is a processor whose processing, on behalf of the controller, of the personal data transferred is governed by, or authorised in accordance with, a contract with the controller that complies with section 59, or
- (b) in a case where the controller is a competent authority specified in any of paragraphs 5 to 17, 21, 24 to 28, 34 to 51, 54 and 56 of Schedule 7—
- (i) the intended recipient is a person in a third country other than a relevant authority, and
- (i) the intended recipient is a person in a third country who is not a person described in paragraph (a) or (aa), and
- (ii) the additional conditions in section 77 are met.
- (5) Authorisation is not required as mentioned in subsection (1)(b) if—
- (a) the transfer is necessary for the prevention of an immediate and serious threat either to the public security of ... a third country or to the essential interests of a member State, and
- (a) the transfer is necessary for the prevention of an immediate and serious threat to the public security, national security or essential interests of a third country or the United Kingdom, and
- (b) the authorisation cannot be obtained in good time.
@@ -2122,15 +2044,17 @@
##### 75
- (1) A transfer of personal data to a third country or an international organisation is based on there being appropriate safeguards where—
- (a) a legal instrument containing appropriate safeguards for the protection of personal data binds the intended recipient of the data, or
- (b) the controller, having assessed all the circumstances surrounding transfers of that type of personal data to the third country or international organisation, concludes that appropriate safeguards exist to protect the data.
- (2) The controller must inform the Commissioner about the categories of data transfers that take place in reliance on subsection (1)(b).
- (3) Where a transfer of data takes place in reliance on subsection (1)—
- (1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (1A) A transfer of personal data to a third country or an international organisation is made subject to appropriate safeguards only if—
- (a) an appropriate legal instrument binds the intended recipient of the data (see subsection (4)), or
- (b) the controller, acting reasonably and proportionately, considers that the data protection test is met in relation to the transfer or that type of transfer (see subsection (5)).
- (2) The controller must inform the Commissioner about the categories of data transfers that take place in reliance on subsection (1A)(b) but not in reliance on section 73(4)(aa) (transfer to processor).
- (3) Where a transfer of data takes place in reliance on this section but not in reliance on section 73(4)(aa) (transfer to processor)—
- (a) the transfer must be documented,
@@ -2146,25 +2070,53 @@
- (iv) a description of the personal data transferred.
- (4) For the purposes of this section, a legal instrument is “*appropriate*”, in relation to a transfer of personal data, if—
- (a) the instrument is intended to be relied on in connection with the transfer or that type of transfer,
- (b) at least one competent authority is a party to the instrument, and
- (c) each competent authority that is a party to the instrument, acting reasonably and proportionately, considers that the data protection test is met in relation to the transfers, or types of transfer, intended to be made in reliance on the instrument (see subsection (5)).
- (5) For the purposes of this section, the data protection test is met in relation to a transfer, or a type of transfer, of personal data if, after the transfer, the standard of the protection provided for the data subject with regard to that personal data, whether by a binding legal instrument or by other means, would not be materially lower than the standard of the protection provided for the data subject with regard to the personal data by or under—
- (a) this Part, and
- (b) Parts 5 to 7, so far as they relate to processing by a competent authority for any of the law enforcement purposes.
- (6) For the purposes of subsections (1A)(b) and (4)(c), what is reasonable and proportionate is to be determined by reference to all the circumstances, or likely circumstances, of the transfer or type of transfer, including the nature and volume of the personal data transferred.
- (7) In this section, references to the protection provided for the data subject are to that protection taken as a whole.
- (8) For provision about standard data protection clauses which the Commissioner considers are capable of securing that the data protection test in this section is met, see section 119A.
#### Transfers on the basis of special circumstances
##### 76
- (1) A transfer of personal data to a third country or international organisation is based on special circumstances where the transfer is necessary—
- (A1) A transfer of personal data to a third country or international organisation is based on special circumstances where—
- (a) it is made in the absence of approval by regulations under section 74AA and of compliance with section 75 (appropriate safeguards), and
- (b) it is necessary for a special purpose.
- (1) A transfer of personal data is necessary for a special purpose if it is necessary—
- (a) to protect the vital interests of the data subject or another person,
- (b) to safeguard the legitimate interests of the data subject,
- (c) for the prevention of an immediate and serious threat to the public security of ... a third country,
- (d) in individual cases for any of the law enforcement purposes, or
- (e) in individual cases for a legal purpose.
- (2) But subsection (1)(d) and (e) do not apply if the controller determines that fundamental rights and freedoms of the data subject override the public interest in the transfer.
- (3) Where a transfer of data takes place in reliance on subsection (1)—
- (c) for the prevention of an immediate and serious threat to the public security or national security of ... a third country or the United Kingdom,
- (d) in particular circumstances, for any of the law enforcement purposes, or
- (e) in particular circumstances, for a legal purpose.
- (2) But a transfer of personal data is not necessary for a special purpose by virtue of subsection (1)(d) or (e) if the controller determines that fundamental rights and freedoms of the data subject override the public interest in the transfer.
- (2A) In accordance with the third data protection principle, the amount of personal data transferred in reliance on this section must not be excessive in relation to the special purpose relied on.
- (3) Where a transfer of data takes place in reliance on this section—
- (a) the transfer must be documented,
@@ -2188,7 +2140,7 @@
- (c) it is otherwise necessary for the purposes of establishing, exercising or defending legal rights in relation to any of the law enforcement purposes.
### Transfers to particular recipients
### Additional conditions
#### Transfers of personal data to persons other than relevant authorities
@@ -2204,11 +2156,11 @@
- (5) Condition 4 is that the transferring controller informs the intended recipient of the specific purpose or purposes for which the personal data may, so far as necessary, be processed.
- (6) Where personal data is transferred to a person in a third country other than a relevant authority, the transferring controller must inform a relevant authority in that third country without undue delay of the transfer, unless this would be ineffective or inappropriate.
- (6) Where personal data is transferred to a person in a third country in reliance on section 73(4)(b), the transferring controller must inform a relevant authority in that third country without undue delay of the transfer, unless this would be ineffective or inappropriate.
- (7) The transferring controller must—
- (a) document any transfer to a recipient in a third country other than a relevant authority, and
- (a) document any transfer to a recipient in a third country that takes place in reliance on section 73(4)(b), and
- (b) inform the Commissioner about the transfer.
@@ -2220,11 +2172,27 @@
##### 78
- (1) Where personal data is transferred in accordance with section 73, the transferring controller must make it a condition of the transfer that the data is not to be further transferred to a third country or international organisation without the authorisation of the transferring controller or another competent authority.
- (2) A competent authority may give an authorisation under subsection (1) only where the further transfer is necessary for a law enforcement purpose.
- (3) In deciding whether to give the authorisation, the competent authority must take into account (among any other relevant factors)—
- (A1) Subsections (1) to (6) apply where a transfer to which section 73 applies takes place otherwise than in reliance on section 73(4)(aa) (transfer to processor).
- (1) ... The transferring controller must make it a condition of the transfer —
- (a) that the personal data is not to be further transferred to a third country or international organisation without the authorisation of the transferring controller or another competent authority (the “UK authoriser”), or
- (b) that—
- (i) the personal data is not to be so transferred without such authorisation except where subsection (1A) applies, and
- (ii) where a transfer is made without such authorisation, the UK authoriser must be informed without delay.
- (1A) This subsection applies if—
- (a) the transfer is necessary for the prevention of an immediate and serious threat to the public security or national security of a third country or the United Kingdom, and
- (b) authorisation from the UK authoriser cannot be obtained in good time.
- (2) The UK authoriser may give an authorisation for the purposes of a condition described in subsection (1) only where the further transfer is necessary for a law enforcement purpose.
- (3) In deciding whether to give the authorisation, the UK authoriser must take into account (among any other relevant factors)—
- (a) the seriousness of the circumstances leading to the request for authorisation,
@@ -2232,15 +2200,21 @@
- (c) the standards for the protection of personal data that apply in the third country or international organisation to which the personal data would be transferred.
- (4) In a case where the personal data was originally transmitted or otherwise made available to the transferring controller or another competent authority by a member State ..., an authorisation may not be given under subsection (1) unless that member State, or any person based in that member State which is a competent authority for the purposes of the Law Enforcement Directive, has authorised the transfer in accordance with the law of the member State.
- (4) In a case where the personal data was originally transmitted or otherwise made available to the transferring controller or another competent authority by a member State ..., the UK authoriser may not give an authorisation for the purposes of a condition described in subsection (1) unless that member State, or any person based in that member State which is a competent authority for the purposes of the Law Enforcement Directive, has authorised the transfer in accordance with the law of the member State.
- (5) Authorisation is not required as mentioned in subsection (4) if—
- (a) the transfer is necessary for the prevention of an immediate and serious threat either to the public security of ... a third country or to the essential interests of a member State, and
- (a) the transfer is necessary for the prevention of an immediate and serious threat to the public security, national security or essential interests of a third country or the United Kingdom, and
- (b) the authorisation cannot be obtained in good time.
- (6) Where a transfer is made without the authorisation mentioned in subsection (4), the authority in the member State which would have been responsible for deciding whether to authorise the transfer must be informed without delay.
- (6) Where a transfer is made in a case described in subsection (4) without the authorisation mentioned in that subsection (whether made with or without authorisation from the UK authoriser), the UK authoriser must, without delay, inform, the authority in the member State which would have been responsible for deciding whether to authorise the transfer ....
- (7) Where a transfer takes place in reliance on section 73(4)(aa) (transfer to processor), the transferring controller must make it a condition of the transfer that the data is only to be further transferred to a third country or international organisation where—
- (a) the terms of any relevant contract entered into, or authorisation given, by the transferring controller in accordance with section 59 are complied with, and
- (b) the further transfer satisfies the requirements in section 73(1).
### CHAPTER 6 — Supplementary
@@ -2520,9 +2494,9 @@
- (1) The second data protection principle is that—
- (a) the purpose for which personal data is collected on any occasion must be specified, explicit and legitimate, and
- (b) personal data so collected must not be processed in a manner that is incompatible with the purpose for which it is collected.
- (a) the purpose for which personal data is collected (whether from the data subject or otherwise) must be specified, explicit and legitimate, and
- (b) personal data so collected must not be processed by or on behalf of a controller in a manner that is incompatible with the purpose for which the controller collected it.
- (2) Paragraph (b) of the second data protection principle is subject to subsections (3) and (4).
@@ -2712,10 +2686,22 @@
- (14) In this section—
- “*the applicable time period*” means—the period of 1 month, orsuch longer period, not exceeding 3 months, as may be specified in regulations made by the Secretary of State,beginning with the relevant time;
- “*the applicable time period*” means the period of one month beginning with the relevant time, subject to subsection (14A);
- “*the relevant time*”, in relation to a request under subsection (1), means the latest of the following—when the controller receives the request,when the fee (if any) is paid, andwhen the controller receives the information (if any) required under subsection (5) in connection with the request.
- (14A) The controller may, by giving notice to the data subject, extend the applicable time period by two further months where that is necessary by reason of—
- (a) the complexity of requests made by the data subject, or
- (b) the number of such requests.
- (14B) A notice under subsection (14A) must—
- (a) be given before the end of the period of one month beginning with the relevant time, and
- (b) state the reasons for the delay.
- (15) Regulations under this section are subject to the negative resolution procedure.
#### Right of access: supplementary
@@ -2752,7 +2738,7 @@
##### 96
- (1) The controller may not take a decision significantly affecting a data subject that is based solely on automated processing of personal data relating to the data subject.
- (1) The controller may not take a decision significantly affecting a data subject that is based on entirely automated processing of personal data relating to the data subject.
- (2) Subsection (1) does not prevent such a decision being made on that basis if—
@@ -2768,7 +2754,9 @@
- (iii) in the course of performing such a contract.
- (3) For the purposes of this section, a decision that has legal effects as regards an individual is to be regarded as significantly affecting the individual.
- (3) For the purposes of this section and section 97, a decision that has legal effects as regards an individual is to be regarded as significantly affecting the individual.
- (4) For the purposes of this section and section 97, a decision is based on entirely automated processing if the decision-making process does not include an opportunity for a human being to accept, reject or influence the decision.
#### Right to intervene in automated decision-making
@@ -2776,7 +2764,7 @@
- (1) This section applies where—
- (a) the controller takes a decision significantly affecting a data subject that is based solely on automated processing of personal data relating to the data subject, and
- (a) the controller takes a decision significantly affecting a data subject that is based on entirely automated processing of personal data relating to the data subject, and
- (b) the decision is required or authorised by law.
@@ -2798,7 +2786,7 @@
- (a) to reconsider the decision, or
- (b) to take a new decision that is not based solely on automated processing.
- (b) to take a new decision that is not based on entirely automated processing.
- (5) If a request is made to the controller under subsection (4), the controller must, before the end of the period of 1 month beginning with receipt of the request—
@@ -2806,7 +2794,7 @@
- (b) by notice in writing inform the data subject of the outcome of that consideration.
- (6) For the purposes of this section, a decision that has legal effects as regards an individual is to be regarded as significantly affecting the individual.
- (6) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### Right to information about decision-making
@@ -3644,17 +3632,27 @@
##### 135
- (1) Where a request to the Commissioner from a data subject or a data protection officer is manifestly unfounded or excessive, the Commissioner may—
- (A1) This section makes provision about cases in which a request made to the Commissioner, to which the Commissioner is required or authorised to respond under the data protection legislation, is manifestly unfounded or excessive.
- (1) ... The Commissioner may—
- (a) charge a reasonable fee for dealing with the request, or
- (b) refuse to act on the request.
- (1A) In subsection (1)—
- (a) the reference in paragraph (a) to charging a reasonable fee is, in a case in which section 134 is relevant, a reference to doing so under that section, and
- (b) paragraph (b) is not to be read as implying anything about whether the Commissioner may refuse to act on requests that are neither manifestly unfounded nor excessive.
- (2) An example of a request that may be excessive is one that merely repeats the substance of previous requests.
- (3) In any proceedings where there is an issue as to whether a request described in subsection (1) is manifestly unfounded or excessive, it is for the Commissioner to show that it is.
- (4) Subsections (1) and (3) apply only in cases in which the Commissioner does not already have such powers and obligations under Article 57(4) of the UK GDPR.
- (3) In any proceedings where there is an issue as to whether a request described in subsection (A1) is manifestly unfounded or excessive, it is for the Commissioner to show that it is.
- (4) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (5) Article 57(3) of the UK GDPR (performance of Commissioner’s tasks generally to be free of charge for data subject) has effect subject to this section.
#### Guidance about fees
@@ -3662,9 +3660,9 @@
- (1) The Commissioner must produce and publish guidance about the fees the Commissioner proposes to charge in accordance with—
- (a) section 134 or 135, or
- (b) Article 57(4) of the UK GDPR.
- (a) section 134 or 135, ...
- (b) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (2) Before publishing the guidance, the Commissioner must consult the Secretary of State.
@@ -4016,10 +4014,24 @@
- (h) permit the Commissioner to observe the processing of personal data that takes place on the premises;
- (i) make available for interview by the Commissioner a specified number of people of a specified description who process personal data on behalf of the controller, not exceeding the number who are willing to be interviewed.
- (i) make available for interview by the Commissioner a specified number of people of a specified description who process personal data on behalf of the controller, not exceeding the number who are willing to be interviewed;
- (j) make arrangements for an approved person to prepare a report on a specified matter;
- (k) provide to the Commissioner a report prepared in pursuance of such arrangements.
- (3) In subsection (2), references to the Commissioner include references to the Commissioner's officers and staff.
- (3A) An assessment notice that requires a controller or processor to make arrangements for an approved person to prepare a report may require the arrangements to include specified terms as to—
- (a) the preparation of the report;
- (b) the contents of the report;
- (c) the form in which the report is to be provided;
- (d) the date by which the report is to be completed.
- (4) An assessment notice must, in relation to each requirement imposed by the notice, specify the time or times at which, or period or periods within which, the requirement must be complied with (but see the restrictions in subsections (6) to (9)).
- (5) An assessment notice must provide information about—
@@ -4060,8 +4072,12 @@
- (11) Where the Commissioner gives an assessment notice to a processor, the Commissioner must, so far as reasonably practicable, give a copy of the notice to each controller for whom the processor processes personal data.
- (11A) Where the Commissioner gives an assessment notice that requires the controller or processor to make arrangements for an approved person to prepare a report, the controller or processor is liable for the payment of the approved person’s remuneration and expenses under the arrangements.
- (12) In this section—
- “*approved person*”, in relation to a report, means a person approved to prepare the report in accordance with section 146A;
- “*domestic premises*” means premises, or a part of premises, used as a dwelling;
- “*specified*” means specified in an assessment notice.
@@ -4100,9 +4116,9 @@
- (6) The Commissioner may not give an assessment notice to—
- (a) a body specified in section 23(3) of the Freedom of Information Act 2000 (bodies dealing with security matters), or
- (b) the Office for Standards in Education, Children's Services and Skills in so far as it is a controller or processor in respect of information processed for the purposes of functions exercisable by Her Majesty's Chief Inspector of Education, Children's Services and Skills by virtue of section 5(1)(a) of the Care Standards Act 2000.
- (a) a body specified in section 23(3) of the Freedom of Information Act 2000 (bodies dealing with security matters), ...
- (b) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
### Information notices and assessment notices: destruction of documents etc
@@ -4144,13 +4160,13 @@
- (a) a provision of Chapter II of the UK GDPR or Chapter 2 of Part 3 or Chapter 2 of Part 4 of this Act (principles of processing);
- (b) a provision of Articles 12 to 22 of the UK GDPR or Part 3 or 4 of this Act conferring rights on a data subject;
- (b) a provision of or made under Articles 12 to 22D of the UK GDPR or Part 3 or 4 of this Act conferring rights on a data subject;
- (c) a provision of Articles 25 to 39 of the UK GDPR or section 64 or 65 of this Act (obligations of controllers and processors);
- (d) a requirement to communicate a personal data breach to the Commissioner or a data subject under section 67, 68 or 108 of this Act;
- (e) the principles for transfers of personal data to third countries, non-Convention countries and international organisations in Articles 44 to 49 of the UK GDPR or in sections 73 to 78 or 109 of this Act.
- (e) the principles for transfers of personal data to third countries, non-Convention countries and international organisations in Articles 44A to 49A of the UK GDPR or in sections 73 to 78 or 109 of this Act.
- (3) The second type of failure is where a monitoring body has failed, or is failing, to comply with an obligation under Article 41 of the UK GDPR (monitoring of approved codes of conduct).
@@ -4174,7 +4190,7 @@
- (a) may make provision about the giving of an enforcement notice in respect of the failure, including by amending this section and sections 150 to 152,
- (b) may make provision about the giving of an information notice, an assessment notice or a penalty notice, or about powers of entry and inspection, in connection with the failure, including by amending sections 142, 143, 146, 147 and 155 to 157 and Schedules 15 and 16, and
- (b) may make provision about the giving of an information notice, an assessment notice , an interview notice or a penalty notice, or about powers of entry and inspection, in connection with the failure, including by amending sections 142, 143, 146, 147 , 148A, 148B and 155 to 157 and Schedules 15 and 16, and
- (c) are subject to the affirmative resolution procedure.
@@ -4320,9 +4336,11 @@
- (1) If the Commissioner is satisfied that a person—
- (a) has failed or is failing as described in section 149(2), (3), (4) or (5), or
- (b) has failed to comply with an information notice, an assessment notice or an enforcement notice,
- (a) has failed or is failing as described in section 149(2), (3), (4) or (5), ...
- (b) has failed to comply with an information notice, an assessment notice , an interview notice or an enforcement notice , or
- (c) has failed to comply with a duty imposed on the person by section 146A(6).
the Commissioner may, by written notice (a “penalty notice”), require the person to pay to the Commissioner an amount in sterling specified in the notice.
@@ -4416,7 +4434,7 @@
- (2) In relation to an infringement of a provision of Part 3 of this Act, the maximum amount of the penalty that may be imposed by a penalty notice is—
- (a) in relation to a failure to comply with section 35, 36, 37, 38(1), 39(1), 40, 44, 45, 46, 47, 48, 49, 52, 53, 73, ... 75, 76, 77 or 78, the higher maximum amount, and
- (a) in relation to a failure to comply with section 35, 36, 37, 38(1), 39(1), 40, 44, 45, 46, 47, 48, 50B, 50C, 52, 53, 73, ... 75, 76, 77 or 78, the higher maximum amount, and
- (b) otherwise, the standard maximum amount.
@@ -4426,7 +4444,7 @@
- (b) otherwise, the standard maximum amount.
- (4) In relation to a failure to comply with an information notice, an assessment notice or an enforcement notice, the maximum amount of the penalty that may be imposed by a penalty notice is the higher maximum amount.
- (4) In relation to a failure to comply with an information notice, an assessment notice , an interview notice or an enforcement notice, the maximum amount of the penalty that may be imposed by a penalty notice is the higher maximum amount.
- (5) The “higher maximum amount” is—
@@ -4492,6 +4510,8 @@
- (b) assessment notices,
- (ba) interview notices,
- (c) enforcement notices, and
- (d) penalty notices.
@@ -4510,6 +4530,10 @@
- (a) provision specifying factors to be considered in determining whether to give an assessment notice to a person;
- (aa) provision specifying factors to be considered in determining whether to give an assessment notice to a person that imposes a requirement of a sort mentioned in section 146(2)(j);
- (ab) provision about the factors the Commissioner may take into account when determining the suitability of a person to prepare a report of a sort mentioned in section 146(2)(j);
- (b) provision about the circumstances in which the Commissioner would consider it appropriate to give an assessment notice in reliance on section 146(8) or (9) (urgent cases);
- (c) provision specifying descriptions of documents or information that—
@@ -4532,6 +4556,18 @@
- (b) documents and information concerning the provision of social care for an individual.
- (5A) In relation to interview notices, the guidance must include—
- (a) provision specifying factors to be considered in determining whether to give an interview notice to an individual;
- (b) provision about the circumstances in which the Commissioner would consider it appropriate to give an interview notice to an individual in reliance on section 148A(8) (urgent cases);
- (c) provision about the circumstances in which the Commissioner would consider it appropriate to vary the place or time specified in an interview notice at the request of the individual to whom the notice is given;
- (d) provision about the nature of interviews carried out in accordance with an interview notice;
- (e) provision about how the Commissioner will determine how to proceed if an individual does not comply with an interview notice.
- (6) In relation to enforcement notices, the guidance must include—
- (a) provision specifying factors to be considered in determining whether to give an enforcement notice to a person;
@@ -4550,6 +4586,8 @@
- (d) provision about how the Commissioner will determine how to proceed if a person does not comply with a penalty notice.
- (e) provision about the circumstances in which the Commissioner would consider it necessary to comply with the duty in paragraph 4(A2) of Schedule 16 after the period of 6 months mentioned in that paragraph.
- (8) The Commissioner—
- (a) may alter or replace guidance produced under this section, and
@@ -4612,6 +4650,8 @@
- (b) an assessment notice;
- (ba) an interview notice;
- (c) an enforcement notice;
- (d) a penalty notice;
@@ -4650,7 +4690,7 @@
##### 164
- (1) This section applies where an information notice, an assessment notice or an enforcement notice given to a person contains an urgency statement.
- (1) This section applies where an information notice, an assessment notice , an interview notice or an enforcement notice given to a person contains an urgency statement.
- (2) The person may apply to the court for either or both of the following—
@@ -4674,7 +4714,9 @@
- (a) in relation to an information notice, a statement under section 142(7)(a),
- (b) in relation to an assessment notice, a statement under section 146(8)(a) or (9)(d), and
- (b) in relation to an assessment notice, a statement under section 146(8)(a) or (9)(d),
- (ba) in relation to an interview notice, a statement under section 148A(8)(a), and
- (c) in relation to an enforcement notice, a statement under section 150(8)(a).
@@ -4820,7 +4862,7 @@
- (2) It is a defence for a person charged with an offence under subsection (1) to prove that the obtaining, disclosing, procuring or retaining—
- (a) was necessary for the purposes of preventing or detecting crime,
- (a) was necessary for the purposes of preventing , investigating or detecting crime,
- (b) was required or authorised by an enactment, by a rule of law or by the order of a court or tribunal, or
@@ -4870,7 +4912,7 @@
- (3) It is a defence for a person charged with an offence under subsection (1) to prove that the re-identification—
- (a) was necessary for the purposes of preventing or detecting crime,
- (a) was necessary for the purposes of preventing , investigating or detecting crime,
- (b) was required or authorised by an enactment, by a rule of law or by the order of a court or tribunal, or
@@ -4912,7 +4954,7 @@
- (6) It is a defence for a person charged with an offence under subsection (5) to prove that the processing—
- (a) was necessary for the purposes of preventing or detecting crime,
- (a) was necessary for the purposes of preventing , investigating or detecting crime,
- (b) was required or authorised by an enactment, by a rule of law or by the order of a court or tribunal, or
@@ -5260,6 +5302,8 @@
- “*information notice*” has the meaning given in section 142;
- “*interview notice*” has the meaning given in section 148A;
- “*penalty notice*” has the meaning given in section 155;
- “*penalty variation notice*” has the meaning given in Schedule 16;
@@ -5296,7 +5340,7 @@
- (f) paragraph 15 of Schedule 2.
- (4) Subsection (2) does not apply to regulations made under section 18 where the Secretary of State has made an urgency statement in respect of them.
- (4) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (5) Regulations under this Act may—
@@ -5304,35 +5348,27 @@
- (b) include consequential, supplementary, incidental, transitional, transitory or saving provision.
- (6) Where regulations under this Act are subject to “the negative resolution procedure” the statutory instrument containing the regulations is subject to annulment in pursuance of a resolution of either House of Parliament.
- (7) Where regulations under this Act are subject to “the affirmative resolution procedure” the regulations may not be made unless a draft of the statutory instrument containing them has been laid before Parliament and approved by a resolution of each House of Parliament.
- (8) Where regulations under this Act are subject to “the made affirmative resolution procedure”—
- (a) the statutory instrument containing the regulations must be laid before Parliament after being made, together with the urgency statement in respect of them, and
- (b) the regulations cease to have effect at the end of the period of 120 days beginning with the day on which the instrument is made, unless within that period the instrument is approved by a resolution of each House of Parliament.
- (9) In calculating the period of 120 days, no account is to be taken of any time during which—
- (a) Parliament is dissolved or prorogued, or
- (b) both Houses of Parliament are adjourned for more than 4 days.
- (10) Where regulations cease to have effect as a result of subsection (8), that does not—
- (a) affect anything previously done under the regulations, or
- (b) prevent the making of new regulations.
- (11) Any provision that may be included in regulations under this Act subject to the negative resolution procedure may be made by regulations subject to the affirmative resolution procedure or the made affirmative resolution procedure.
- (6) For the purposes of this Act, where regulations are subject to “the negative resolution procedure” the statutory instrument containing the regulations is subject to annulment in pursuance of a resolution of either House of Parliament.
- (7) For the purposes of this Act, where regulations are subject to “the affirmative resolution procedure” the regulations may not be made unless a draft of the statutory instrument containing them has been laid before Parliament and approved by a resolution of each House of Parliament.
- (8) For the purposes of this Act, regulations are subject to “the made affirmative resolution procedure” if—
- (a) the statutory instrument containing the regulations must be laid before Parliament after being made, together with an urgency statement in respect of them, and
- (b) the regulations cease to have effect at the end of a period beginning with the day on which the instrument is made, unless within that period the instrument is approved by a resolution of each House of Parliament.
- (9) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (10) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (11) Any provision that may be included in regulations under this Act subject to the negative resolution procedure may be made by regulations made under this Act or another enactment that are subject to the affirmative resolution procedure or the made affirmative resolution procedure.
- (12) If a draft of a statutory instrument containing regulations under section 7 would, apart from this subsection, be treated for the purposes of the standing orders of either House of Parliament as a hybrid instrument, it is to proceed in that House as if it were not such an instrument.
- (13) A requirement under a provision of this Act to consult may be satisfied by consultation before, as well as by consultation after, the provision comes into force.
- (14) In this section, “*urgency statement*” has the meaning given in section 18(4).
- (14) For the purposes of this section, an urgency statement is a reasoned statement that the Secretary of State considers it desirable for regulations to come into force without delay.
### Changes to the Data Protection Convention
@@ -5392,7 +5428,7 @@
- (b) in the particular circumstances, was justified as being in the public interest.
- (4) The imposition of the requirement referred to in subsection (1) or (2) is not to be regarded as justified as being in the public interest on the ground that it would assist in the prevention or detection of crime, given —
- (4) The imposition of the requirement referred to in subsection (1) or (2) is not to be regarded as justified as being in the public interest on the ground that it would assist in the prevention , investigation or detection of crime, given —
- (a) Part 5 of the Police Act 1997 (certificates of criminal records etc), and
@@ -5774,7 +5810,7 @@
- (b) on summary conviction in Scotland or Northern Ireland, to a fine not exceeding level 5 on the standard scale.
- (2) A person who commits an offence under section 132, 144, 148, 170, 171 or 184 is liable—
- (2) A person who commits an offence under section 132, 144, 148, 148C, 170, 171 or 184 is liable—
- (a) on summary conviction in England and Wales, to a fine;
@@ -5850,352 +5886,334 @@
##### 199
- (1) The National Police Records (Recordable Offences) Regulations 2000 (S.I. 2000/1139) have effect as if the offences under the following provisions were listed in the Schedule to the Regulations—
- (1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (2) Regulations under section 27(4) of the Police and Criminal Evidence Act 1984 (recordable offences) may repeal subsection (1).
#### Guidance about PACE codes of practice
##### 200
- (1) The Commissioner must produce and publish guidance about how the Commissioner proposes to perform the duty under section 67(9) of the Police and Criminal Evidence Act 1984 (duty to have regard to codes of practice under that Act when investigating offences and charging offenders) in connection with offences under this Act.
- (2) The Commissioner—
- (a) may alter or replace the guidance, and
- (b) must publish any altered or replacement guidance.
- (3) The Commissioner must consult the Secretary of State before publishing guidance under this section (including any altered or replacement guidance).
- (4) The Commissioner must arrange for guidance under this section (including any altered or replacement guidance) to be laid before Parliament.
### The Tribunal
#### Disclosure of information to the Tribunal
##### 201
- (1) No enactment or rule of law prohibiting or restricting the disclosure of information precludes a person from providing the First-tier Tribunal or the Upper Tribunal with information necessary for the discharge of—
- (a) its functions under the data protection legislation, or
- (b) its other functions relating to the Commissioner's acts and omissions.
- (2) But this section does not authorise the making of a disclosure which is prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.
- (3) Until the repeal of Part 1 of the Regulation of Investigatory Powers Act 2000 by paragraphs 45 and 54 of Schedule 10 to the Investigatory Powers Act 2016 is fully in force, subsection (2) has effect as if it included a reference to that Part.
#### Proceedings in the First-tier Tribunal: contempt
##### 202
- (1) This section applies where—
- (a) a person does something, or fails to do something, in relation to proceedings before the First-tier Tribunal—
- (i) on an appeal under section 27, 79, 82E, 111 or 162, or
- (ii) for an order under section 166, and
- (b) if those proceedings were proceedings before a court having power to commit for contempt, the act or omission would constitute contempt of court.
- (2) The First-tier Tribunal may certify the offence to the Upper Tribunal.
- (3) Where an offence is certified under subsection (2), the Upper Tribunal may—
- (a) inquire into the matter, and
- (b) deal with the person charged with the offence in any manner in which it could deal with the person if the offence had been committed in relation to the Upper Tribunal.
- (4) Before exercising the power under subsection (3)(b), the Upper Tribunal must—
- (a) hear any witness who may be produced against or on behalf of the person charged with the offence, and
- (b) hear any statement that may be offered in defence.
#### Tribunal Procedure Rules
##### 203
- (1) Tribunal Procedure Rules may make provision for regulating—
- (a) the exercise of the rights of appeal conferred by section 27, 79, 82E, 111 or 162, and
- (b) the exercise of the rights of data subjects under section 166, including their exercise by a representative body.
- (2) In relation to proceedings involving the exercise of those rights, Tribunal Procedure Rules may make provision about—
- (a) securing the production of material used for the processing of personal data, and
- (b) the inspection, examination, operation and testing of equipment or material used in connection with the processing of personal data.
### Interpretation
#### Meaning of “health professional” and “social work professional”
##### 204
- (1) In this Act, “*health professional*” means any of the following—
- (a) a registered medical practitioner;
- (b) a registered nurse or midwife;
- (c) a registered dentist within the meaning of the Dentists Act 1984 (see section 53 of that Act);
- (d) a registered dispensing optician or a registered optometrist within the meaning of the Opticians Act 1989 (see section 36 of that Act);
- (e) a registered osteopath with the meaning of the Osteopaths Act 1993 (see section 41 of that Act);
- (f) a registered chiropractor within the meaning of the Chiropractors Act 1994 (see section 43 of that Act);
- (g) a person registered as a member of a profession to which the Health ... Professions Order 2001 (S.I. 2002/254) for the time being extends; ...
- (h) a registered pharmacist or a registered pharmacy technician within the meaning of the Pharmacy Order 2010 (S.I. 2010/231) (see article 3 of that Order);
- (i) a registered person within the meaning of the Pharmacy (Northern Ireland) Order 1976 (S.I. 1976/1213 (N.I. 22)) (see Article 2 of that Order);
- (j) a child psychotherapist;
- (k) a scientist employed by a health service body as head of a department.
- (l) a person registered under the Anaesthesia Associates and Physician Associates Order 2024.
- (2) In this Act, “*social work professional*” means any of the following—
- (a) a person registered as a social worker in the register maintained by Social Work England under section 39(1) of the Children and Social Work Act 2017;
- (b) a person registered as a social worker in the register maintained by Social Care Wales under section 80 of the Regulation and Inspection of Social Care (Wales) Act 2016 (anaw 2);
- (c) a person registered as a social worker in the register maintained by the Scottish Social Services Council under section 44 of the Regulation of Care (Scotland) Act 2001 (asp 8);
- (d) a person registered as a social worker in the register maintained by the Northern Ireland Social Care Council under section 3 of the Health and Personal Social Services Act (Northern Ireland) 2001 (c. 3 (N.I.)).
- (3) In subsection (1)(a) “*registered medical practitioner*” includes a person who is provisionally registered under section 15 or 21 of the Medical Act 1983 and is engaged in such employment as is mentioned in subsection (3) of that section.
- (4) In subsection (1)(k) “*health service body*” means any of the following—
- (a) the Secretary of State in relation to the exercise of functions under section 2A or 2B of, or paragraph 7C, 8 or 12 of Schedule 1 to, the National Health Service Act 2006;
- (b) a local authority in relation to the exercise of functions under section 2B or 111 of, or any of paragraphs 1 to 7B or 13 of Schedule 1 to, the National Health Service Act 2006;
- (c) a National Health Service trust first established under section 25 of the National Health Service Act 2006;
- (d) a Special Health Authority established under section 28 of the National Health Service Act 2006;
- (e) an NHS foundation trust;
- (f) the National Institute for Health and Care Excellence;
- (g) NHS England;
- (h) a National Health Service trust first established under section 5 of the National Health Service and Community Care Act 1990;
- (i) a Local Health Board established under section 11 of the National Health Service (Wales) Act 2006;
- (j) a National Health Service trust first established under section 18 of the National Health Service (Wales) Act 2006;
- (k) a Special Health Authority established under section 22 of the National Health Service (Wales) Act 2006;
- (l) a Health Board within the meaning of the National Health Service (Scotland) Act 1978;
- (m) a Special Health Board within the meaning of the National Health Service (Scotland) Act 1978;
- (n) a National Health Service trust first established under section 12A of the National Health Service (Scotland) Act 1978;
- (o) the managers of a State Hospital provided under section 102 of the National Health Service (Scotland) Act 1978;
- (p) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (q) a special health and social care agency established under the Health and Personal Social Services (Special Agencies) (Northern Ireland) Order 1990 (S.I. 1990/247 (N.I. 3));
- (r) a Health and Social Care trust established under Article 10 of the Health and Personal Social Services (Northern Ireland) Order 1991 (S.I. 1991/194 (N.I. 1)).
#### General interpretation
##### 205
- (1) In this Act—
- “*biometric data*” means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of an individual, which allows or confirms the unique identification of that individual, such as facial images or dactyloscopic data;
- “*data concerning health*” means personal data relating to the physical or mental health of an individual, including the provision of health care services, which reveals information about his or her health status;
- “*enactment*” includes—an enactment passed or made after this Act,an enactment comprised in subordinate legislation,an enactment comprised in, or in an instrument made under, a Measure or Act of the National Assembly for Wales,an enactment comprised in, or in an instrument made under, an Act of the Scottish Parliament, ...an enactment comprised in, or in an instrument made under, Northern Ireland legislation; andany assimilated direct legislation;
- “*genetic data*” means personal data relating to the inherited or acquired genetic characteristics of an individual which gives unique information about the physiology or the health of that individual and which results, in particular, from an analysis of a biological sample from the individual in question;
- “*government department*” includes the following (except in the expression “*United Kingdom government department*”)—a part of the Scottish Administration;a Northern Ireland department;the Welsh Government;a body or authority exercising statutory functions on behalf of the Crown;
- “*health record*” means a record which—consists of data concerning health, andhas been made by or on behalf of a health professional in connection with the diagnosis, care or treatment of the individual to whom the data relates;
- “*inaccurate*”, in relation to personal data, means incorrect or misleading as to any matter of fact;
- “*international obligation of the United Kingdom*” includes—. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .an obligation that arises under an international agreement or arrangement to which the United Kingdom is a party;
- “*international organisation*” means an organisation and its subordinate bodies governed by international law, or any other body which is set up by, or on the basis of, an agreement between two or more countries;
- “*Minister of the Crown*” has the same meaning as in the Ministers of the Crown Act 1975;
- “*publish*” means make available to the public or a section of the public (and related expressions are to be read accordingly);
- “*subordinate legislation*” has the meaning given in the Interpretation Act 1978;
- “*tribunal*” means any tribunal in which legal proceedings may be brought;
- “*the Tribunal*”, in relation to an application or appeal under this Act, means—the Upper Tribunal, in any case where it is determined by or under Tribunal Procedure Rules that the Upper Tribunal is to hear the application or appeal, orthe First-tier Tribunal, in any other case.
- (1A) In this Act, references to fundamental rights or fundamental freedoms (however expressed) are to the Convention rights within the meaning of the Human Rights Act 1998.
- (2) References in this Act to a period expressed in hours, days, weeks, months or years are to be interpreted in accordance with Article 3 of Regulation (EEC, Euratom) No. 1182/71 of the Council of 3 June 1971 determining the rules applicable to periods, dates and time limits, except in—
- (za) section 119A(10) and (11);
- (a) section 125(4), (7) and (8);
- (b) section 161(3), (5) and (6);
- (c) section 176(2);
- (d) section 178(2);
- (e) section 182(8) ...;
- (f) section 183(4);
- (g) section 192(3), (5) and (6);
- (h) section 197(3) and (4);
- (i) paragraph 23(4) and (5) of Schedule 1;
- (j) paragraphs 5(4) and 6(4) of Schedule 3;
- (k) Schedule 5;
- (l) paragraph 11(5) of Schedule 12;
- (la) paragraph 22(6) of Schedule 12A;
- (m) Schedule 15;
(and the references in section 5 to terms used in ... Part 2 do not include references to a period expressed in hours, days, weeks, months or years).
- (3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (4) In the definition of “the UK GDPR” in section 3(10)—
- (a) the reference to Regulation (EU) 2016/679 as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 is to be treated as a reference to that Regulation as modified by Schedule 1 to the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (“*the 2019 Regulations*”), but
- (b) nothing in the definition or in paragraph (a) determines whether, where Regulation (EU) 2016/679 is modified on or after IP completion day by the law of England and Wales, Scotland or Northern Ireland (other than by Schedule 1 to the 2019 Regulations), the reference to Regulation (EU) 2016/679 is then to be read as a reference to that Regulation as modified.
- (5) Subsection (4) is not to be read as implying anything about how other references to Regulation (EU) 2016/679 or references to other assimilated law are to be interpreted.
#### Index of defined expressions
##### 206
The Table below lists provisions which define or otherwise explain terms defined for this Act, for a Part of this Act or for Chapter 2 or 3 of Part 2 of this Act.
### Territorial application
#### Territorial application of this Act
##### 207
- (1) This Act applies only to processing of personal data described in subsections (1A) and (2).
- (1A) In the case of the processing of personal data to which Part 2 (the UK GDPR) applies, it applies to the types of such processing to which the UK GDPR applies by virtue of Article 3 of the UK GDPR.
- (2) In the case of the processing of personal data to which Part 2 does not apply, it applies where such processing is carried out in the context of the activities of an establishment of a controller or processor in the United Kingdom, whether or not the processing takes place in the United Kingdom.
- (3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (4) Subsections (1), (1A) and (2) have effect subject to any provision in or made under section 120 providing for the Commissioner to carry out functions in relation to other processing of personal data.
- (5) Section 3(14)(c) does not apply to the reference to the processing of personal data in subsection (2).
- (6) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (7) In this section, references to a person who has an establishment in the United Kingdom include the following—
- (a) an individual who is ordinarily resident in the United Kingdom,
- (b) a body incorporated under the law of the United Kingdom or a part of the United Kingdom,
- (c) a partnership or other unincorporated association formed under the law of the United Kingdom or a part of the United Kingdom, and
- (d) a person not within paragraph (a), (b) or (c) who maintains, and carries on activities through, an office, branch or agency or other stable arrangements in the United Kingdom,
....
### General
#### Children in Scotland
##### 208
- (1) Subsections (2) and (3) apply where a question falls to be determined in Scotland as to the legal capacity of a person aged under 16 to—
- (a) exercise a right conferred by the data protection legislation, or
- (b) give consent for the purposes of the data protection legislation.
- (2) The person is to be taken to have that capacity where the person has a general understanding of what it means to exercise the right or give such consent.
- (3) A person aged 12 or over is to be presumed to be of sufficient age and maturity to have such understanding, unless the contrary is shown.
#### Application to the Crown
##### 209
- (1) This Act binds the Crown.
- (2) For the purposes of the UK GDPR and this Act, each government department is to be treated as a person separate from the other government departments (to the extent that is not already the case).
- (3) Where government departments are not able to enter into contracts with each other, a provision of the UK GDPR or this Act that would require relations between them to be governed by a contract (or other binding legal act) in writing is to be treated as satisfied if the relations are the subject of a memorandum of understanding between them.
- (4) Where the purposes for which and the manner in which personal data is, or is to be, processed are determined by a person acting on behalf of the Royal Household, the Duchy of Lancaster or the Duchy of Cornwall, the controller in respect of that data for the purposes of the UK GDPR and this Act is—
- (a) in relation to the Royal Household, the Keeper of the Privy Purse,
- (b) in relation to the Duchy of Lancaster, such person as the Chancellor of the Duchy appoints, and
- (c) in relation to the Duchy of Cornwall, such person as the Duke of Cornwall, or the possessor for the time being of the Duchy of Cornwall, appoints.
- (5) Different persons may be appointed under subsection (4)(b) or (c) for different purposes.
- (6) As regards criminal liability—
- (a) a government department is not liable to prosecution under this Act;
- (b) nothing in subsection (4) makes a person who is a controller by virtue of that subsection liable to prosecution under this Act;
- (c) a person in the service of the Crown is liable to prosecution under the provisions of this Act listed in subsection (7).
- (7) Those provisions are—
- (a) section 119;
- (b) section 132;
- (c) section 144;
- (d) section 148;
- (e) section 170;
- (f) section 171;
- (g) section 173;
- (h) section 184;
- (i) paragraph 15 of Schedule 15.
- (2) Regulations under section 27(4) of the Police and Criminal Evidence Act 1984 (recordable offences) may repeal subsection (1).
#### Guidance about PACE codes of practice
##### 200
- (1) The Commissioner must produce and publish guidance about how the Commissioner proposes to perform the duty under section 67(9) of the Police and Criminal Evidence Act 1984 (duty to have regard to codes of practice under that Act when investigating offences and charging offenders) in connection with offences under this Act.
- (2) The Commissioner—
- (a) may alter or replace the guidance, and
- (b) must publish any altered or replacement guidance.
- (3) The Commissioner must consult the Secretary of State before publishing guidance under this section (including any altered or replacement guidance).
- (4) The Commissioner must arrange for guidance under this section (including any altered or replacement guidance) to be laid before Parliament.
### The Tribunal
#### Disclosure of information to the Tribunal
##### 201
- (1) No enactment or rule of law prohibiting or restricting the disclosure of information precludes a person from providing the First-tier Tribunal or the Upper Tribunal with information necessary for the discharge of—
- (a) its functions under the data protection legislation, or
- (b) its other functions relating to the Commissioner's acts and omissions.
- (2) But this section does not authorise the making of a disclosure which is prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.
- (3) Until the repeal of Part 1 of the Regulation of Investigatory Powers Act 2000 by paragraphs 45 and 54 of Schedule 10 to the Investigatory Powers Act 2016 is fully in force, subsection (2) has effect as if it included a reference to that Part.
#### Proceedings in the First-tier Tribunal: contempt
##### 202
- (1) This section applies where—
- (a) a person does something, or fails to do something, in relation to proceedings before the First-tier Tribunal—
- (i) on an appeal under section 27, 79, 82E, 111 or 162, or
- (ii) for an order under section 166, and
- (b) if those proceedings were proceedings before a court having power to commit for contempt, the act or omission would constitute contempt of court.
- (2) The First-tier Tribunal may certify the offence to the Upper Tribunal.
- (3) Where an offence is certified under subsection (2), the Upper Tribunal may—
- (a) inquire into the matter, and
- (b) deal with the person charged with the offence in any manner in which it could deal with the person if the offence had been committed in relation to the Upper Tribunal.
- (4) Before exercising the power under subsection (3)(b), the Upper Tribunal must—
- (a) hear any witness who may be produced against or on behalf of the person charged with the offence, and
- (b) hear any statement that may be offered in defence.
#### Tribunal Procedure Rules
##### 203
- (1) Tribunal Procedure Rules may make provision for regulating—
- (a) the exercise of the rights of appeal conferred by section 27, 79, 82E, 111 or 162, and
- (b) the exercise of the rights of data subjects under section 166, including their exercise by a representative body.
- (2) In relation to proceedings involving the exercise of those rights, Tribunal Procedure Rules may make provision about—
- (a) securing the production of material used for the processing of personal data, and
- (b) the inspection, examination, operation and testing of equipment or material used in connection with the processing of personal data.
### Interpretation
#### Meaning of “health professional” and “social work professional”
##### 204
- (1) In this Act, “*health professional*” means any of the following—
- (a) a registered medical practitioner;
- (b) a registered nurse or midwife;
- (c) a registered dentist within the meaning of the Dentists Act 1984 (see section 53 of that Act);
- (d) a registered dispensing optician or a registered optometrist within the meaning of the Opticians Act 1989 (see section 36 of that Act);
- (e) a registered osteopath with the meaning of the Osteopaths Act 1993 (see section 41 of that Act);
- (f) a registered chiropractor within the meaning of the Chiropractors Act 1994 (see section 43 of that Act);
- (g) a person registered as a member of a profession to which the Health ... Professions Order 2001 (S.I. 2002/254) for the time being extends; ...
- (h) a registered pharmacist or a registered pharmacy technician within the meaning of the Pharmacy Order 2010 (S.I. 2010/231) (see article 3 of that Order);
- (i) a registered person within the meaning of the Pharmacy (Northern Ireland) Order 1976 (S.I. 1976/1213 (N.I. 22)) (see Article 2 of that Order);
- (j) a child psychotherapist;
- (k) a scientist employed by a health service body as head of a department.
- (l) a person registered under the Anaesthesia Associates and Physician Associates Order 2024.
- (2) In this Act, “*social work professional*” means any of the following—
- (a) a person registered as a social worker in the register maintained by Social Work England under section 39(1) of the Children and Social Work Act 2017;
- (b) a person registered as a social worker in the register maintained by Social Care Wales under section 80 of the Regulation and Inspection of Social Care (Wales) Act 2016 (anaw 2);
- (c) a person registered as a social worker in the register maintained by the Scottish Social Services Council under section 44 of the Regulation of Care (Scotland) Act 2001 (asp 8);
- (d) a person registered as a social worker in the register maintained by the Northern Ireland Social Care Council under section 3 of the Health and Personal Social Services Act (Northern Ireland) 2001 (c. 3 (N.I.)).
- (3) In subsection (1)(a) “*registered medical practitioner*” includes a person who is provisionally registered under section 15 or 21 of the Medical Act 1983 and is engaged in such employment as is mentioned in subsection (3) of that section.
- (4) In subsection (1)(k) “*health service body*” means any of the following—
- (a) the Secretary of State in relation to the exercise of functions under section 2A or 2B of, or paragraph 7C, 8 or 12 of Schedule 1 to, the National Health Service Act 2006;
- (b) a local authority in relation to the exercise of functions under section 2B or 111 of, or any of paragraphs 1 to 7B or 13 of Schedule 1 to, the National Health Service Act 2006;
- (c) a National Health Service trust first established under section 25 of the National Health Service Act 2006;
- (d) a Special Health Authority established under section 28 of the National Health Service Act 2006;
- (e) an NHS foundation trust;
- (f) the National Institute for Health and Care Excellence;
- (g) NHS England;
- (h) a National Health Service trust first established under section 5 of the National Health Service and Community Care Act 1990;
- (i) a Local Health Board established under section 11 of the National Health Service (Wales) Act 2006;
- (j) a National Health Service trust first established under section 18 of the National Health Service (Wales) Act 2006;
- (k) a Special Health Authority established under section 22 of the National Health Service (Wales) Act 2006;
- (l) a Health Board within the meaning of the National Health Service (Scotland) Act 1978;
- (m) a Special Health Board within the meaning of the National Health Service (Scotland) Act 1978;
- (n) a National Health Service trust first established under section 12A of the National Health Service (Scotland) Act 1978;
- (o) the managers of a State Hospital provided under section 102 of the National Health Service (Scotland) Act 1978;
- (p) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (q) a special health and social care agency established under the Health and Personal Social Services (Special Agencies) (Northern Ireland) Order 1990 (S.I. 1990/247 (N.I. 3));
- (r) a Health and Social Care trust established under Article 10 of the Health and Personal Social Services (Northern Ireland) Order 1991 (S.I. 1991/194 (N.I. 1)).
#### General interpretation
##### 205
- (1) In this Act—
- “*biometric data*” means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of an individual, which allows or confirms the unique identification of that individual, such as facial images or dactyloscopic data;
- “*data concerning health*” means personal data relating to the physical or mental health of an individual, including the provision of health care services, which reveals information about his or her health status;
- “*enactment*” includes—an enactment passed or made after this Act,an enactment comprised in subordinate legislation,an enactment comprised in, or in an instrument made under, a Measure or Act of the National Assembly for Wales,an enactment comprised in, or in an instrument made under, an Act of the Scottish Parliament, ...an enactment comprised in, or in an instrument made under, Northern Ireland legislation; andany assimilated direct legislation;
- “*genetic data*” means personal data relating to the inherited or acquired genetic characteristics of an individual which gives unique information about the physiology or the health of that individual and which results, in particular, from an analysis of a biological sample from the individual in question;
- “*government department*” includes the following (except in the expression “*United Kingdom government department*”)—a part of the Scottish Administration;a Northern Ireland department;the Welsh Government;a body or authority exercising statutory functions on behalf of the Crown;
- “*health record*” means a record which—consists of data concerning health, andhas been made by or on behalf of a health professional in connection with the diagnosis, care or treatment of the individual to whom the data relates;
- “*inaccurate*”, in relation to personal data, means incorrect or misleading as to any matter of fact;
- “*international obligation of the United Kingdom*” includes—. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .an obligation that arises under an international agreement or arrangement to which the United Kingdom is a party;
- “*international organisation*” means an organisation and its subordinate bodies governed by international law, or any other body which is set up by, or on the basis of, an agreement between two or more countries;
- “*Minister of the Crown*” has the same meaning as in the Ministers of the Crown Act 1975;
- “*publish*” means make available to the public or a section of the public (and related expressions are to be read accordingly);
- “*subordinate legislation*” has the meaning given in the Interpretation Act 1978;
- “*tribunal*” means any tribunal in which legal proceedings may be brought;
- “*the Tribunal*”, in relation to an application or appeal under this Act, means—the Upper Tribunal, in any case where it is determined by or under Tribunal Procedure Rules that the Upper Tribunal is to hear the application or appeal, orthe First-tier Tribunal, in any other case.
- (1A) In this Act, references to fundamental rights or fundamental freedoms (however expressed) are to the Convention rights within the meaning of the Human Rights Act 1998.
- (2) References in this Act to a period expressed in hours, days, weeks, months or years are to be interpreted in accordance with Article 3 of Regulation (EEC, Euratom) No. 1182/71 of the Council of 3 June 1971 determining the rules applicable to periods, dates and time limits, except in—
- (za) section 119A(10) and (11);
- (a) section 125(4), (7) and (8);
- (b) section 161(3), (5) and (6);
- (c) section 176(2);
- (d) section 178(2);
- (e) section 182(8) and (9);
- (f) section 183(4);
- (g) section 192(3), (5) and (6);
- (h) section 197(3) and (4);
- (i) paragraph 23(4) and (5) of Schedule 1;
- (j) paragraphs 5(4) and 6(4) of Schedule 3;
- (k) Schedule 5;
- (l) paragraph 11(5) of Schedule 12;
- (la) paragraph 22(6) of Schedule 12A;
- (m) Schedule 15;
(and the references in section 5 to terms used in ... Part 2 do not include references to a period expressed in hours, days, weeks, months or years).
- (3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (4) In the definition of “the UK GDPR” in section 3(10)—
- (a) the reference to Regulation (EU) 2016/679 as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 is to be treated as a reference to that Regulation as modified by Schedule 1 to the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (“*the 2019 Regulations*”), but
- (b) nothing in the definition or in paragraph (a) determines whether, where Regulation (EU) 2016/679 is modified on or after IP completion day by the law of England and Wales, Scotland or Northern Ireland (other than by Schedule 1 to the 2019 Regulations), the reference to Regulation (EU) 2016/679 is then to be read as a reference to that Regulation as modified.
- (5) Subsection (4) is not to be read as implying anything about how other references to Regulation (EU) 2016/679 or references to other assimilated law are to be interpreted.
#### Index of defined expressions
##### 206
The Table below lists provisions which define or otherwise explain terms defined for this Act, for a Part of this Act or for Chapter 2 or 3 of Part 2 of this Act.
### Territorial application
#### Territorial application of this Act
##### 207
- (1) This Act applies only to processing of personal data described in subsections (1A) and (2).
- (1A) In the case of the processing of personal data to which Part 2 (the UK GDPR) applies, it applies to the types of such processing to which the UK GDPR applies by virtue of Article 3 of the UK GDPR.
- (2) In the case of the processing of personal data to which Part 2 does not apply, it applies where such processing is carried out in the context of the activities of an establishment of a controller or processor in the United Kingdom, whether or not the processing takes place in the United Kingdom.
- (3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (4) Subsections (1), (1A) and (2) have effect subject to any provision in or made under section 120 providing for the Commissioner to carry out functions in relation to other processing of personal data.
- (5) Section 3(14)(c) does not apply to the reference to the processing of personal data in subsection (2).
- (6) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (7) In this section, references to a person who has an establishment in the United Kingdom include the following—
- (a) an individual who is ordinarily resident in the United Kingdom,
- (b) a body incorporated under the law of the United Kingdom or a part of the United Kingdom,
- (c) a partnership or other unincorporated association formed under the law of the United Kingdom or a part of the United Kingdom, and
- (d) a person not within paragraph (a), (b) or (c) who maintains, and carries on activities through, an office, branch or agency or other stable arrangements in the United Kingdom,
....
### General
#### Children in Scotland
##### 208
- (1) Subsections (2) and (3) apply where a question falls to be determined in Scotland as to the legal capacity of a person aged under 16 to—
- (a) exercise a right conferred by the data protection legislation, or
- (b) give consent for the purposes of the data protection legislation.
- (2) The person is to be taken to have that capacity where the person has a general understanding of what it means to exercise the right or give such consent.
- (3) A person aged 12 or over is to be presumed to be of sufficient age and maturity to have such understanding, unless the contrary is shown.
#### Application to the Crown
##### 209
- (1) This Act binds the Crown.
- (2) For the purposes of the UK GDPR and this Act, each government department is to be treated as a person separate from the other government departments (to the extent that is not already the case).
- (3) Where government departments are not able to enter into contracts with each other, a provision of the UK GDPR or this Act that would require relations between them to be governed by a contract (or other binding legal act) in writing is to be treated as satisfied if the relations are the subject of a memorandum of understanding between them.
- (4) Where the purposes for which and the manner in which personal data is, or is to be, processed are determined by a person acting on behalf of the Royal Household, the Duchy of Lancaster or the Duchy of Cornwall, the controller in respect of that data for the purposes of the UK GDPR and this Act is—
- (a) in relation to the Royal Household, the Keeper of the Privy Purse,
- (b) in relation to the Duchy of Lancaster, such person as the Chancellor of the Duchy appoints, and
- (c) in relation to the Duchy of Cornwall, such person as the Duke of Cornwall, or the possessor for the time being of the Duchy of Cornwall, appoints.
- (5) Different persons may be appointed under subsection (4)(b) or (c) for different purposes.
- (6) As regards criminal liability—
- (a) a government department is not liable to prosecution under this Act;
- (b) nothing in subsection (4) makes a person who is a controller by virtue of that subsection liable to prosecution under this Act;
- (c) a person in the service of the Crown is liable to prosecution under the provisions of this Act listed in subsection (7).
- (7) Those provisions are—
- (a) section 119;
- (b) section 170;
- (c) section 171;
@@ -6414,7 +6432,7 @@
- (a) is necessary for archiving purposes, scientific or historical research purposes or statistical purposes,
- (b) is carried out in accordance with Article 89(1) of the UK GDPR (as supplemented by section 19), and
- (b) is carried out in accordance with Article 84B of the UK GDPR, and
- (c) is in the public interest.
@@ -6539,7 +6557,7 @@
- (1) This condition is met if the processing—
- (a) is necessary for the purposes of the prevention or detection of an unlawful act,
- (a) is necessary for the purposes of the prevention , investigation or detection of an unlawful act,
- (b) must be carried out without the consent of the data subject so as not to prejudice those purposes, and
@@ -6603,7 +6621,7 @@
- (1) This condition is met if—
- (a) the processing consists of the disclosure of personal data for the special purposes,
- (a) the processing consists of , or is carried out in preparation for, the disclosure of personal data for the special purposes,
- (b) it is carried out in connection with a matter described in sub-paragraph (2),
@@ -6645,7 +6663,9 @@
- (i) the disclosure of personal data by a person as a member of an anti-fraud organisation,
- (ii) the disclosure of personal data in accordance with arrangements made by an anti-fraud organisation, or
- (ii) the disclosure of personal data in accordance with arrangements made by an anti-fraud organisation,
- (iia) the processing of personal data carried out in preparation for disclosure described in sub-paragraph (i) or (ii), or
- (iii) the processing of personal data disclosed as described in sub-paragraph (i) or (ii).
@@ -6967,7 +6987,7 @@
- (d) a member of the Northern Ireland Assembly immediately before that Assembly is dissolved,
is to be treated as if the person were such a member until the end of the fourth day after the day on which the subsequent general election in relation to that Parliament or Assembly is held.
is to be treated as if the person were such a member until the end of the period of 30 days beginning with the day after the day on which the subsequent general election in relation to that Parliament or Assembly is held.
- (5) For the purposes of sub-paragraph (3), a person who is an elected member of the Common Council of the City of London and whose term of office comes to an end at the end of the day preceding the annual Wardmotes is to be treated as if he or she were such a member until the end of the fourth day after the day on which those Wardmotes are held.
@@ -6977,7 +6997,7 @@
- (1) This condition is met if—
- (a) the processing consists of the disclosure of personal data—
- (a) the processing consists of , or is carried out in preparation for, the disclosure of personal data—
- (i) to an elected representative or a person acting with the authority of such a representative, and
@@ -7257,7 +7277,7 @@
- (i) Article 5(1)(a) (lawful, fair and transparent processing), other than the lawfulness requirements set out in Article 6;
- (ii) Article 5(1)(b) (purpose limitation).
- (ii) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### Crime and taxation: general
@@ -7265,7 +7285,7 @@
- (1) The listed GDPR provisions and Article 34(1) and (4) of the UK GDPR (communication of personal data breach to the data subject) do not apply to personal data processed for any of the following purposes—
- (a) the prevention or detection of crime,
- (a) the prevention , investigation or detection of crime,
- (b) the apprehension or prosecution of offenders, or
@@ -7305,7 +7325,7 @@
- (i) the assessment or collection of a tax or duty or an imposition of a similar nature, or
- (ii) the prevention or detection of crime or apprehension or prosecution of offenders, where the offence concerned involves the unlawful use of public money or an unlawful claim for payment out of public money.
- (ii) the prevention , investigation or detection of crime or apprehension or prosecution of offenders, where the offence concerned involves the unlawful use of public money or an unlawful claim for payment out of public money.
- (3) The UK GDPR provisions referred to in sub-paragraph (1) are the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR)—
@@ -7847,7 +7867,7 @@
- (ii) Article 36 (requirement for controller to consult Commissioner prior to high risk processing);
- (d) in Chapter V of the UK GDPR (transfers of data to third countries etc), Article 44 (general principles for transfers);
- (d) in Chapter V of the UK GDPR (transfers of data to third countries etc), Article 44A (general principles for transfers);
- (e) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
@@ -7879,7 +7899,7 @@
- (3) The exemption in sub-paragraph (1) is available only where—
- (a) the personal data is processed in accordance with Article 89(1) of the UK GDPR (as supplemented by section 19), and
- (a) the personal data is processed in accordance with Article 84B of the UK GDPR, and
- (b) as regards the disapplication of Article 15(1) to (3), the results of the research or any resulting statistics are not made available in a form which identifies a data subject.
@@ -7907,7 +7927,7 @@
- (f) Article 21(1) (objections to processing).
- (3) The exemption in sub-paragraph (1) is available only where the personal data is processed in accordance with Article 89(1) of the UK GDPR (as supplemented by section 19).
- (3) The exemption in sub-paragraph (1) is available only where the personal data is processed in accordance with Article 84B of the UK GDPR.
- (4) Where processing for a purpose described in sub-paragraph (1) serves at the same time another purpose, the exemption in sub-paragraph (1) is available only where the personal data is processed for a purpose referred to in that sub-paragraph.
@@ -9437,7 +9457,9 @@
- (i) the disclosure of personal data by a competent authority as a member of an anti-fraud organisation,
- (ii) the disclosure of personal data by a competent authority in accordance with arrangements made by an anti-fraud organisation, or
- (ii) the disclosure of personal data by a competent authority in accordance with arrangements made by an anti-fraud organisation,
- (iia) the processing of personal data carried out in preparation for disclosure described in sub-paragraph (i) or (ii), or
- (iii) the processing of personal data disclosed as described in sub-paragraph (i) or (ii).
@@ -9649,7 +9671,7 @@
The listed provisions do not apply to personal data processed for any of the following purposes—
- (a) the prevention and detection of crime, or
- (a) the prevention , investigation and detection of crime, or
- (b) the apprehension and prosecution of offenders,
@@ -10389,9 +10411,9 @@
- (1) Before giving a person a penalty notice, the Commissioner must, by written notice (a “notice of intent”) inform the person that the Commissioner intends to give a penalty notice.
- (2) The Commissioner may not give a penalty notice to a person in reliance on a notice of intent after the end of the period of 6 months beginning when the notice of intent is given, subject to sub-paragraph (3).
- (3) The period for giving a penalty notice to a person may be extended by agreement between the Commissioner and the person.
- (2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### Contents of notice of intent
@@ -10429,9 +10451,17 @@
##### 4
- (1) The Commissioner may not give a penalty notice before a time, or before the end of a period, specified in the notice of intent for making oral or written representations.
- (2) When deciding whether to give a penalty notice to a person and determining the amount of the penalty, the Commissioner must consider any oral or written representations made by the person in accordance with the notice of intent.
- (A1) This paragraph applies where the Commissioner gives a notice of intent to a person.
- (A2) Within the period of 6 months beginning when the notice is given, or as soon as reasonably practicable thereafter, the Commission must give to the person—
- (a) a penalty notice, or
- (b) written notice that the Commissioner has decided not to give a penalty notice to the person.
- (1) But the Commissioner may not give a penalty notice to the person before a time, or before the end of a period, specified in the notice of intent for making oral or written representations.
- (2) When deciding whether to give a penalty notice to the person and determining the amount of the penalty, the Commissioner must consider any oral or written representations made by the person in accordance with the notice of intent.
#### Contents of penalty notice
@@ -10585,7 +10615,7 @@
##### 4
Section 164 applies where an information notice or assessment notice contains a statement under paragraph 2(2)(a) or 3(2)(a) as it applies where such a notice contains a statement under section 142(7)(a) or 146(8)(a).
Section 164 applies where an information notice , assessment notice or interview notice contains a statement under paragraph 2(2)(a) , 3(2)(a) or 3A(2)(a) as it applies where such a notice contains a statement under section 142(7)(a) , 146(8)(a) or 148A(8)(a).
## SCHEDULE 18
@@ -16276,7 +16306,7 @@
##### 58
- (1) The repeal of a provision of the 1998 Act does not affect its operation for the purposes of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“the PECR 2003”) (see regulations 2, 31 and 31B of, and Schedule 1 to, those Regulations).
- (1) The repeal of a provision of the 1998 Act does not affect its operation for the purposes of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“the PECR 2003”) (see regulation 2 of those Regulations).
- (2) Where subordinate legislation made under a provision of the 1998 Act is in force immediately before the repeal of that provision, neither the revocation of the subordinate legislation nor the repeal of the provision of the 1998 Act affect the application of the subordinate legislation for the purposes of the PECR 2003 after that time.
@@ -16364,7 +16394,7 @@
### Racial and ethnic diversity at senior levels of organisations
### Preventing or detecting unlawful acts
### Preventing etc unlawful acts
### Protecting the public against dishonesty etc
@@ -17298,22 +17328,14 @@
[^c23266331]: S. 12 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23266351]: S. 14 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23266361]: S. 16 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23266371]: S. 18 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23266381]: S. 19 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23266401]: S. 24 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23266411]: S. 30 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23266421]: S. 35 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23266431]: S. 50 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23266471]: S. 53 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23268021]: S. 54 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
@@ -17366,8 +17388,12 @@
[^key-00432701eea2cde637ac5d287f4837c8]: [Sch. 19 para. 333](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/333) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-0069451af9e1f039078d649a6b834dfb]: S. 119A(3)(aa) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 20(3)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/20/3) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-008659743a491eb703127dd80e785478]: Words in [s. 124(5)](https://www.legislation.gov.uk/ukpga/2018/12/section/124/5) omitted (20.8.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 18(a)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/18/a); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(y)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/y)
[^key-00a998ef954e776a941edb1c4f669ea3]: Words in s. 78(2) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 10(5)(a)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/10/5/a); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-00c31acc0526af8b197626c45f603186]: S. 103 in force at 16.9.2019 by [S.I. 2019/1188](https://www.legislation.gov.uk/uksi/2019/1188), [reg. 2(c)](https://www.legislation.gov.uk/uksi/2019/1188/regulation/2/c)
[^key-019c61443b227cfc431617e576673df8]: [Sch. 19 para. 368](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/368) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -17396,6 +17422,8 @@
[^key-03d2f3e7999eedf91b3cf7abed68d4f9]: [Sch. 19 para. 289](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/289) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-03fe9c07df618a44ead6a09ff7ff172f]: Words in s. 78(1) omitted (5.2.2026) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 10(3)(a)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/10/3/a); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-043f7bc14d22fdcbfb448881e634bb29]: [Sch. 14 para. 9](https://www.legislation.gov.uk/ukpga/2018/12/schedule/14/paragraph/9) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-0447af8ae299a204a2630922dc53e872]: [Sch. 19 para. 270](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/270) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -17410,24 +17438,32 @@
[^key-04deb533ed57e15add641215ed3efabf]: Sch. 20 para. 46 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-04eb1172bf0efdbe8a895be27cefc005]: Words in Sch. 21 para. 10(4)(a) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 25(8)(b)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/25/8/b) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-052d274a8bd30e1ac9982409ed6e3e86]: S. 182(9)(10) omitted (5.2.2026) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 22(6)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/22/6) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-055760fc82e5e2786df333ac02e415f3]: [Sch. 19 para. 297](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/297) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-058ceb009e6f2263b728c5df73cb3576]: Words in s. 187(2)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 81(5)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/81/5/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-05db1f618adcd0f850b18cfe67f3c291]: Words in Sch. 2 para. 4(2) substituted (8.3.2024) by [The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024 (S.I. 2024/342)](https://www.legislation.gov.uk/uksi/2024/342), [regs. 1(2)](https://www.legislation.gov.uk/uksi/2024/342/regulation/1/2), [2(5)](https://www.legislation.gov.uk/uksi/2024/342/regulation/2/5)
[^key-067b411a6f252d978f5363bb7f8fd473]: Words in [s. 161(6)](https://www.legislation.gov.uk/ukpga/2018/12/section/161/6) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 21](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/21); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(y)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/y)
[^key-067b411a6f252d978f5363bb7f8fd473]: Words in s. 161(6) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 21](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/21); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(y)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/y)
[^key-068079f0d354b65a415f2cdd6d742510]: Word in s. 165(5)(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 66(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/66/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-06e85acf6fae37d9f442573e440e4c13]: Words in s. 24(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 32(2)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/32/2/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-06ee5fb74345454741ae734d0b97ceaa]: S. 136(1)(b) and word omitted (5.2.2026) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 94(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/94/3), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(p)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/p)
[^key-07090df3ca4a1ef9932cc47e618dc305]: Words in s. 149(2)(e) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 61](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/61) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-071d1dd7492c1a08829b1e12514d44f6]: [Sch. 19 para. 393](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/393) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-073279dc56c10b95d4fc1174d2bb9002]: [Sch. 19 para. 344](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/344) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-074df9646a976c44c98e2007798a5bda]: Sch. 16 para. 4(A1)(A2) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 101(3)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/101/3/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(t)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/t) (with [reg. 6](https://www.legislation.gov.uk/uksi/2026/82/regulation/6))
[^key-075130ba76e3c3f27cf76df70ec522b8]: [Sch. 19 para. 204](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/204) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-075c9a035c809ff241232418d14ceeff]: Words in s. 190(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 84](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/84) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -17436,12 +17472,14 @@
[^key-07dee8d69012da87b02291e4c8e3d699]: Sch. 2 para. 11 table modified (28.1.2021 for specified purposes, 30.7.2022 in so far as not already in force) by [The Financial Services and Markets Act 2000 (Regulated Activities) (Amendment) Order 2021 (S.I. 2021/90)](https://www.legislation.gov.uk/uksi/2021/90), [arts. 1(2)](https://www.legislation.gov.uk/uksi/2021/90/article/1/2)[(3)](https://www.legislation.gov.uk/uksi/2021/90/article/1/3), [15(2)](https://www.legislation.gov.uk/uksi/2021/90/article/15/2)
[^key-07e5424a1ee2d09e154dd4e8255595ea]: Words in s. 73(3)(c) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 40(3)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/40/3/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-081d12fd19e15895b2c24def7373caac]: S. 135(A1) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 94(2)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/94/2/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(p)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/p)
[^key-0876256c5ad3d60e361b782c4058e808]: [Sch. 19 para. 224](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/224) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-08a66ca2af7b4b1ea6d3d87306a370f7]: Words in Sch. 2 para. 1(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(5)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/5/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-08ad9f9df54aea437bd161c772023bf2]: [S. 83(A1)](https://www.legislation.gov.uk/ukpga/2018/12/section/83/A1) inserted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 90(4)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/4/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/b)
[^key-08b293e3fde48c9b8dd1f1ec574b10ea]: S. 205(3) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 85(6)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/85/6) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-08f0dc8ee77a2e679c674a1653b65e89]: [Sch. 19 para. 44](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/44) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -17458,21 +17496,29 @@
[^key-0a47f233acc9d54f244d68e5e7b97287]: [Sch. 7 para. 7](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/7) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-0a7db461f51968f8ba878ebd21f8457e]: [S. 84(2A)](https://www.legislation.gov.uk/ukpga/2018/12/section/84/2A) inserted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 90(5)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/5/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/b)
[^key-0a802107ab2c08fc27b1ddde01f85aa8]: Words in Sch. 4 para. 1 substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 94(4)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/94/4) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-0a86b7ac7f6cd28ad8594499bf962105]: [Sch. 12 para. 4](https://www.legislation.gov.uk/ukpga/2018/12/schedule/12/paragraph/4) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-0ad994e390ded3737e0cf452dcb87c1c]: [Sch. 19 para. 88](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/88) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-0aec7eae8fcc0cb7a6400cb54bac6096]: S. 45(4)(d) omitted (5.9.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(4)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/4/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-0b089b6e1c9a68b042bfb7d6decabe4a]: Sch. 20 para. 48 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-0b10f6281c849fb152ebfa1af8d2f949]: Words in [s. 115(5)](https://www.legislation.gov.uk/ukpga/2018/12/section/115/5) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 47(6)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/47/6) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-0ba459e03e17dc61a837438daecd1a48]: Word in s. 171(3)(a) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 23(2)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/23/2); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z12)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z12)
[^key-0bfd00907b511398d0520d55dda1857c]: [Sch. 19 para. 140](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/140) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-0c2efecad359220e6a37b89dba30fb47]: [Sch. 19 para. 334](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/334) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-0c64f94808e62ce8c06e20ffbc5b1116]: [Sch. 16 para. 4](https://www.legislation.gov.uk/ukpga/2018/12/schedule/16/paragraph/4) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-0c4dc81c9c250f7500da1b0dc37fb7e1]: Words in s. 74B(7) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 5(9)(a)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/5/9/a); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-0c64f94808e62ce8c06e20ffbc5b1116]: Sch. 16 para. 4 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-0c921886eda65d928d0d76962456ecfe]: [S. 124A](https://www.legislation.gov.uk/ukpga/2018/12/section/124A) inserted (19.6.2025 for specified purposes, 20.8.2025 in so far as not already in force) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 92(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/92/2), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(f)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/f)
@@ -17486,7 +17532,7 @@
[^key-0d271530c429f861f97bd026d99487d6]: [Sch. 19 para. 48](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/48) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-0d28ce61d602ad2e767e31293c260e43]: [Sch. 16](https://www.legislation.gov.uk/ukpga/2018/12/schedule/16) applied (with modifications) by [S.I. 2016/696](https://www.legislation.gov.uk/uksi/2016/696), [Sch. 2](https://www.legislation.gov.uk/uksi/2016/696/schedule/2) (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 406](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/406) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g) (with [reg. 4](https://www.legislation.gov.uk/uksi/2018/625/regulation/4)))
[^key-0d28ce61d602ad2e767e31293c260e43]: Sch. 16 applied (with modifications) by [S.I. 2016/696](https://www.legislation.gov.uk/uksi/2016/696), [Sch. 2](https://www.legislation.gov.uk/uksi/2016/696/schedule/2) (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 406](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/406) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g) (with [reg. 4](https://www.legislation.gov.uk/uksi/2018/625/regulation/4)))
[^key-0d4b111311777831fdffba581e848ea6]: [Sch. 9 para. 5](https://www.legislation.gov.uk/ukpga/2018/12/schedule/9/paragraph/5) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
@@ -17496,16 +17542,22 @@
[^key-0e22a095e41e8693fa7318f4c45ed9e9]: [Sch. 19 para. 19](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/19) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-0e77a10a2be9269a9a10434a1228683a]: Words in s. 78(1) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 10(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/10/3/d); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-0e7dfc288a4e86482de3e20d1740cfa6]: Words in Sch. 21 para. 12(1) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 25(9)(b)(i)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/25/9/b/i) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-0e87ceeaeb473d5c9e0fc5a4ea92b025]: Sch. 20 para. 28 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-0ebeabb9baa1c3270129deaf8098cef1]: Sch. 20 para. 37 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-0ec738b14348d17f3e62b70513465a13]: [Sch. 19 para. 55](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/55) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-0ec85b5201d6c46e5fab22ab4e896d43]: Words in s. 78(5)(a) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 45(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/45/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-0ee3310713d1629ddd39380fe64cbd00]: [Sch. 19 para. 42](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/42) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-0ef61c79a2caa1fceea57dd634375af5]: S. 162(1)(ba) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 100(7)](https://www.legislation.gov.uk/ukpga/2025/18/section/100/7), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(s)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/s)
[^key-0f889346244276db6c824e1a59269789]: Words in s. 149(2)(b) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 6 para. 15(a)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/6/paragraph/15/a); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z8)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z8) (with [reg. 5](https://www.legislation.gov.uk/uksi/2026/82/regulation/5))
[^key-10250dcd0017993ac3d096de2e88503b]: Words in s. 15(2)(e) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 19(7)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/19/7/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-104c707c6a01b69f5d71d71da7c75c6d]: [Sch. 19 para. 101](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/101) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -17520,6 +17572,8 @@
[^key-1148dc6616b45f92ec3191558e2d7f41]: [Sch. 19 para. 353](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/353) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-11713a4a83eebe64064274ef861d5f85]: S. 146(3A) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 98(2)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/98/2/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(q)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/q)
[^key-1184aae7611f8dceba09b9e679d2f54c]: Sch. 1 para. 34 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-11c07ee11f2167bbb1763bd246448e85]: [Sch. 19 para. 217](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/217) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -17534,6 +17588,10 @@
[^key-12685902bd117eecdf41483cba453640]: Words in Sch. 3 para. 20(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(19)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/19) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-1284f5ea94d84d42dc81e80877b05881]: Sch. 2 para. 1(b)(ii) omitted (5.2.2026) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 71(10)](https://www.legislation.gov.uk/ukpga/2025/18/section/71/10), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(d)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/d)
[^key-12e3d0fff7beb57219b3b7559e3266e5]: Word in Sch. 2 para. 3(2)(b)(ii) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 29(3)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/29/3); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z12)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z12)
[^key-12f1ccb28a2bd9f965f7c31d10395d32]: Words in s. 205(1) substituted (1.1.2024) by [The Retained EU Law (Revocation and Reform) Act 2023 (Consequential Amendment) Regulations 2023 (S.I. 2023/1424)](https://www.legislation.gov.uk/uksi/2023/1424), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2023/1424/regulation/1/2), [Sch. para. 87(a)](https://www.legislation.gov.uk/uksi/2023/1424/schedule/paragraph/87/a)
[^key-12f86fac951fc73c0140d571a31e9292]: [Sch. 19 para. 210](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/210) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -17542,7 +17600,9 @@
[^key-1366acd7f95a9c1e06161794880e0719]: Sch. 20 para. 35 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-13cffa7e513a8d19da475b708717a6c5]: [S. 161A](https://www.legislation.gov.uk/ukpga/2018/12/section/161A) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 102(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/102/4), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(i)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/i)
[^key-13b42698594ab524aa3bd391ddbb00d8]: Word in s. 196(2) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 100(10)](https://www.legislation.gov.uk/ukpga/2025/18/section/100/10), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(s)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/s)
[^key-13cffa7e513a8d19da475b708717a6c5]: S. 161A inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 102(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/102/4), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(i)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/i)
[^key-145f005fd8042c51b0664ff136e39957]: [Sch. 7 para. 18](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/18) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
@@ -17550,6 +17610,8 @@
[^key-14ad0fde7b800982b4c427e3cb39df35]: Sch. 1 para. 6 modified by [S.I. 1999/677](https://www.legislation.gov.uk/uksi/1999/677), [art. 7(1)(2)](https://www.legislation.gov.uk/uksi/1999/677/article/7/1/2) (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 237](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/237) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g))
[^key-14dc1bd03f341f46d16e2b23a8854253]: S. 51(1)(ba) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 79(7)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/79/7/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/a) (with [reg. 3](https://www.legislation.gov.uk/uksi/2025/996/regulation/3))
[^key-15470efb9363c5548c4b065c183e0df8]: [Sch. 19 para. 214](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/214) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-15749221f368fbb105364a1b67ee891c]: [Sch. 19 para. 38](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/38) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -17560,6 +17622,8 @@
[^key-1622e2e636a8697beaac52d8c441e4ac]: Sch. 1 para. 20 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-163fd2a2c3332fd617114d54434beede]: Words in s. 155(1)(b) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 100(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/100/4), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(s)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/s)
[^key-16bde097283134ad53e67bc7eced6507]: [Sch. 9 para. 2](https://www.legislation.gov.uk/ukpga/2018/12/schedule/9/paragraph/2) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-16c6bec2c0f932b75e6e897d0d0214e1]: [Sch. 19 para. 300](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/300) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -17568,10 +17632,14 @@
[^key-1751702947b03f5d997effe7d3559e00]: [Sch. 19 para. 59](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/59) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-177f4502bd713ba257f8a94220cf312a]: Words in s. 53(5) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 75(2)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/75/2/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(g)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/g)
[^key-17a7230647a2583246524911d5578f98]: [Sch. 19 para. 403](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/403) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-18239a18e3bd9a603de2281708e6151d]: [Sch. 19 para. 241](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/241) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-1851ffdfb55a1ae4837371dce443325b]: Words in s. 110(2)(a) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(9)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/9/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-187011edc25500f0e9ac9f2a1b42e1b3]: [Sch. 19 para. 180](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/180) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-187293003be44c5bcbbaa54a11235709]: [Sch. 8 para. 1](https://www.legislation.gov.uk/ukpga/2018/12/schedule/8/paragraph/1) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
@@ -17590,11 +17658,13 @@
[^key-192b65f20b37cd2b1425d8b8099bd30c]: [Sch. 19 para. 427](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/427) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-197984193b1a0c63c5cf1d6bdb297f95]: S. 45 cross-heading omitted (5.9.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 79(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/79/5), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/a) (with [reg. 3](https://www.legislation.gov.uk/uksi/2025/996/regulation/3))
[^key-1a7305813bab945662593ecbbd86a3cc]: [Sch. 19 para. 267](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/267) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-1a7fa63e5530837c3583f0e5c7220882]: Words in s. 5(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 6(2)(c)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/6/2/c) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-1aa44aabdb698a96bbb40d99be769ffe]: Words in [s. 181](https://www.legislation.gov.uk/ukpga/2018/12/section/181) omitted (20.8.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 24](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/24); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(y)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/y)
[^key-1aa44aabdb698a96bbb40d99be769ffe]: Words in s. 181 omitted (20.8.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 24](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/24); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(y)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/y)
[^key-1ae0cb7d1e50923dabeee3e28331a92e]: S. 206: power to amend conferred (19.6.2025 for specified purposes, 20.8.2025 in so far as not already in force) by Regulation (EU) 679/2016, Art. 11A(3) (as inserted by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 74(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/74/1), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(c)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/c))
@@ -17602,12 +17672,16 @@
[^key-1affb68b010b011243d40d4337506c52]: Word in s. 205(5) substituted (1.1.2024) by [The Retained EU Law (Revocation and Reform) Act 2023 (Consequential Amendment) Regulations 2023 (S.I. 2023/1424)](https://www.legislation.gov.uk/uksi/2023/1424), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2023/1424/regulation/1/2), [Sch. para. 87(b)](https://www.legislation.gov.uk/uksi/2023/1424/schedule/paragraph/87/b)
[^key-1b040d8edc9113c2fe18f72c65488af0]: S. 155(1)(c) and word inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 98(4)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/98/4/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(q)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/q)
[^key-1b3210620a45e848232ab9e47619a0b4]: [Sch. 19 para. 134](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/134) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-1b4ccf50fa29ed8677a8eda0173f00f9]: [Sch. 19 para. 349](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/349) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-1bc27c21cc548d92bc3de596a7cdbe0e]: Words in s. 213(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 90(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/90/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-1bdda78ceb7b33ce85740d055b1a3758]: S. 24(4)(ba) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 87(2)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/87/2/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(o)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/o)
[^key-1be29581136bd4c18ff6bb98bfbee461]: [Sch. 7 para. 28](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/28) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-1be9e273ac0b64d03506cf32210c1a57]: Sch. 3 para. 18 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
@@ -17616,6 +17690,8 @@
[^key-1c131e673e4b114091bed8a61ac7815e]: [Sch. 9 para. 3](https://www.legislation.gov.uk/ukpga/2018/12/schedule/9/paragraph/3) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-1c39091bca9026eb347e79e1fa4a78e5]: Words in s. 205(2)(e) omitted (5.2.2026) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 23](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/23) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-1cc22440a757c75d6a761e14e8508d42]: Sch. 20 para. 18(8) inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 101(4)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/101/4/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)) (as amended by [S.I. 2020/1586](https://www.legislation.gov.uk/uksi/2020/1586), [regs. 1(2)](https://www.legislation.gov.uk/uksi/2020/1586/regulation/1/2), [5(3)](https://www.legislation.gov.uk/uksi/2020/1586/regulation/5/3)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-1ccd56afc99d98d997ea26936d814e5e]: [Sch. 7 para. 35](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/35) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
@@ -17628,12 +17704,16 @@
[^key-1d55fa5fc856a1be58b2f58fd5d98059]: S. 165(6) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 66(4)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/66/4) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-1d6dfd3a633b39d621c1ab30454c7837]: Sch. 21 para. 10(6) omitted (5.2.2026) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 25(8)(c)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/25/8/c) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-1e29eba27e76c7408aaff2905df122df]: [Sch. 19 para. 313](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/313) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-1e4185b59d1be365db23794ea0ee1651]: Words in s. 16(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 20(2)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/20/2/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-1e98d97332c9829fa200bf50f75866b5]: [Sch. 19 para. 63](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/63) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-1ecad5e9871f13d9cd7d7b16b0161128]: Pts. 5-7 applied in part (with modifications) (5.2.2026) by [S.I. 2003/2426](https://www.legislation.gov.uk/uksi/2003/2426), [reg. 31](https://www.legislation.gov.uk/uksi/2003/2426/regulation/31), [Sch. 1](https://www.legislation.gov.uk/uksi/2003/2426/schedule/1) (as substituted by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 115(5)(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/115/5/8), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 13](https://www.legislation.gov.uk/ukpga/2025/18/schedule/13); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(y)(z14)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/y/z14) (with [regs. 8-11](https://www.legislation.gov.uk/uksi/2026/82/regulation/8)))
[^key-1ee41f387acdf11b0ee41fecc521ae98]: Words in [s. 115(4)](https://www.legislation.gov.uk/ukpga/2018/12/section/115/4) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 47(5)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/47/5) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-1ee641f3c321f91dfed1e82cc0461f56]: [Sch. 19 para. 135](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/135) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -17650,12 +17730,18 @@
[^key-20637b6951bd30d789aabe29602a4eb2]: [Sch. 19 para. 97](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/97) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-20ea859c115d39d5e3436826e6c5c262]: Sch. 21 para. 8 omitted (5.2.2026) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 25(5)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/25/5) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-2100b3196361a95d8557db2f9b70e820]: [Sch. 19 para. 381](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/381) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-211221de3dc056053a4c24f48f61a5c6]: [Sch. 19 para. 110](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/110) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-213b489d8cd0817f932abf8b31c43adb]: [Sch. 19 para. 2](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/2) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-2168a1b3e7131b302945e8fe317f3c27]: Words in s. 87(1)(a) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 71(9)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/71/9/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(d)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/d)
[^key-218ac3e533ec93bd9bdc354aed5273ba]: S. 74A omitted (5.2.2026) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 4(1)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/4/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-21b9303a7f71f231674bf2d10ba2e078]: Words in Sch. 3 para. 6(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(9)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/9) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-21cd06c381ae74c2c93a120a10d0d395]: Sch. 20 para. 2 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -17664,12 +17750,16 @@
[^key-21fced2ab0bcbddc5fc58b17d5e47dcf]: [Sch. 19 para. 287](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/287) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-220a17bfd3f14d70dbffc23b40f7617c]: Ss. 74AA, 74AB inserted (19.6.2025 for specified purposes) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h), [Sch. 8 para. 4(2)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/4/2)
[^key-220a17bfd3f14d70dbffc23b40f7617c]: Ss. 74AA, 74AB inserted (19.6.2025 for specified purposes, 5.2.2026 in so far as not already in force) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h), [Sch. 8 para. 4(2)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/4/2); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-224603786e8386f2203555d1040fa06f]: [Sch. 7 para. 2](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/2) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-224beca082638e8b5e55543343cc38ac]: [S. 158](https://www.legislation.gov.uk/ukpga/2018/12/section/158) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-2289dc8b6eefe1d46d6a782ef7ea28b8]: S. 19 and cross-heading omitted (5.2.2026) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 86(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/86/6), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(n)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/n)
[^key-228a2c4e83873d484f3840e102ea75d9]: Word in s. 171(6)(a) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 23(3)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/23/3); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z12)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z12)
[^key-22a9c9e8dbf86322bdf3b841fb939851]: [Sch. 19 para. 122](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/122) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-22c9cb2cd2037b308003142aeeee5b32]: Words in s. 5(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 6(3)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/6/3/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -17690,6 +17780,12 @@
[^key-23f48e53190001650ee581d5ea78c872]: [Sch. 19 para. 304](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/304) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-23f61e511accf4c5242cc571d1f808b8]: Words in s. 79(8) substituted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(8)(f)(ii)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/8/f/ii), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-24005f7ff051c74ba6fbee3b3344f7d6]: Word in [s. 104(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/104/1) substituted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 90(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/6), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/b)
[^key-2403c9bfbf96edff074974c79b22608a]: Words in s. 75(3) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 6(6)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/6/6); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-2434c3fb6c8b5ee17896e645120e0c61]: Sch. 2 para. 27 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-248079bcb833bce1b84980bc42a826bf]: Words in Sch. 3 para. 8(1)(b) substituted (30.11.2022) by [The Health and Social Care Act (Northern Ireland) 2022 (Consequential Amendments) Order 2022 (S.I. 2022/1174)](https://www.legislation.gov.uk/uksi/2022/1174), [arts. 1(2)](https://www.legislation.gov.uk/uksi/2022/1174/article/1/2), [12(3)(a)](https://www.legislation.gov.uk/uksi/2022/1174/article/12/3/a)
@@ -17702,6 +17798,8 @@
[^key-25346aaf6bc9db597d7da83585c8bc2f]: [Sch. 19 para. 118](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/118) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-2593e756947a665be89cb620b04ef451]: Words in s. 72(1)(b) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 2(b)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/2/b); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-25d3635823d956cf15b550afd13d4e98]: Words in s. 206 Table inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 86(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/86/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-2626514eaa370e042778c491444aee9c]: [Sch. 19 para. 11](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/11) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -17714,6 +17812,10 @@
[^key-265056c26b76a20e1dbc856fb69e9468]: [Sch. 19 para. 121](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/121) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-2686f9acbc03b702d067ea3f8d19b78f]: Words in s. 157(4) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 100(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/100/5), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(s)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/s)
[^key-26d90feb72847e03ea021fb96e4178ec]: Word in Sch. 16 para. 4(1) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 101(3)(b)(i)](https://www.legislation.gov.uk/ukpga/2025/18/section/101/3/b/i), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(t)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/t) (with [reg. 6](https://www.legislation.gov.uk/uksi/2026/82/regulation/6))
[^key-26ded41f68d1f732b3865cc93e8d88fd]: Sch. 2 para. 19 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-26e02e31432cdbfaad7525568f904f96]: [Sch. 19 para. 280](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/280) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -17762,6 +17864,10 @@
[^key-2a3a6de533c8c12b0494351998aa1271]: Sch. 20 para. 24 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-2a41d0e360feb8153add5e203acb19c0]: Words in s. 181 inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 100(9)](https://www.legislation.gov.uk/ukpga/2025/18/section/100/9), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(s)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/s)
[^key-2a87aa80873751cb087012413e702374]: Words in s. 24(2)(c) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 16(a)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/16/a) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-2acdeca126a2ebe1ce6a4586947c1173]: [Sch. 19 para. 306](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/306) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-2b2224275f44680ddca2bfd57fbc2416]: [Sch. 19 para. 250](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/250) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -17774,10 +17880,12 @@
[^key-2bb2789479074d0f5b04dc7d5c186c7f]: Sch. 21: power to amend conferred (19.6.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 142(2)(g)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/g), [143(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/143/2)
[^key-2c18515dd4765f9f04330a4672395f59]: Words in s. 14(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 17(2)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/17/2/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-2c7e00ac1f688e12ca2bcc445e3ef4a8]: [Sch. 19 para. 192](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/192) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-2c823c725443a820c779371731696d6c]: Words in s. 72(1)(b) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 2(a)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/2/a); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-2cb53e6958194b9c8f2dfb3797109eb5]: Word in Sch. 21 para. 12(1)(a) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 25(9)(b)(ii)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/25/9/b/ii) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-2d48534b027b25a30a2b80c2a510dd6b]: [Sch. 19 para. 243](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/243) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-2d89ded5d2f38b02918f66bf72aa9a67]: [Sch. 19 para. 34](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/34) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -17792,6 +17900,8 @@
[^key-2ee236ebdbefaa20152eb5e389c3f15f]: [S. 139A](https://www.legislation.gov.uk/ukpga/2018/12/section/139A) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 95](https://www.legislation.gov.uk/ukpga/2025/18/section/95), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(h)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/h)
[^key-2f056c8fbea11fd72923190c3a60a7e8]: [S. 82(A1)](https://www.legislation.gov.uk/ukpga/2018/12/section/82/A1) inserted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 89(2)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/89/2/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/a)
[^key-2f0e9d2ad7758b3d8eeaabe264498df0]: [Sch. 15 para. 11](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/11) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-2f2b6b8a9c341182dd7aa56637785a0a]: Words in Sch. 2 para. 1(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(5)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/5/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -17802,12 +17912,16 @@
[^key-2fdc0f7c7c058ffa2465d97115f722c5]: [Sch. 19 para. 286](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/286) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-3039aa24ff9ca1b28fabc3817626b72d]: S. 77 cross-heading substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 8](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/8); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-305ad8039b1a46c5f9ea78fe8a6b5ff7]: [S. 183(2A)](https://www.legislation.gov.uk/ukpga/2018/12/section/183/2A) inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 78(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/78/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-30d4dac90018730975d3332a90aa59d7]: Words in s. 24(5)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 32(5)(d)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/32/5/d) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-30f8f37f3351a58e02d6f5b4850e8f6a]: [Sch. 19 para. 299](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/299) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-30f9474fc1a05e0f61d821c1b8087a7b]: Words in Sch. 21 para. 6(1)(a) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 25(4)(a)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/25/4/a) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-30fb2804b001c6b0ad13a62b29019b1d]: [S. 128](https://www.legislation.gov.uk/ukpga/2018/12/section/128) omitted (20.8.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 92(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/92/5), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(f)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/f)
[^key-3119209adeaef6a1df5147b527a4b2b7]: Words in s. 77(8) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 44](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/44) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -17840,6 +17954,8 @@
[^key-3327a481d30c9bdff556a8b76ded69cb]: [Sch. 19 para. 123](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/123) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-332de4f04a0a242ded4037391f956f33]: Words in s. 36(1)(a) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 71(8)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/71/8/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(d)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/d)
[^key-334055490339c13a3065b12d15d14412]: [S. 163](https://www.legislation.gov.uk/ukpga/2018/12/section/163) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-3369d46a2dc6feb2b919520a08308048]: [Sch. 19 para. 103](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/103) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -17874,6 +17990,8 @@
[^key-358700da09bd3b3db589d842d7dd9ab7]: Words in s. 17(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 22(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/22/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-35c1456922e0715ba072c49f2627e940]: S. 76(A1) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 7(3)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/7/3); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-35c840436ea427bbc6b05f90d6e943f1]: [Sch. 19 para. 131](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/131) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-35db6d3245ae82a21c0141b79278945a]: Words in s. 25(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 33(2)(c)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/33/2/c) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -17898,14 +18016,20 @@
[^key-37f00e3fbcf6a1325a7bdb8cee3541b8]: Words in [s. 3(9)(d)](https://www.legislation.gov.uk/ukpga/2018/12/section/3/9/d) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 107(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/107/2), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(l)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/l)
[^key-37f0e7baab56b10e415c83cab5bddb11]: Words in s. 74B(4) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 5(5)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/5/5); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-3813ee8247c9e3239d38238f596aab7f]: Words in [s. 120(6)](https://www.legislation.gov.uk/ukpga/2018/12/section/120/6) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 52(4)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/52/4) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-38b76457e1736087523fe425b9baf70a]: [Sch. 19 para. 371](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/371) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-38c99db18cd5c194cee9495ce48403e8]: [Sch. 19 para. 223](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/223) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-38e9d9c17d56c79090d6074e03e8ddbc]: S. 73(1)(c) and word inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 3(3)(c)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/3/3/c); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-38f52a9e32414b17494731e4cbb18039]: Words in [Sch. 2 Pt. 4](https://www.legislation.gov.uk/ukpga/2018/12/schedule/2/part/4) heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(15)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/15) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-38fa0eb45714967ac6481ea2074debe8]: [S. 84(6B)](https://www.legislation.gov.uk/ukpga/2018/12/section/84/6B) inserted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 90(5)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/5/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/b)
[^key-391aec4a4ec0685cabdd1aa28a8ba785]: Words in s. 15(2)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 19(3)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/19/3/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-394e213ab391d7a2301095c644dcd821]: Sum in s. 157(6) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 64(5)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/64/5) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -17938,10 +18062,18 @@
[^key-3ab92aa41a35b7fca7dfb7bb9e94ab09]: [Sch. 19 para. 176](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/176) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-3af973959f9df0279172807036d2ff65]: Word in s. 135(3) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 94(2)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/94/2/d), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(p)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/p)
[^key-3b189075aee602d5dd61a066dc8f918f]: [Sch. 19 para. 43](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/43) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-3b334490a5b70cdd54dc63818afde14d]: [S. 2(2)](https://www.legislation.gov.uk/ukpga/2018/12/section/2/2) omitted (20.8.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 91(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/91/2), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(e)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/e)
[^key-3baa6060931d93b6943577f334d005b6]: S. 75(4)-(7) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 6(7)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/6/7); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-3be04071b6e982862efa5dedc98b91c5]: [Ss. 82A-82E](https://www.legislation.gov.uk/ukpga/2018/12/section/82A) inserted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 89(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/89/3), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/a)
[^key-3bf08e78325296b3e02f96ed8461dc11]: Words in Sch. 21 para. 9(3)(a) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 25(6)(b)(ii)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/25/6/b/ii) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-3c0bda84559a635149b77d2604f5e78b]: [Sch. 19 para. 308](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/308) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-3c2c46a40b01364a2f55ced34f0da62b]: Sch. 2 para. 17 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
@@ -17958,8 +18090,6 @@
[^key-3cd4b21c486fb333c4f69a8f7f6ab0fa]: Sch. 1 para. 27 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-3d084b212bc615dd082bd37fe99059b7]: Words in s. 19(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 25](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/25) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-3d17c501d2052e26fccb827029f0a864]: Word in s. 16(2)(a)(ii) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 20(3)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/20/3/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-3d3c389152b7c8322a41c76aa2f421da]: Sch. 1 para. 15 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
@@ -17978,18 +18108,26 @@
[^key-3ea752fe762439ea500ec02ee2749c5a]: Words in s. 15(2)(d) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 19(6)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/19/6/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-3eaa0823ead96c831913592484a5d070]: Words in s. 45(7)(a) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(4)(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/4/c), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-3eb4d6aaf025a6d26ecf486d178f137f]: Words in [s. 115(2)(b)](https://www.legislation.gov.uk/ukpga/2018/12/section/115/2/b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 47(4)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/47/4/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-3ed12644095170b55de459a25220e589]: Word in s. 155(1)(a) omitted (5.2.2026) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 98(4)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/98/4/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(q)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/q)
[^key-3eefcad59e5059bb1f25e0745e831a85]: Word in [s. 129(3)](https://www.legislation.gov.uk/ukpga/2018/12/section/129/3) substituted (19.6.2025 for specified purposes, 20.8.2025 in so far as not already in force) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 92(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/92/6), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(f)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/f)
[^key-3ef88b0e811cc1444359e5e0cb768e95]: Words in s. 28(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 36(3)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/36/3/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-3f625eda300a4caa4b2537beb0425bcb]: Sch. 20 para. 13 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-3f7ad845a14fe6000892c2d50d22b759]: Words in s. 73(4)(b)(i) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 3(5)(b)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/3/5/b); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-3f969b23e46516434ae2e89ddc69df68]: Words in s. 15(4) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 19(10)(c)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/19/10/c) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-3f98c0a7a2654c2ef537f15b5f7eb22f]: [Sch. 19 para. 423](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/423) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-3fd65504d7dcf79fa723e5de5abf3481]: Words in s. 182(6) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 22(3)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/22/3) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-40291df4906d4cc34785699c69e47b83]: Sch. 2 para. 28(4) inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(24)(d)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/24/d) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-403f2e7140850b3e5a4883ebe1dfba4a]: [Sch. 19 para. 40](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/40) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -18016,6 +18154,8 @@
[^key-427e92f73b3e719ad3cf5a1214730481]: Words in s. 187(1)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 81(3)(c)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/81/3/c) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-428c10615c092e807aebccc777cfb710]: Sch. 21 para. 12 renumbered as Sch. 21 para. 12(1) (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 25(9)(a)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/25/9/a) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-43046246cf3f27e7ff102d3f13a65766]: [Sch. 19 para. 252](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/252) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4306e68c9bcde53b4480e1f50d20f060]: Sch. 2 para. 5 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
@@ -18030,6 +18170,8 @@
[^key-43bc0992bbfa072aa58b065a6a0dbcb2]: [Sch. 8 para. 7](https://www.legislation.gov.uk/ukpga/2018/12/schedule/8/paragraph/7) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-43bee759a5f6cbf8926b877ad7d6d594]: S. 78A inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(7)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/7), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-440e3de22d9a2fac78e668ed17f56a46]: [Sch. 10 para. 7](https://www.legislation.gov.uk/ukpga/2018/12/schedule/10/paragraph/7) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-445f17fb666df6c1f9cf69c559a379b6]: [Sch. 19 para. 230](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/230) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -18038,6 +18180,8 @@
[^key-450c7b25512dedb58adb3ea87cb6ba20]: [Pt. 2 Ch. 2](https://www.legislation.gov.uk/ukpga/2018/12/part/2/chapter/2) heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 7](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/7) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-450d49414ec7653fc52157b5f13d5626]: S. 78(7) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 10(10)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/10/10); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-45472bbd00a393b549f1e72fd153ac3f]: [Sch. 19 para. 119](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/119) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-456760319c42feac9a7898e5f44b1b19]: [Sch. 19 para. 12](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/12) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -18048,32 +18192,50 @@
[^key-4670484b4cf22739c3b6dc134a6750aa]: Words and comma in s. 117 omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 49(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/49/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-46a72a966d1ff585bedf865cca8cec16]: Words in s. 14(5) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 17(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/17/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-46dee059f9cbf1fe5d1cc11477168436]: Words in s. 73(3)(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 40(3)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/40/3/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-476957a259953895973b48488fd85773]: Sch. 1 para. 6 modified by S.I. 1999/3145, art. 9(1)(2) (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 238](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/238) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g))
[^key-479c0bc37322fff5ab05a964ed5802b3]: [Sch. 19 para. 162](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/162) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-47b298b6510458494f665aeeee02e734]: [S. 82(4)](https://www.legislation.gov.uk/ukpga/2018/12/section/82/4) inserted (19.6.2025 for specified purposes, 17.11.2025 in so far as not already in force) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 89(2)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/89/2/d), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/a)
[^key-47be8568fc2fb24fc749f0903b5c4987]: Words in s. 7(4) substituted (25.1.2023) by [Advanced Research and Invention Agency Act 2022 (c. 4)](https://www.legislation.gov.uk/ukpga/2022/4), [s. 13(1)](https://www.legislation.gov.uk/ukpga/2022/4/section/13/1), [Sch. 3 para. 14(b)](https://www.legislation.gov.uk/ukpga/2022/4/schedule/3/paragraph/14/b); [S.I. 2023/58](https://www.legislation.gov.uk/uksi/2023/58), [reg. 2](https://www.legislation.gov.uk/uksi/2023/58/regulation/2)
[^key-47eb0702215830c476b0ed47eb46e7dd]: Words in s. 8 omitted (5.2.2026) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 70(7)](https://www.legislation.gov.uk/ukpga/2025/18/section/70/7), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(c)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/c)
[^key-482221ff062473b1919305c7eba14534]: Words in Sch. 21 para. 10(1) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 25(8)(a)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/25/8/a) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-482cfc0bdfdc1cd7467d24b06e056b53]: Word in [s. 203(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/203/1) inserted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 90(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/8), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/b)
[^key-4849df2d1d93b321b98b1225cfbb8277]: S. 79(3A) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(8)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/8/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-48556573bb2ddc6e999946cea4c7d1d1]: Words in [Sch. 2](https://www.legislation.gov.uk/ukpga/2018/12/schedule/2) heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-48752be13f0732ee1bc7ba1f42c99452]: S. 54(3A)-(3D) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 76(6)(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/76/6/c), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(h)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/h) (with [reg. 4](https://www.legislation.gov.uk/uksi/2026/82/regulation/4))
[^key-489b6d3d98bf09a70287853137ab35e6]: Words in Sch. 2 para. 27(3)(a) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 87(2)(c)(i)](https://www.legislation.gov.uk/ukpga/2025/18/section/87/2/c/i), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(o)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/o)
[^key-48eaeef4a832b970bc428de9cf37c88d]: [S. 175](https://www.legislation.gov.uk/ukpga/2018/12/section/175) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-493b6699ab43b773b99b03d2551ed8b8]: Words in s. 15(2)(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 19(4)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/19/4/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-4946c510a1d7d274f8f33e589eefa4ab]: Sch. 2 para. 4(1A)-(1C) inserted (31.1.2022) by [The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2022 (S.I. 2022/76)](https://www.legislation.gov.uk/uksi/2022/76), [regs. 1(2)](https://www.legislation.gov.uk/uksi/2022/76/regulation/1/2), [2(2)(b)](https://www.legislation.gov.uk/uksi/2022/76/regulation/2/2/b)
[^key-494dd52ba56482beabc25e56147b27ce]: Words in [s. 1(5)](https://www.legislation.gov.uk/ukpga/2018/12/section/1/5) inserted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 90(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/2), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/b)
[^key-4974e4683c63a2295b4c8e367be9b4bd]: [Sch. 19 para. 384](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/384) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-49b5b8891d09db8683757e7b32a72562]: [Sch. 19 para. 1](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/1) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-49c6c21a8f1c4f4ca1ccfff6d70d38c9]: [Sch. 19 para. 184](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/184) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-49fe73ca1ed5e09d77a6cff08738e315]: Words in s. 206 Table inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 100(11)](https://www.legislation.gov.uk/ukpga/2025/18/section/100/11), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(s)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/s)
[^key-4a5f063f25fb8de879cdc65f385fe055]: Sch. 21 para. 6(3) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 25(4)(c)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/25/4/c) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-4a697ea4ae028d646b23790db24f4bf7]: Words in Sch. 3 para. 11 substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(12)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/12) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-4a91bcf4f11286ff218d1506b5ffd7bb]: Word in Sch. 11 para. 2(a) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 31](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/31); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z12)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z12)
[^key-4ac91bf85ec11b5b09d2cffc0834e330]: [Sch. 11 para. 3](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/3) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-4acce7a36a65b3dfa88122e1ac018720]: Words in s. 206 Table inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 117(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/117/5), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(r)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/r)
@@ -18088,12 +18250,16 @@
[^key-4c80cd42315c6365ff023e85a763c2e5]: Words in s. 18 heading inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 24(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/24/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-4cacf6ad42f2ff6a460cd4fecf587502]: Words in s. 78(2) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 10(5)(b)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/10/5/b); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-4cb750ea4557f2baffcc01c9e44b677f]: Sch. 7 para. 50 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-4cdb09090293d26d78397375ceeeef64]: Word in s. 205(1) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 85(2)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/85/2/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-4cf3e7d466f11b7e40ea1d651a44da91]: [Sch. 19 para. 277](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/277) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4d0adcfaa451f8df9766cc65dfba95e8]: Words in [s. 202(1)(a)(i)](https://www.legislation.gov.uk/ukpga/2018/12/section/202/1/a/i) inserted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 90(7)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/7), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/b)
[^key-4d10128808e45c569543c313b90f3f68]: Words in s. 5(7) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 6(6)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/6/6/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-4d5bceecca89ad72be32168252e30a12]: Sch. 1 para. 18 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
@@ -18104,8 +18270,12 @@
[^key-4d956270edecbf7135abf8cbbd045529]: [Sch. 19 para. 399](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/399) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4d9aa0606c413206cb1320a83695979d]: Words in s. 110(2)(b) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(9)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/9/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-4dd14d64a5ac75aa8ddd3bd00ead5989]: [Sch. 15 para. 9](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/9) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-4e053c869dd0d1212f96f10b0bd1f15c]: Words in s. 44(7)(a) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(3)(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/3/c), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-4e053f303d63b7b74a499c4480735616]: [Sch. 19 para. 409](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/409) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4e06da20a4ee2b31f0f19b9c470f9b8d]: Words in Sch. 1 para. 2(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 91(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/91/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -18116,6 +18286,12 @@
[^key-4ef43de1fd3d22fa65d544c29721ca53]: Sch. 20 para. 54 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4ef7c38139417e706b6402b58c13c6a1]: Words in s. 75(2) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 6(5)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/6/5); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-4f3513a26367d91804bfa7f435078e46]: Words in s. 79(7) substituted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(8)(e)(i)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/8/e/i), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-4f560578ecfbff00c81b108cc574f95c]: Words in s. 79(7) substituted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(8)(e)(ii)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/8/e/ii), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-4fabde886f7f8ff4ffdec98db5a5a329]: [Sch. 19 para. 317](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/317) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4fdda46f1a69130f122c5704602c094d]: [Sch. 19 para. 379](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/379) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -18126,26 +18302,34 @@
[^key-50685db8378599c3d063ffd01618c754]: Words in s. 155(2)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 63](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/63) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-50b24bd536f09a25fb71ed7410fa8f3b]: Words in s. 76(1)(e) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 7(4)(d)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/7/4/d); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-51071121f70681b71cab6d579e3ad89a]: [Sch. 19 para. 61](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/61) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5161df839eddc2224f1ac8381d920e73]: [Sch. 19 para. 294](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/294) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-518f0c230d07941d0b60ba6ea8afffc9]: Words in s. 28(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 36(3)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/36/3/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-51a420e340d7561e52b67143aef34c49]: S. 186(3)(ca) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(10)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/10), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-51e5c70be67119667b759e829b6ec310]: [Sch. 19 para. 342](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/342) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-51f9e4c401bc3155e422927720dd9738]: Words in Sch. 2 para. 28(3) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 87(2)(c)(ii)](https://www.legislation.gov.uk/ukpga/2025/18/section/87/2/c/ii), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(o)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/o)
[^key-522cc2ffd4fbefd6bc331626b37d8649]: Words in s. 159(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 65](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/65) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-523e415bc234f62c893d91846c4c7579]: [S. 3(9)(e)](https://www.legislation.gov.uk/ukpga/2018/12/section/3/9/e) and word omitted (20.8.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 14(b)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/14/b); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(y)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/y)
[^key-524d29be7a87de3454a3657a29965b20]: Words in Sch. 2 para. 27(3)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(23)(c)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/23/c) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-5277e76770029ad12ef38864a40b6300]: Sch. 20 para. 31 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5294d6d9aa82b0309648f5ec4d8160db]: [Sch. 19 para. 346](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/346) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-52ed2b8cb72fb84acd6e2db1c86a4a19]: Words in s. 15(2)(e) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 19(7)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/19/7/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-53107efacf22ac248514ba40c62a4ee5]: Words in s. 74B(6)(a) omitted (5.2.2026) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 5(7)(a)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/5/7/a); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-5323f01b951ce1dc681a7e41c427fe5a]: Words in [s. 83(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/83/1) substituted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 90(4)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/4/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/b)
[^key-536ca137c3e35cd31b66970c3841bf62]: [Sch. 19 para. 392](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/392) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-537ddaa4e08f232eeb349cab5d9e3a51]: [Sch. 19 para. 91](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/91) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -18154,8 +18338,12 @@
[^key-5408ef8b4fef9b4413225ee38a7c8a5d]: Words in s. 165(7) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 66(5)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/66/5) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-5418e3ab3799af9615274352eba15429]: Words in s. 54(2) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 76(6)(b)(i)](https://www.legislation.gov.uk/ukpga/2025/18/section/76/6/b/i), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(h)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/h) (with [reg. 4](https://www.legislation.gov.uk/uksi/2026/82/regulation/4))
[^key-541c32cbb194df275a3b189f928f6db1]: [Sch. 19 para. 21](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/21) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-54284906fe76feffec80867f982781e9]: Words in s. 87(1)(b) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 71(9)(b)(i)](https://www.legislation.gov.uk/ukpga/2025/18/section/71/9/b/i), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(d)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/d)
[^key-542d243b9191f7169b7009b1177f80e5]: S. 3(9)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 4(3)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/4/3/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-547275c503d1622ed745a1844aa3c05c]: [Sch. 19 para. 231](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/231) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -18168,6 +18356,8 @@
[^key-551a5acb36329559fb8567a347c30867]: [Sch. 10 para. 8](https://www.legislation.gov.uk/ukpga/2018/12/schedule/10/paragraph/8) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-556c71ac16f94e09c49f45e309bf0afd]: Words in Sch. 16 para. 4(1) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 101(3)(b)(ii)](https://www.legislation.gov.uk/ukpga/2025/18/section/101/3/b/ii), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(t)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/t) (with [reg. 6](https://www.legislation.gov.uk/uksi/2026/82/regulation/6))
[^key-5596802d5ca5ee15d01f2a0e77ed94e9]: [Sch. 19 para. 236](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/236) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-55d404a9f5a64d1bf721098163e73e8c]: Words in s. 185(4)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 79](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/79) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -18178,6 +18368,8 @@
[^key-562d08cd2dcb5be04009f471b7f9552f]: [Sch. 19 para. 200](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/200) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5633966e010ddf6145173a099d2c2156]: Words in s. 79(5) substituted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(8)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/8/d), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-5652c80df7fd4845a3ee74d7a2a77128]: Sch. 20 para. 58 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-56536b33263227125ad45c4609bbea48]: [Sch. 7 para. 33](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/33) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
@@ -18188,6 +18380,10 @@
[^key-56a85299b8061657d3e11b677b355c71]: [Sch. 9 para. 6](https://www.legislation.gov.uk/ukpga/2018/12/schedule/9/paragraph/6) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-56e9ccbc908fd8c21431b5532b3be0d6]: Words in s. 78(6) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 10(9)(a)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/10/9/a); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-56f4c20119cf628e33d225490dc8dd65]: Words in Sch. 21 para. 9(1) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 25(6)(a)(i)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/25/6/a/i) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-5719f4546efdf9f702b40b2a5e775b53]: [Sch. 15 para. 16](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/16) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-57812c32673391de107302cc043c6950]: [Sch. 7 para. 19](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/19) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
@@ -18206,6 +18402,8 @@
[^key-589147da4c3b8f7f70ca38a2aad7a017]: Words in s. 78(4) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 45(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/45/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-591ce9de9eda44e5f845b9c965e14c54]: S. 48(3)(d) omitted (5.9.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(5)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/5/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-5923789b39f2f85486d93c43d008a53e]: Sch. 1 para. 14 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-592385c2bfb47df43a31d621a3e907ca]: [Sch. 19 para. 253](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/253) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -18216,12 +18414,10 @@
[^key-59b565f9ed686b63dd17fb78a246be4b]: [S. 148](https://www.legislation.gov.uk/ukpga/2018/12/section/148) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-59c00d0f4b9012edb2a6a3564ca2644d]: [S. 9A and cross-heading](https://www.legislation.gov.uk/ukpga/2018/12/chapter/2/crossheading/relevant-international-law) inserted (19.6.2025 for specified purposes, 20.8.2025 for specified purposes) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 72(7)](https://www.legislation.gov.uk/ukpga/2025/18/section/72/7), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(b)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/b)
[^key-59c00d0f4b9012edb2a6a3564ca2644d]: [S. 9A and cross-heading](https://www.legislation.gov.uk/ukpga/2018/12/chapter/2/crossheading/relevant-international-law) inserted (19.6.2025 for specified purposes, 20.8.2025 for specified purposes, 5.2.2026 in so far as not already in force) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 72(7)](https://www.legislation.gov.uk/ukpga/2025/18/section/72/7), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(b)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/b); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(e)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/e)
[^key-59da614434458460aa757b305cd350e7]: Sch. 1 para. 30 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-5a1bc9d2d4360d96ed3a6474b2d979fe]: Words in s. 14(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 17(2)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/17/2/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-5a317a18af189f11ef752bf8e9909bfd]: Words in s. 115 heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 47(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/47/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-5a464370d8822b40169ec522a8d773a6]: Words in s. 13(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 16](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/16) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -18232,6 +18428,8 @@
[^key-5ae2292fa42aa74f4748479a28697330]: [Sch. 7 para. 40](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/40) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-5b0f52439fb91a2150369b4f1d490abd]: S. 77 heading substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 9(2)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/9/2); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-5b3acd4e0294355b8e9efe356efa7aa4]: [Sch. 19 para. 272](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/272) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5bc0406a73661aa1415e2904b278ad74]: Words in s. 10(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 13(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/13/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -18250,8 +18448,6 @@
[^key-5cca3ac8ac29e135e7479d669dca2466]: S. 21(5)(c) and word inserted (25.1.2023) by [Advanced Research and Invention Agency Act 2022 (c. 4)](https://www.legislation.gov.uk/ukpga/2022/4), [s. 13(1)](https://www.legislation.gov.uk/ukpga/2022/4/section/13/1), [Sch. 3 para. 15(2)(b)](https://www.legislation.gov.uk/ukpga/2022/4/schedule/3/paragraph/15/2/b); [S.I. 2023/58](https://www.legislation.gov.uk/uksi/2023/58), [reg. 2](https://www.legislation.gov.uk/uksi/2023/58/regulation/2)
[^key-5cf186d286be79919630c38ec0789919]: Words in Sch. 2 para. 28(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(24)(c)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/24/c) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-5d060454d3ffbec772dcf30d85306332]: [Sch. 19 para. 82](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/82) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5d2229549ab7a2313028e02954440336]: Sch. 20 para. 5 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -18260,10 +18456,14 @@
[^key-5e45ce56358543510889bcd1e8168c6a]: [Sch. 19 para. 67](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/67) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5ea99755306c1877268f3c7f8f0acae1]: S. 73(A1) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 3(2)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/3/2); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-5ebc40ae0ba03aa3d9abb7a5c47c27a0]: Words in Sch. 4 heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 94(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/94/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-5f09a0ec7fe4d04e41a74ebc4ea7a57a]: [Sch. 19 para. 288](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/288) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5f0fe9220d1a668dafa7cc7eeb298854]: Words in Sch. 1 para. 23(4) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 73](https://www.legislation.gov.uk/ukpga/2025/18/section/73), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(f)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/f)
[^key-5f188da75fed9d0a5af86af0820ced84]: Words in s. 168(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 69(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/69/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-5f231bc059b057c3be3a8b858c1237d0]: [Sch. 19 para. 293](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/293) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -18276,6 +18476,8 @@
[^key-5f76e0da6463fb498ac656ec87d1f1da]: S. 205(1A) substituted (31.12.2023 immediately before the end of 2023) by [The Data Protection (Fundamental Rights and Freedoms) (Amendment) Regulations 2023 (S.I. 2023/1417)](https://www.legislation.gov.uk/uksi/2023/1417), [regs. 1(2)](https://www.legislation.gov.uk/uksi/2023/1417/regulation/1/2), [3(3)](https://www.legislation.gov.uk/uksi/2023/1417/regulation/3/3)
[^key-5f94619ed391555b8bc542f944bc9f07]: S. 78A(2)(e)(ia) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 19](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/19) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-5fa4e1b4e3138284c1e0c09af0505f2a]: Words in s. 8 substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 11](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/11) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-5fb747b583c0fc376438a9ab6fbe24d2]: Sch. 21 inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 102](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/102) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5), [Sch. 3 para. 111(6)](https://www.legislation.gov.uk/uksi/2019/419/schedule/3/paragraph/111/6)) (as amended by [S.I. 2020/1586](https://www.legislation.gov.uk/uksi/2020/1586), [regs. 1(2)](https://www.legislation.gov.uk/uksi/2020/1586/regulation/1/2), [5(4)](https://www.legislation.gov.uk/uksi/2020/1586/regulation/5/4)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -18292,6 +18494,8 @@
[^key-60c010d25f11f1914bccbc6d06e219b9]: [Sch. 19 para. 359](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/359) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-60de89cf3b214460c2075bf102f6e8d5]: Words in s. 74B(3) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 5(4)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/5/4); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-60e4a152cf94a583f140fc84ff119a86]: [Sch. 7 para. 12](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/12) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-61187dd7a3e1c1e7fb0580816d8b4c9d]: Sch. 5 para. 5 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
@@ -18308,12 +18512,18 @@
[^key-624e37c2f534f473861144715410cd20]: Words in s. 33(7) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 37](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/37) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-6251dd26de77a38b94d1a0a4ca997116]: S. 75(1) omitted (5.2.2026) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 6(3)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/6/3); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-6251e3f8b043005c1b3af9c93785fec4]: [S. 144](https://www.legislation.gov.uk/ukpga/2018/12/section/144) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-6262e574d77f3ed97e165e248a2abadd]: Words in s. 125(1) substituted (19.6.2025 for specified purposes, 20.8.2025 in so far as not already in force) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 92(3)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/92/3/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(f)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/f)
[^key-6269a01b7e8cea25418c69a3a415f3c2]: Words in Sch. 2 para. 3(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(7)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/7/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-62783f17b8f2a7022ee1d43b4a98678e]: Words in s. 53(3) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 6 para. 14(3)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/6/paragraph/14/3); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z8)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z8) (with [reg. 5](https://www.legislation.gov.uk/uksi/2026/82/regulation/5))
[^key-62971ebca8ba67472f601cf6c756ddc0]: Words in Sch. 1 para. 24(1)(a) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 28(6)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/28/6); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z12)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z12)
[^key-62bbcd16a8bad5ae9f248e8cf72a3217]: Words in [s. 115(8)(b)](https://www.legislation.gov.uk/ukpga/2018/12/section/115/8/b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 47(9)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/47/9) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-63001065089a95390c38d674f45299f3]: S. 22 and cross-heading omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 30](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/30) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -18322,6 +18532,8 @@
[^key-63210b57744fbf08d2edb285a0cd5902]: [Sch. 19 para. 415](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/415) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-63330d56a2e81707f9cd5b177a000af0]: Words in [s. 183A(4)](https://www.legislation.gov.uk/ukpga/2018/12/section/183A/4) substituted (29.1.2026) by [The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (S.I. 2026/82)](https://www.legislation.gov.uk/uksi/2026/82), [reg. 12(2)](https://www.legislation.gov.uk/uksi/2026/82/regulation/12/2)
[^key-63477ad6b0f04b0dec5c0e7403800ffa]: [Sch. 19 para. 108](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/108) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-634f3407a04ae2b50df4bc577770f7b4]: S. 205: power to amend conferred (19.6.2025 for specified purposes, 20.8.2025 in so far as not already in force) by Regulation (EU) 679/2016, Art. 11A(3) (as inserted by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 74(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/74/1), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(c)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/c))
@@ -18342,6 +18554,8 @@
[^key-652e061bb56fb9b4f220ffae3d0a3b7c]: [Sch. 19 para. 259](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/259) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-65343b18ed649b3b52f5b6a00da1caaa]: Words in Sch. 17 para. 4 substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 100(12)(b)(iii)](https://www.legislation.gov.uk/ukpga/2025/18/section/100/12/b/iii), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(s)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/s)
[^key-6545233b44f61feb3cdd2c63700b450b]: [Sch. 19 para. 388](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/388) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-654ef76458b17b962e7470b23278c518]: Words in s. 24(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 32(4)(c)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/32/4/c) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -18380,18 +18594,20 @@
[^key-678a3382174b5eef118f049a8e0135a3]: [Sch. 19 para. 154](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/154) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-67aec105c02309b3dcc27b6e0cf1c250]: Words in s. 74B(6)(a) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 5(7)(c)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/5/7/c); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-67c2d07c6b756193ae777321980fbada]: Sch. 5 para. 3 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-67f8177fb9af4ad26bb4c77960155a96]: Sch. 2 para. 21 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-68225e3df25a9f0f2570cf0783246f60]: Words in s. 79(11) substituted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(8)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/8/h), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-68468e63dc949bef1473171d5c80732e]: [Sch. 15 para. 14](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/14) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-6888ac65f30f092ac6490e4894483c5f]: [Sch. 11 para. 6](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/6) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-68c26f2b2ec74cc15e867e9b451f50ae]: Words in s. 25(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 33(2)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/33/2/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-68ecc63089a9afe9300dcfcff0d33f46]: Words in s. 14(3)(c) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 17(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/17/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-68f53a767f04f663ce23ebba7b9a8622]: Words in s. 73(1)(b) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 40(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/40/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-690c58c64b417a3b6f1d897287ce2cc0]: Word in s. 157(2)(a) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 64(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/64/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -18402,6 +18618,8 @@
[^key-69b650c8b8cd0a9f9c00303439bac5ac]: [Sch. 19 para. 377](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/377) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-69e18d9dd8b0baf912598da89854fe38]: Words in s. 97(4)(b) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 80(5)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/80/5/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(j)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/j) (with [reg. 5](https://www.legislation.gov.uk/uksi/2026/82/regulation/5))
[^key-69f1f4e3df8cba86080a11e581cacbc7]: Sch. 1 para. 32 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-69f9a7a9d26266ca1b42b20f77139add]: [Sch. 7 para. 36](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/36) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
@@ -18428,6 +18646,8 @@
[^key-6c12a28a9f47155604b92c5ded987ee4]: Sch. 2 para. 26(9)(e) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(21)(c)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/21/c) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-6c1f6bae1d802c23f773298531014961]: S. 17B omitted (5.2.2026) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 13](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/13) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-6c3e1b90198089fd750919397b5d5f31]: Words in Sch. 2 para. 25(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(19)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/19/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-6c97145e9bea286f39b3cebee1e809b4]: [Sch. 19 para. 138](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/138) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -18442,6 +18662,8 @@
[^key-6db365e85b52911a728021f65ea4c98a]: [Sch. 11 para. 1](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/1) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-6dde167af2d730a8ec63a8abbf4d8720]: Word in s. 78(1) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 10(3)(b)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/10/3/b); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-6e07ab4cb80ed81cfca1cbdc5f2f54bb]: Ss. 164A, 164B inserted (19.6.2025 for specified purposes) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 103(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/103/2), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h)
[^key-6e7cb2f6dc84974e7ac6a5e8816900a0]: Words in s. 167(4) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 68](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/68) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -18482,8 +18704,12 @@
[^key-71dea759dbffeefab580aeb644dc5c34]: Words in s. 187(1)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 81(3)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/81/3/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-71f3222fd4b877a586e08d163019b411]: Words in s. 79(4) substituted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(8)(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/8/c), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-7285958890d3383878df626a9c90418f]: [Sch. 19 para. 291](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/291) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-729c091eec1d54911a073b69bce236e3]: Word in s. 170(2)(a) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 22](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/22); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z12)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z12)
[^key-72ba0767b30e3e4aaa628d751ad94496]: [S. 114A](https://www.legislation.gov.uk/ukpga/2018/12/section/114A) and cross-heading inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 117(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/117/2), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(r)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/r)
[^key-72cb372c18446331d54d7581b2844122]: [Sch. 19 para. 283](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/283) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -18492,24 +18718,32 @@
[^key-72fc14e4074bc221cce83073cc6b4954]: Words in Sch. 2 para. 10(2)(c)(iv) inserted (E.W.) (23.7.2019) by [Public Services Ombudsman (Wales) Act 2019 (anaw 3)](https://www.legislation.gov.uk/anaw/2019/3), [s. 77(1)](https://www.legislation.gov.uk/anaw/2019/3/section/77/1), [Sch. 5 para. 28](https://www.legislation.gov.uk/anaw/2019/3/schedule/5/paragraph/28); [S.I. 2019/1096](https://www.legislation.gov.uk/wsi/2019/1096), [reg. 2](https://www.legislation.gov.uk/wsi/2019/1096/regulation/2)
[^key-72fef9ced678f05f26d9e69c3ad91d32]: Words in s. 14(6) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 17(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/17/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-730bc1c474fbdbd93f519027acff36fe]: [S. 146](https://www.legislation.gov.uk/ukpga/2018/12/section/146) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-72fccd4d6ebac9d3e017e3797b580ef5]: [S. 14](https://www.legislation.gov.uk/ukpga/2018/12/section/14) omitted (5.2.2026) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 6 para. 11](https://www.legislation.gov.uk/ukpga/2025/18/schedule/6/paragraph/11); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z8)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z8) (with [reg. 5](https://www.legislation.gov.uk/uksi/2026/82/regulation/5))
[^key-730bc1c474fbdbd93f519027acff36fe]: S. 146 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-737325028727ba2041f2f0de7660090b]: S. 205(2)(la) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 117(4)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/117/4/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(r)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/r)
[^key-73798ad4ecbb7ae34845e132f9a11398]: Words in s. 52(6) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 6 para. 13(6)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/6/paragraph/13/6); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z8)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z8) (with [reg. 5](https://www.legislation.gov.uk/uksi/2026/82/regulation/5))
[^key-73831303993667d8f859b9488103ac73]: Words in s. 151(8)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 62](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/62) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-7391cf8e2ee42e601b02ca8e23000688]: Words in s. 168 heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 69(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/69/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-739c1f855803d04d32431eb1509216b9]: Words in s. 76(1)(d) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 7(4)(c)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/7/4/c); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-73a5bdb2a7cc14d028614db4749623ee]: Words in s. 204(1)(g) omitted (2.12.2019 at 00:01) by virtue of [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 227(2)(b)](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/227/2/b) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2019/1434](https://www.legislation.gov.uk/uksi/2019/1434), [reg. 2(b)](https://www.legislation.gov.uk/uksi/2019/1434/regulation/2/b)
[^key-73e6fdaac8c2a2ceb6b3e1ac469fcfb7]: [Sch. 19 para. 245](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/245) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-73f61be4aeced86ac6a16de662af58f7]: Words in Sch. 21 para. 4(1) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 25(3)(a)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/25/3/a) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-742f3892a7615fbe038b411efd2afeab]: [Sch. 10 para. 2](https://www.legislation.gov.uk/ukpga/2018/12/schedule/10/paragraph/2) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-7439244a501d4ccda7b7ab1b68d56133]: Words in s. 143(9) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 60](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/60) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-74428c9d29b310b26608d6b4d093fa12]: S. 160(5A) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 100(6)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/100/6/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(s)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/s)
[^key-7477a257b589b1a659d9da8bb1f814ee]: [Sch. 19 para. 260](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/260) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-748f9db9dd425e0dbebe2451c4618aa0]: Words in s. 189(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 83(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/83/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -18528,12 +18762,18 @@
[^key-75e47e526bd371fad97da14f5ce0b720]: [Sch. 19 para. 426](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/426) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-75e7207d12d4887e8870cd0d8b680f5b]: S. 17C omitted (5.2.2026) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 14](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/14) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-75fa556cead4d7860cebbae93d9ce5ea]: [Sch. 20 para. 43](https://www.legislation.gov.uk/ukpga/2018/12/schedule/20/paragraph/43) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-764b5a189b5ddc8f21ff15d3aadd46f8]: Words in s. 7(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 10(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/10/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-76c627fd558f2827e55ea322c5601a0c]: Words in Sch. 17 para. 4 substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 100(12)(b)(ii)](https://www.legislation.gov.uk/ukpga/2025/18/section/100/12/b/ii), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(s)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/s)
[^key-76d8987f83cd23085268f88605eab012]: Sch. 2 para. 8 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-770e5734455a727a1728da1020faca17]: Words in s. 76(2) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 7(5)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/7/5); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-7716f17e15cfe1f6e1c380c980402f84]: Words in s. 16(1)(c) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 20(2)(d)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/20/2/d) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-774f89899f61e3fd5faa9f3af3ea0924]: Words in Sch. 3 para. 1 substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(4)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/4) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -18548,10 +18788,16 @@
[^key-78821949ef2cd79dbfb3b1bc8aedb9e2]: [Sch. 19 para. 17](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/17) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-789b1fb0bff945a128559c3def13e851]: Words in [s. 186A(5)](https://www.legislation.gov.uk/ukpga/2018/12/section/186A/5) substituted (29.1.2026) by [The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (S.I. 2026/82)](https://www.legislation.gov.uk/uksi/2026/82), [reg. 12(4)](https://www.legislation.gov.uk/uksi/2026/82/regulation/12/4)
[^key-78db76102146a4973fbe100f48e3ab2d]: [Sch. 19 para. 422](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/422) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-79af9794db26153d08755ea59021b7f1]: Words in [s. 183B(5)(b)](https://www.legislation.gov.uk/ukpga/2018/12/section/183B/5/b) substituted (29.1.2026) by [The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (S.I. 2026/82)](https://www.legislation.gov.uk/uksi/2026/82), [reg. 12(3)](https://www.legislation.gov.uk/uksi/2026/82/regulation/12/3)
[^key-79e7068c8e4cd6fd22e23d24f813e766]: Words in [s. 6(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/6/1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 9](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/9) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-79ecfa480be800660f1c1ae8309a399e]: Words in s. 43(1)(a) substituted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 79(2)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/79/2/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/a) (with [reg. 3](https://www.legislation.gov.uk/uksi/2025/996/regulation/3))
[^key-7a5a1fef2d738d7c657db0fb599f1871]: [Sch. 10 para. 1](https://www.legislation.gov.uk/ukpga/2018/12/schedule/10/paragraph/1) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-7a8fc913f5df2ae9c65b684b305d36db]: Sch. 2 para. 22 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
@@ -18560,8 +18806,12 @@
[^key-7acebc72466e110599be1c7c05f2d8a7]: Words in s. 5(7) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 6(6)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/6/6/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-7b08ad8bb36134d0d4900f86e600578c]: Sch. 21 para. 4(6) omitted (5.2.2026) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 25(3)(c)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/25/3/c) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-7b259fddaf883dcc4820053ea22fcd9b]: Word in [s. 3(9)(c)](https://www.legislation.gov.uk/ukpga/2018/12/section/3/9/c) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 14(a)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/14/a); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(y)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/y)
[^key-7b42535826b9e64165b9e42d1465e55e]: Words in s. 149(9)(b) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 100(3)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/100/3/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(s)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/s)
[^key-7b7a7abcbe377f85ee79df3619288d0c]: [Sch. 12 para. 3](https://www.legislation.gov.uk/ukpga/2018/12/schedule/12/paragraph/3) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-7bccbbbdba88ddb2e2eba7451840f2a4]: [Sch. 19 para. 386](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/386) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -18610,6 +18860,10 @@
[^key-7f00e74cd3a9eb7a899739fc11c8d773]: Words in Sch. 20 para. 50 substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 101(5)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/101/5) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-7f0faad6aea3cdd25a004443eaac8e79]: S. 54(4)-(6) omitted (5.2.2026) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 76(6)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/76/6/d), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(h)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/h) (with [reg. 4](https://www.legislation.gov.uk/uksi/2026/82/regulation/4))
[^key-7f421b709d4b29a3c22625c805399f04]: Words in s. 79(12) substituted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(8)(i)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/8/i), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-7f611cef7c9785e78160c449fcd3cf59]: [Sch. 19 para. 166](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/166) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-7fb49ddb4c78e0617a283d46b8fd297a]: [Sch. 19 para. 360](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/360) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -18624,6 +18878,8 @@
[^key-80aece53fcb0b6da0c128b207cec4326]: [Sch. 19 para. 51](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/51) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-811106a76f9598073e3be0f7aee49e14]: Sch. 17 para. 3A and cross-heading inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 100(12)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/100/12/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(s)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/s)
[^key-81281ac0c84a46bf1301b64aa0388e21]: [S. 9](https://www.legislation.gov.uk/ukpga/2018/12/section/9) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 12](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/12) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-812f736d922e3056b472b473c1393f22]: Sch. 3 para. 16 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
@@ -18640,34 +18896,52 @@
[^key-81deaf853b1516dd630825a728ac8038]: Sch. 1 para. 25 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-81f2c5858b72110814b0b26f826ff5fe]: Word in Sch. 1 para. 10 heading substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 28(2)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/28/2); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z12)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z12)
[^key-820044391a685be40d41c5c8cf8e22e4]: Ss. 148A-148C and cross-heading inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 100(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/100/2), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(s)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/s)
[^key-822383846c852126639e302c4f8d3d5e]: Words in s. 3(10) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 4(4)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/4/4/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-82414ea480fe391b01b01fb4e26587de]: S. 79(13) omitted (5.9.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(8)(j)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/8/j), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-8293f14cb956099346b10c81f37389f6]: [Sch. 19 para. 206](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/206) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-82b2319cae98bf9d18d415b5900b1b8d]: [Sch. 19 para. 83](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/83) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-82e6d6ee170d0749ef39b3a4e333d6d6]: [Sch. 19 para. 235](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/235) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-83076b9bd062b17b55b3f3900b7b16ca]: Words in Sch. 16 para. 4(2) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 101(3)(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/101/3/c), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(t)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/t) (with [reg. 6](https://www.legislation.gov.uk/uksi/2026/82/regulation/6))
[^key-83378423b48f16d54ba90d2ae9044d24]: [Sch. 19 para. 129](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/129) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-835ab8f4363d0fb83f0c4cf209c3a562]: Words in s. 17(7) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 22(5)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/22/5/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-8378189986c623d4592091758ed051d5]: [Sch. 19 para. 362](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/362) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-837eca93d325a90e6a14ec91f892ebda]: Sch. 8 para. 8(1)(b)(iia) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 30](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/30); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z12)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z12)
[^key-83a763dd81dbb8571ef5ab019fcdb125]: [Sch. 10 para. 3](https://www.legislation.gov.uk/ukpga/2018/12/schedule/10/paragraph/3) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-83b36e0f8528921cbbf895c351bf7713]: [S. 115(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/115/1) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 47(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/47/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-83b4b960f436c0a11f244dc3d71d2274]: Sch. 20 para. 60 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-83cd0e4be4bc9319fbb76e9a6ba71e9c]: S. 51(4)(aa) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 79(7)(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/79/7/c), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/a) (with [reg. 3](https://www.legislation.gov.uk/uksi/2025/996/regulation/3))
[^key-83da7441fd879e24ad1e9bf9355724bc]: [Sch. 19 para. 189](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/189) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-83e672a87c0d79e60c67f56b75e7939b]: Words in s. 43(1)(d) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 6 para. 12](https://www.legislation.gov.uk/ukpga/2025/18/schedule/6/paragraph/12); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z8)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z8) (with [reg. 5](https://www.legislation.gov.uk/uksi/2026/82/regulation/5))
[^key-83e7b4be5485db05a2217193e409052e]: Words in s. 15(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 19(9)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/19/9/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-847feaddc6148bc37c46c1a3e5b8905c]: Words in s. 17(1)(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 22(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/22/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-8497f1214ba7ccd2b9dc5d3d6fe6bba4]: Word in s. 51(6) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 79(7)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/79/7/d), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/a) (with [reg. 3](https://www.legislation.gov.uk/uksi/2025/996/regulation/3))
[^key-84eda6b71dbe3fa5e5686e74405328d3]: Words in [s. 129(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/129/1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 54](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/54) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-85309b04599203eba01a0b910cc8317f]: Words in s. 182(7) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 22(4)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/22/4) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-853556fb17545841a06d58d5f0af9994]: [S. 139(1A)](https://www.legislation.gov.uk/ukpga/2018/12/section/139/1A)[(1B)](https://www.legislation.gov.uk/ukpga/2018/12/section/139/1B) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 91(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/91/4), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1) (with [s. 91(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/91/5)); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(e)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/e)
[^key-8536ab473caeb847327e2f5e6d40132d]: Sch. 20 para. 49 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -18690,12 +18964,20 @@
[^key-86c0f2e4ef516da39d4241866b656e32]: [Sch. 19 para. 65](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/65) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-86ea667053fa639fd3f9de2728af1019]: Words in Sch. 17 para. 4 substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 100(12)(b)(i)](https://www.legislation.gov.uk/ukpga/2025/18/section/100/12/b/i), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(s)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/s)
[^key-8737925ef099c354b79a2dee4ef45379]: [Sch. 19 para. 144](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/144) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-873a9a81f73c6a07542ec3514b86b3e0]: Words in s. 43(1)(b) substituted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 79(2)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/79/2/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/a) (with [reg. 3](https://www.legislation.gov.uk/uksi/2025/996/regulation/3))
[^key-87644839deaefcefaa5289d143de43b3]: Words in Sch. 3 substituted (1.7.2022) by [Health and Care Act 2022 (c. 31)](https://www.legislation.gov.uk/ukpga/2022/31), [s. 186(6)](https://www.legislation.gov.uk/ukpga/2022/31/section/186/6), [Sch. 1 para. 1(1)](https://www.legislation.gov.uk/ukpga/2022/31/schedule/1/paragraph/1/1)[(2)](https://www.legislation.gov.uk/ukpga/2022/31/schedule/1/paragraph/1/2); [S.I. 2022/734](https://www.legislation.gov.uk/uksi/2022/734), [reg. 2(a)](https://www.legislation.gov.uk/uksi/2022/734/regulation/2/a), [Sch.](https://www.legislation.gov.uk/uksi/2022/734/schedule) (with [regs. 13](https://www.legislation.gov.uk/uksi/2022/734/regulation/13), [29](https://www.legislation.gov.uk/uksi/2022/734/regulation/29), [30](https://www.legislation.gov.uk/uksi/2022/734/regulation/30))
[^key-88136afa0ef1df300a43059fe5b24e85]: [Sch. 14 para. 6](https://www.legislation.gov.uk/ukpga/2018/12/schedule/14/paragraph/6) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-882fa25ed9d1559430a3c58aa7cf5fb7]: Words in s. 96(1) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 80(4)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/80/4/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(j)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/j) (with [reg. 5](https://www.legislation.gov.uk/uksi/2026/82/regulation/5))
[^key-88604e36ed44217ed8948f4855ef1e2a]: Words in Sch. 1 para. 4(b) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 87(2)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/87/2/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(o)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/o)
[^key-888b5b35cd29f20bcaae1dbca8f16d61]: Words in s. 28 heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 36(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/36/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-88a3135321752bf6d4a55db7f2e0cf2f]: [Sch. 19 para. 352](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/352) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -18726,7 +19008,7 @@
[^key-8be42a9b4ca72b465ef3e53b07fce39f]: [Sch. 19 para. 343](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/343) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-8c1041f35a0b088d2c6574d402bd386c]: [Ss. 50A-50D](https://www.legislation.gov.uk/ukpga/2018/12/section/50A) substituted for ss. 49, 50 (19.6.2025 for specified purposes, 5.2.2026 in so far as not already in force) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 80(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/80/3), [142(1)(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1/2/h); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(j)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/j) (with [reg. 5](https://www.legislation.gov.uk/uksi/2026/82/regulation/5))
[^key-8c1041f35a0b088d2c6574d402bd386c]: Ss. 50A-50D substituted for ss. 49, 50 (19.6.2025 for specified purposes, 5.2.2026 in so far as not already in force) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 80(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/80/3), [142(1)(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1/2/h); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(j)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/j) (with [reg. 5](https://www.legislation.gov.uk/uksi/2026/82/regulation/5))
[^key-8c2497c1133310d316d82accef38e97a]: Words in s. 3(14)(d) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 4(7)(c)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/4/7/c) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -18740,10 +19022,16 @@
[^key-8d0a6b8a209b4ce122af409aeeba27bd]: S. 15 cross-heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 18](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/18) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-8d58a5c874287d0bdc585648c49f5321]: S. 51(2)(aa) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 79(7)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/79/7/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/a) (with [reg. 3](https://www.legislation.gov.uk/uksi/2025/996/regulation/3))
[^key-8d7025c26d4306ebf37846aafc6ac184]: Words in s. 76(1)(c) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 7(4)(b)(ii)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/7/4/b/ii); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-8d9d7cdf97e575d2a5c03f8e3c76a63d]: [Sch. 15 para. 10](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/10) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-8ddd7db9cbd1f85a5d9da877704c4c39]: Words in s. 168(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 69(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/69/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-8dedc7ecc2ab08385cf725c2325091ce]: Word in Sch. 2 para. 2(1)(a) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 29(2)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/29/2); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z12)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z12)
[^key-8deea6ad2e1ca2aa03a2df3af2489d28]: Sch. 20 para. 6 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-8e33d9698917e5f35b620ce7b474ccc1]: Words in s. 149(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 61](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/61) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -18754,16 +19042,22 @@
[^key-8eea3e6bdf7c7820f434b8c876de250f]: Words in s. 80(2) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 46(3)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/46/3/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-8efaf1436cbf85d5d8e08d9cba2a529d]: Word in s. 184(4) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 25](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/25); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z12)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z12)
[^key-8f06068680301e2c3ed98acf8976fc95]: [Sch. 19 para. 167](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/167) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-8f1f87eac9c9e51e89136342ce6694ad]: [Sch. 19 para. 94](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/94) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-8f48b1c7ac191d68b6f2c80fbc631de8]: S. 160(7)(e) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 101(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/101/4), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(t)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/t) (with [reg. 6](https://www.legislation.gov.uk/uksi/2026/82/regulation/6))
[^key-8f7fd51f2b17bc66f5766dfce21ff80d]: Words in s. 76(1)(c) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 43](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/43) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-8fbe292ba1de6fbf2a9d7d97a4bad919]: [Sch. 7 para. 29](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/29) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-8fee20a32a0c94dd1be0c59c92f7d22d]: [Sch. 19 para. 28](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/28) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9006f6f60d2f3cd5a380a45e92c3daf0]: Words in s. 77(7)(a) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 9(4)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/9/4); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-905f3924a8759d0b5e86546e2ec79c8f]: Words in Sch. 18 para. 5(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 99(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/99/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-908fd5d459d7a579cab7061f3e5f0f93]: S. 5(4)(5)(6) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 6(5)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/6/5) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -18784,6 +19078,8 @@
[^key-91f7b5de6c9148c918065d61457bce4a]: [Sch. 19 para. 418](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/418) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-920dd296746894521060038ea62d1636]: S. 73(4)(aa) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 3(5)(a)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/3/5/a); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-92602c48b03bd64557bffe924a7a3393]: [Sch. 7 para. 39](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/39) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-926294555a21e585ef6c49d64cb54163]: Words in s. 24(5) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 32(5)(c)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/32/5/c) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -18792,8 +19088,12 @@
[^key-92a2fbba444a2180ed2d6977278c2304]: Sch. 20 para. 12 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-92a89703ae0bccb19e3aa6357a2199fe]: Words in s. 52(1) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 6 para. 13(2)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/6/paragraph/13/2); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z8)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z8) (with [reg. 5](https://www.legislation.gov.uk/uksi/2026/82/regulation/5))
[^key-92d6e74f37be3e97e68bdee8fdc6cda3]: [Sch. 19 para. 319](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/319) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-92e4fbc7da5832de351cee8561572d00]: S. 160(4)(aa)(ab) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 98(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/98/5), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(q)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/q)
[^key-9327a9e51950d697f6ab1419608e7b34]: [Sch. 19 para. 351](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/351) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-932fb2eb6cef1d6174f128001bbe0202]: [S. 140 cross-heading](https://www.legislation.gov.uk/ukpga/2018/12/part/5/crossheading/reports-etc) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 95](https://www.legislation.gov.uk/ukpga/2025/18/section/95), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(h)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/h)
@@ -18806,13 +19106,17 @@
[^key-9494a2ed2dae96290f9c0461356a1bd3]: Words in s. 149(2)(c) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 61](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/61) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-94d96ee0fcb3bd0d69d2d1921830ed5c]: Words in s. 110(2)(c) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(9)(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/9/c), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-94dd0e117ae91630c416e9e8439ee602]: Words in Sch. 1 para. 1(3) substituted (15.12.2021) by [The UK Statistics (Amendment etc.) (EU Exit) Regulations 2021 (S.I. 2021/1300)](https://www.legislation.gov.uk/uksi/2021/1300), [regs. 1](https://www.legislation.gov.uk/uksi/2021/1300/regulation/1), [2](https://www.legislation.gov.uk/uksi/2021/1300/regulation/2)
[^key-9511ece09469c0730d75ca0d615a38e3]: S. 78(A1) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 10(2)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/10/2); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-953b9df49e10ea57d7c67ec16df9d1c0]: Act excluded (30.9.2020) by [The Channel Tunnel (Arrangements with the Kingdom of the Netherlands) Order 2020 (S.I. 2020/916)](https://www.legislation.gov.uk/uksi/2020/916), [arts. 1(2)(b)](https://www.legislation.gov.uk/uksi/2020/916/article/1/2/b)[4(4)](https://www.legislation.gov.uk/uksi/2020/916/article/4/4)
[^key-9554afd386ff1a76b263966b60fc1907]: [Sch. 19 para. 132](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/132) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-956ddefbb071412616ffde4240a5ba73]: [S. 119A](https://www.legislation.gov.uk/ukpga/2018/12/section/119A) inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 51](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/51) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-956ddefbb071412616ffde4240a5ba73]: S. 119A inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 51](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/51) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-95787e0b7f0ab5b7c704ec6bec9bc401]: Words in s. 149(4)(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 61](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/61) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -18822,8 +19126,6 @@
[^key-969f5ea1c155862f9d516708188b069a]: Words in Sch. 3 para. 21 cross-heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(20)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/20) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-96ae04ac2f2af44f8b1423f15c733f45]: S. 26(2)(fa) inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 34(3)(d)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/34/3/d) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-9702e78daee1441e8db8fb0bd641a1d1]: [S. 145](https://www.legislation.gov.uk/ukpga/2018/12/section/145) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-973b20ca86f76226ec3ba9a60c4213af]: S. 193 in force at 23.7.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 3(j)](https://www.legislation.gov.uk/uksi/2018/625/regulation/3/j)
@@ -18850,6 +19152,12 @@
[^key-98fa005db175e358483a9c7e427babf0]: [Sch. 19 para. 29](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/29) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-99764e13e67fc0e364b2a29b26e35863]: S. 18 omitted (5.2.2026) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 15](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/15) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-99e7d7d61a4298a0bc3dcc630b5b9294]: Words in s. 77(6) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 9(3)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/9/3); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-99eac3f5edb1f7ed59bf7b3f0c18b9cb]: Words in Sch. 21 para. 10 heading substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 25(7)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/25/7) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-9a01dffe8e031e6fd2dba2087a13223d]: Words in Sch. 18 para. 5(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 99(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/99/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-9a443c5bd0f1d495d7eb959fe3c7dfdd]: Sch. 1 para. 38 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
@@ -18884,10 +19192,12 @@
[^key-9b9087b9158da4ffd811465a30b1f973]: [Sch. 19 para. 146](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/146) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9ba92cb088fb455028dbeb88fcb5edb6]: Words in [s. 119A(11)](https://www.legislation.gov.uk/ukpga/2018/12/section/119A/11) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 17](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/17); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(y)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/y)
[^key-9ba92cb088fb455028dbeb88fcb5edb6]: Words in s. 119A(11) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 17](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/17); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(y)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/y)
[^key-9bc333ae2f3f8bcbd3a38bc3a810fb5a]: [Sch. 15 para. 3](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/3) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-9bc5785e330c32abd43dccc500d5dda8]: Sch. 21 para. 7 omitted (5.2.2026) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 25(5)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/25/5) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-9c101e97812e71a335520eb1c47a6ec6]: Sch. 2 para. 23 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-9cb040d62e9f275b1ff61ca32bcd6148]: [Sch. 12A](https://www.legislation.gov.uk/ukpga/2018/12/schedule/12A) inserted (19.6.2025 for specified purposes, 20.8.2025 in so far as not already in force) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h), [Sch. 14 para. 1](https://www.legislation.gov.uk/ukpga/2025/18/schedule/14/paragraph/1) (with [Sch. 14 paras. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/14/paragraph/2), [3](https://www.legislation.gov.uk/ukpga/2025/18/schedule/14/paragraph/3)); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(z)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/z) (with [reg. 1(3)](https://www.legislation.gov.uk/uksi/2025/904/regulation/1/3))
@@ -18896,23 +19206,33 @@
[^key-9ce1c997de01c079f4e45fdcfb0339c3]: Words in s. 151(1)(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 62](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/62) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-9ce829069ec9d3018f75efc1d11eddd0]: Words in [s. 135(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/135/1) omitted (5.2.2026) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 94(2)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/94/2/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(p)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/p)
[^key-9d710e651e6d63fff04c93e4807f2c24]: [Sch. 19 para. 100](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/100) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9dc954c44dc2f1d5fb977d7d90900abc]: Word in s. 44 heading omitted (5.9.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 79(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/79/4), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/a) (with [reg. 3](https://www.legislation.gov.uk/uksi/2025/996/regulation/3))
[^key-9dd7994c42a80efb90cbfa1a45252e1d]: [Sch. 12 para. 2](https://www.legislation.gov.uk/ukpga/2018/12/schedule/12/paragraph/2) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-9def3b7505a61a658140ff7ee34bf178]: [Sch. 19 para. 49](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/49) omitted (21.7.2019) by virtue of [The Financial Services and Markets Act 2000 (Prospectus) Regulations 2019 (S.I. 2019/1043)](https://www.legislation.gov.uk/uksi/2019/1043), [regs. 1(1)](https://www.legislation.gov.uk/uksi/2019/1043/regulation/1/1), [37](https://www.legislation.gov.uk/uksi/2019/1043/regulation/37)
[^key-9e04e254fa3d9a8eae87beaaec26dd03]: Words in s. 149(9)(b) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 100(3)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/100/3/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(s)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/s)
[^key-9e24f8af50209b0af1b4ff26a0525e0e]: [Sch. 19 para. 279](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/279) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9e3449692e9eee7e556134a9272ef4ee]: S. 146(2)(j)(k) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 98(2)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/98/2/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(q)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/q)
[^key-9e7a5f58b13f91f6d28b4ab819f33a54]: Sch. 2 para. 4(3) omitted (31.1.2022) by virtue of [The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2022 (S.I. 2022/76)](https://www.legislation.gov.uk/uksi/2022/76), [regs. 1(2)](https://www.legislation.gov.uk/uksi/2022/76/regulation/1/2), [2(2)(d)](https://www.legislation.gov.uk/uksi/2022/76/regulation/2/2/d)
[^key-9e9abcbf54f86bbf9b0784d06d72490e]: Word in Sch. 2 para. 26(9)(d) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 24](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/24) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-9ea61d1ece95e50cb79bdb1b64be7a03]: S. 17 cross-heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 21](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/21) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-9ef9aecb69c6cba490e1936f1f0fb107]: Words in s. 157(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 64(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/64/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-9f5c56edc1342d98195ad1b32fab06cb]: [Sch. 19 para. 8](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/8) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9f5da3b688523031c188cc42ef688048]: Words in s. 73(3)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 40(3)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/40/3/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-9f72e36003430e39c3757295200a60d4]: Words in s. 182(8)(b) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 22(5)(d)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/22/5/d) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-9f924437bee18db808d47091eedf71e4]: [Sch. 19 para. 213](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/213) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -18924,6 +19244,8 @@
[^key-a0127af1ada079caf6957dccac2808db]: S. 3(10A) inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 4(5)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/4/5) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-a049100b2a7f7e52c5da14c539d6046a]: S. 96(4) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 80(4)(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/80/4/c), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(j)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/j) (with [reg. 5](https://www.legislation.gov.uk/uksi/2026/82/regulation/5))
[^key-a0b98661e146b804075a34298587c3ff]: [Sch. 19 para. 174](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/174) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a108ccc8090ee178d30cecfaf943e5e8]: [Sch. 19 para. 20](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/20) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -18932,8 +19254,16 @@
[^key-a1273524e053f511fd09ea5026a748c7]: Words in Sch. 3 para. 2(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(5)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/5) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-a1284e67c0464faf7b552d309af526ee]: Words in Sch. 21 para. 4 heading substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 25(2)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/25/2) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-a168ba5289668a8cd5edfcb49d96d728]: Words in s. 79(10) substituted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(8)(g)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/8/g), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-a16e898716b82093a021e0d331d6725e]: [Sch. 7 para. 18A](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/18A) inserted (1.11.2022 for specified purposes) by [Armed Forces Act 2021 (c. 35)](https://www.legislation.gov.uk/ukpga/2021/35), [s. 24(1)](https://www.legislation.gov.uk/ukpga/2021/35/section/24/1), [Sch. 4 para. 9](https://www.legislation.gov.uk/ukpga/2021/35/schedule/4/paragraph/9); [S.I. 2022/1095](https://www.legislation.gov.uk/uksi/2022/1095), [reg. 3](https://www.legislation.gov.uk/uksi/2022/1095/regulation/3)
[^key-a182758c8bbfb23b0f4de56a33affea8]: Words in s. 206 Table substituted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 90(9)(a)(ii)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/9/a/ii), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/b)
[^key-a1ace6c1cc4bec0d69aec49f273df997]: Words in s. 75 heading substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 6(2)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/6/2); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-a1c35c4d9fb9c6b8432b9c99b83faa06]: S. 104 in force at 16.9.2019 by [S.I. 2019/1188](https://www.legislation.gov.uk/uksi/2019/1188), [reg. 2(d)](https://www.legislation.gov.uk/uksi/2019/1188/regulation/2/d)
[^key-a2536056f71e77d12ec0552af9cdb0ae]: [Sch. 19 para. 14](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/14) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -18942,8 +19272,16 @@
[^key-a2dc7867f7754a11a35a6a348b1c9035]: Sch. 7 para. 56 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-a31bbbaf0702a16d218d015081e896e0]: S. 45A inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 79(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/79/6), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/a) (with [reg. 3](https://www.legislation.gov.uk/uksi/2025/996/regulation/3))
[^key-a3223e88f65edf1e7502f2b1c6679a68]: Words in s. 76(1) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 7(4)(a)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/7/4/a); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-a3956bf127b4dff3e08e52e3a45b9de4]: Words in s. 74B(7) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 5(9)(b)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/5/9/b); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-a3c0ce05bf3da8355e376954eddca53f]: Sch. 7 para. 52 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-a3c7eb3e7878fac572efde73a8615fd3]: Words in s. 182(8)(a) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 22(5)(c)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/22/5/c) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-a3ce48c816fb2bf06559889b7357e5f6]: [Sch. 19 para. 330](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/330) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a3e5aec1f29a24d1eaf3ac27bcb0f574]: Sch. 3 para. 13 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
@@ -18960,6 +19298,10 @@
[^key-a4c5e68e10976ef4fd24a41417295228]: Words in s. 186(1) omitted (20.8.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 106(4)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/106/4/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(k)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/k)
[^key-a55bc19846ba8171882b84179089460e]: S. 75(1A) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 6(4)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/6/4); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-a563ca7f29827ed10138447c14ed491d]: [S. 29(1A)](https://www.legislation.gov.uk/ukpga/2018/12/section/29/1A) inserted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 90(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/3), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/b)
[^key-a59f8dde3068bf877b888306045bdfab]: [Sch. 19 para. 424](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/424) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a5d5816e42d277460429b755f59aaec5]: Sch. 20 para. 16 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -18980,7 +19322,7 @@
[^key-a63390fc5b556409349772fb7f0ec1d4]: [Sch. 19 para. 145](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/145) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a63f73287f410fd54431d0a02dc24128]: Words in [s. 94(10)](https://www.legislation.gov.uk/ukpga/2018/12/section/94/10) substituted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 16](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/16); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(y)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/y)
[^key-a63f73287f410fd54431d0a02dc24128]: Words in s. 94(10) substituted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 16](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/16); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(y)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/y)
[^key-a6604195d497ecc3ddea17c2bd854a34]: [Sch. 11 para. 5](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/5) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
@@ -19000,19 +19342,27 @@
[^key-a72ed094e92b1e77b75e2da52e1bc7c9]: Word in Sch. 20 para. 14(2) substituted (5.5.2023) by [The Data Protection Act 2018 (Transitional Provision) Regulations 2023 (S.I. 2023/414)](https://www.legislation.gov.uk/uksi/2023/414), [regs. 1(1)](https://www.legislation.gov.uk/uksi/2023/414/regulation/1/1), [2(2)](https://www.legislation.gov.uk/uksi/2023/414/regulation/2/2)
[^key-a7f4fb45d4985c2ae2de3f44e0683a28]: Words in s. 146(12) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 98(2)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/98/2/d), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(q)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/q)
[^key-a8d6ad38f571bd25bf6e36ce4c60dfb4]: S. 146(11A) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 98(2)(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/98/2/c), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(q)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/q)
[^key-a8f58512cb57f396c3a6b2d0a2120804]: [Sch. 19 para. 179](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/179) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a92af31a14937e990ce7e02e2e9d9f29]: Words in s. 10(5) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 13(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/13/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-a931c9ae51bd816f5bd69abcac767b27]: [S. 160](https://www.legislation.gov.uk/ukpga/2018/12/section/160) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-a931c9ae51bd816f5bd69abcac767b27]: S. 160 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-a94119cccf820588c348cc565b00173b]: [Sch. 19 para. 47](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/47) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a9e9900b37646b445f84ef39a0d76cc0]: Words in s. 157(2)(a) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 6 para. 16](https://www.legislation.gov.uk/ukpga/2025/18/schedule/6/paragraph/16); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z8)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z8) (with [reg. 5](https://www.legislation.gov.uk/uksi/2026/82/regulation/5))
[^key-a9ec2bd81e5dda449f1fc6b59fc8c021]: Words in s. 78(4) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 10(7)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/10/7); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-aa6af2689d3c8dbcfd3393c5949edec1]: [Sch. 19 para. 410](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/410) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-aa86426e70dd097305ad06632c463ad0]: Words in [s. 116(2)](https://www.legislation.gov.uk/ukpga/2018/12/section/116/2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 48(4)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/48/4) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-ab17241dc6150ceb8d51a34398cf5b43]: [S. 164](https://www.legislation.gov.uk/ukpga/2018/12/section/164) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-ab17241dc6150ceb8d51a34398cf5b43]: S. 164 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-ab3ee4f089fcbc7d49b46a2bbd552991]: Words in s. 180(2)(e) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 75](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/75) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -19026,6 +19376,8 @@
[^key-ac0d3ccf4233244b994c97cd184120b6]: [Sch. 7 para. 43](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/43) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-ac3b134b46dc6a134cccaf5d53f4d75d]: S. 182(14) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 22(8)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/22/8) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-acb0285e2b1938c540581efba74d8844]: [Sch. 19 para. 367](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/367) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-acd9c1db11c3f2dc87e850a09432977c]: [Sch. 19 para. 390](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/390) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -19062,7 +19414,11 @@
[^key-b0b94538e5b0cafb0b20aa069c61482f]: Words in Sch. 1 para. 1(3) substituted (31.12.2020) by [The UK Statistics (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/489)](https://www.legislation.gov.uk/uksi/2019/489), [regs. 1](https://www.legislation.gov.uk/uksi/2019/489/regulation/1), [3](https://www.legislation.gov.uk/uksi/2019/489/regulation/3); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-b0db01543b0050f576c5393cc63112bd]: [Sch. 16 para. 2](https://www.legislation.gov.uk/ukpga/2018/12/schedule/16/paragraph/2) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-b0ca7b55c1d34b9d0878eae9b1f6b388]: Words in s. 78(1) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 10(3)(c)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/10/3/c); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-b0db01543b0050f576c5393cc63112bd]: Sch. 16 para. 2 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-b1051ad1ae2b860c2886c33cde88988e]: S. 26(2)(fa) omitted (5.2.2026) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 17](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/17) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-b14dd74941113a22c1d268f51eb9660d]: Sch. 20 para. 39 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -19116,8 +19472,14 @@
[^key-b54c57bf05b376d8d1296b1b3073711a]: [Sch. 19 para. 9](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/9) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b5870932b95e3ca877d17b34543d9485]: S. 24(2)(ca) omitted (5.2.2026) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 16(b)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/16/b) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-b590a9087442280960754e373c622ce8]: [Sch. 19 para. 373](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/373) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b60dc775aac7c701d2165367b07d3c92]: Word in s. 149(2)(b) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 6 para. 15(b)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/6/paragraph/15/b); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z8)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z8) (with [reg. 5](https://www.legislation.gov.uk/uksi/2026/82/regulation/5))
[^key-b621b1bce175765bffd77f862862781f]: S. 79(1)-(3) omitted (5.9.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(8)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/8/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-b62d921feb3097216f65a44384e7c28a]: Sch. 2 para. 7 modified by S.I. 1999/677, art. 7(1)(2) (as substituted (25.5.2018) by [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 237](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/237) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g))
[^key-b66bfe28770e7c763a748c72fa460f03]: [Sch. 19 para. 318](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/318) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -19156,12 +19518,20 @@
[^key-b9933b917dda2c289091db4c60012665]: Words in s. 189(4)(d) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 83(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/83/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-b9957e2a5a2f701bf8221842166c966d]: Sch. 1 para. 14(1)(b)(iia) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 28(5)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/28/5); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z12)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z12)
[^key-b9fb3ca41d32a811b10aaa5281713ab0]: [Sch. 16 para. 7](https://www.legislation.gov.uk/ukpga/2018/12/schedule/16/paragraph/7) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-ba50110eb56a510d248a092ced92efea]: Sch. 20 para. 10 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-bb92ccaf6d40e7fe52d46a80c4f8d067]: Words in Sch. 21 para. 4(4)(a) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 25(3)(b)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/25/3/b) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-bba1972fdaeb5c6bfb595609de9e7fca]: S. 73(3) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 3(4)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/3/4); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-bbc49c524804fb2ab905465728240522]: Words in s. 170(7) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 71](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/71) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-bbf1a58d25121030163f2ecc32091b86]: Word in [s. 82(1)(b)](https://www.legislation.gov.uk/ukpga/2018/12/section/82/1/b) substituted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 89(2)(b)(iii)](https://www.legislation.gov.uk/ukpga/2025/18/section/89/2/b/iii), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/a)
[^key-bc2a530dd3f0d4818c8cbe412b184952]: [S. 42A](https://www.legislation.gov.uk/ukpga/2018/12/section/42A) inserted (19.6.2025 for specified purposes, 20.8.2025 in so far as not already in force) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 74(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/74/5), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(c)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/c)
[^key-bc3021df4d077fdfe7d839e771ba45e1]: Words in s. 126(4) substituted (19.6.2025 for specified purposes, 20.8.2025 in so far as not already in force) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 92(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/92/4), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(f)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/f)
@@ -19188,6 +19558,8 @@
[^key-be312be66278b219bf36807ebc298dca]: S. 21(1)-(4) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 29(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/29/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-bed1bbe545b86b3f34cd73fe1006e0b1]: Words in s. 79(8) substituted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(8)(f)(i)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/8/f/i), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-bedf5d2451f593d3f59d1740c5bd6e9c]: [S. 139(2)](https://www.legislation.gov.uk/ukpga/2018/12/section/139/2) omitted (20.8.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 20](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/20); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(y)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/y)
[^key-bef50065785b938e25237c6aa68a6597]: [Sch. 19 para. 285](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/285) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -19212,6 +19584,8 @@
[^key-bfe8ef2d0b7e57490a5fd744b237a5af]: S. 21 heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 29(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/29/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-c007da42893720a87d1ccc5f31b29e94]: S. 164(5)(ba) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 100(8)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/100/8/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(s)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/s)
[^key-c0286c159abd916463bf0ef6a009374d]: [Sch. 1 para. 19](https://www.legislation.gov.uk/ukpga/2018/12/schedule/1/paragraph/19) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-c03eb89cbce80a935ecb6347de5c299b]: Words in Sch. 2 para. 26(9)(d) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(21)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/21/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -19220,31 +19594,41 @@
[^key-c088d98cf8145c1a34b102fd333f5481]: [Sch. 19 para. 113](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/113) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c0b2f29bccc13f15dc49d5e39f492432]: Words in s. 182(11) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 22(7)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/22/7) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-c1385fd85cc9aa1ac18e428d1255229e]: [Sch. 19 para. 208](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/208) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c16f610c170d5b1d37b2f712191af2cc]: [Sch. 11 para. 12](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/12) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-c1d3f43f097f9a6407e04871a09dba04]: [Sch. 19 para. 335](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/335) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c200f0f3b78d0996b7d83fdabfb5e5be]: Ss. 17A-17C inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 23](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/23) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-c23720bc5fe8d01d4cdc6ce3eb96a7a0]: Word in [s. 35(8)](https://www.legislation.gov.uk/ukpga/2018/12/section/35/8) substituted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 74(4)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/74/4/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(c)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/c)
[^key-c24fe2bf46c2f469339fd6168916f31d]: Words in s. 125(9) substituted (19.6.2025 for specified purposes, 20.8.2025 in so far as not already in force) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 92(3)(e)](https://www.legislation.gov.uk/ukpga/2025/18/section/92/3/e), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(f)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/f)
[^key-c27fc7f3663f78e184ed53b5cb3fa95a]: Words in s. 36(1)(b) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 71(8)(b)(ii)](https://www.legislation.gov.uk/ukpga/2025/18/section/71/8/b/ii), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(d)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/d)
[^key-c283492444369915cc8328a5db21ac24]: Words in s. 41(1) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 86(7)](https://www.legislation.gov.uk/ukpga/2025/18/section/86/7), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(n)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/n)
[^key-c2993c748626851ac752a159c968c2f3]: [Sch. 19 para. 68](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/68) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c2ac2fbd7eae86c3237b0fea08970942]: [Sch. 19 para. 147](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/147) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c2c5d116ce6a43c27f2a73f15736bc95]: S. 135(5) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 94(2)(f)](https://www.legislation.gov.uk/ukpga/2025/18/section/94/2/f), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(p)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/p)
[^key-c2ef1f00c16c6ae79e671982664ebcb6]: Sch. 1 para. 7 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-c30e1b55c0964dff6ce0025bc68780b2]: S. 74B(7)(a) omitted (5.2.2026) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 5(9)(c)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/5/9/c); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-c356bafc244fdc4ace9be54cbc58a2b8]: [Sch. 19 para. 220](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/220) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c36bb938b5c589478fc26017aba6c037]: [Sch. 7 para. 1](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/1) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-c3878a9352147db7dfa9f90c863bf7d5]: [Sch. 19 para. 79](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/79) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c3db4b87743d73511206b4ae86bb0bbf]: [Sch. 11 para. 2](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/2) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-c3db4b87743d73511206b4ae86bb0bbf]: Sch. 11 para. 2 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-c42e79588cd90b927e90e98fb9ba2512]: Words in s. 74B(6)(b) omitted (5.2.2026) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 5(8)(a)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/5/8/a); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-c444d824a5b6f20e42cd95b28ec028cb]: [Sch. 19 para. 13](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/13) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -19254,6 +19638,10 @@
[^key-c4aa80bf6800be1023988219c3bbbb5b]: [Sch. 19 para. 248](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/248) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c4c698ffcad1fdfc1ee117a7b7f0135e]: Words in s. 78(5)(a) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 10(8)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/10/8); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-c4f6f551c02ad0529dcfe52319f44e5b]: Words in s. 45(5) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(4)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/4/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-c51320ded27a1bd50bf68bdae0baf46b]: Words in [s. 27(5)](https://www.legislation.gov.uk/ukpga/2018/12/section/27/5) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 35](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/35) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-c51b193aa656263473481500b9b47e2b]: [Sch. 7 para. 24](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/24) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
@@ -19282,8 +19670,18 @@
[^key-c7f86e0fd7e97d7dc7de053dc830c822]: Words in s. 17(6) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 22(4)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/22/4/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-c8009cd3f34a2fb8b93f511fd91c3911]: Words in s. 54(1) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 76(6)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/76/6/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(h)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/h) (with [reg. 4](https://www.legislation.gov.uk/uksi/2026/82/regulation/4))
[^key-c80351c1f89ae0c5b0904b8cee685403]: Words in s. 78(3) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 10(6)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/10/6); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-c830a9cae371d430b44b2aa6a4bf2b0f]: Words in s. 74B(6)(b) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 5(8)(c)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/5/8/c); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-c878a510ff3f0a3cdbe94d08100e3f1f]: Words in s. 76 heading substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 7(2)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/7/2); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-c8842a494d6ce371ae2b0bfd423daf8a]: [Sch. 19 para. 244](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/244) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c8b189bd190418a0b8c08dc36a21b784]: Words in s. 54(1) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 75(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/75/3), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(g)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/g)
[^key-c8b210ff5beb76a0a92b2c6d4bd6e5eb]: Words in Sch. 3 para. 5 cross-heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(6)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/6) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-c8e2994c25fb458736a5c26eaf716e23]: S. 162 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
@@ -19300,8 +19698,12 @@
[^key-c99271dec5b91e51a9f814f1c8a4b5c2]: Words in Sch. 20 para. 18(2)(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 101(4)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/101/4/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-c9c90b260f03b04a3210ddf5cf427c98]: S. 147(6)(b) and word omitted (5.2.2026) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 99](https://www.legislation.gov.uk/ukpga/2025/18/section/99), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(r)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/r)
[^key-c9dd5c6539aaab7b9c7d8c2530ffbb16]: [Sch. 19 para. 187](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/187) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ca51874e189552fc41a0821aa974d708]: Words in Sch. 1 para. 13(1)(a) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 28(4)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/28/4); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z12)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z12)
[^key-ca55331b740b2f84383f97045a5d7b5c]: Sch. 20 para. 25 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ca96e304fa8efb2d21e87e6971b2da03]: [Sch. 19 para. 428](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/428) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -19316,12 +19718,14 @@
[^key-cb488232f6394d8ef31bca7d0e16a533]: Sch. 3 para. 4 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-cb4bb25b28e2a4cebdd3008f0007e5a3]: Words in s. 52(3) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 6 para. 13(3)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/6/paragraph/13/3); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z8)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z8) (with [reg. 5](https://www.legislation.gov.uk/uksi/2026/82/regulation/5))
[^key-cb60abcf455a1fb39b192e2fb65b8e33]: Sch. 20 para. 21 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-cb7a6630c560b4d7f879a0ea0c77fbd1]: Words in s. 206 Table inserted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 90(9)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/9/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/b)
[^key-cb9887b74f9ddbd87db8262dc983986d]: [Sch. 19 para. 89](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/89) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-cba88e2b39b826968769027cc29370be]: Words in [s. 135(4)](https://www.legislation.gov.uk/ukpga/2018/12/section/135/4) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 56](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/56) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-cbafc2b11db1365fec90797f8b94de74]: Words in [s. 35(6)(b)](https://www.legislation.gov.uk/ukpga/2018/12/section/35/6/b) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 74(4)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/74/4/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(c)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/c)
[^key-cc268dff7489493500857e0da3d30cf8]: [Sch. 19 para. 281](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/281) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -19338,6 +19742,10 @@
[^key-cd0fcadfa37c156db132b641258a55e0]: Sch. 1 para. 35 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-cd3fcd3b3b24247e2c9c80b93ed010a3]: Words in s. 52(5) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 6 para. 13(5)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/6/paragraph/13/5); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z8)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z8) (with [reg. 5](https://www.legislation.gov.uk/uksi/2026/82/regulation/5))
[^key-cd796f7f465a287a7ad8f6cceb0ffdd1]: S. 68(7)(d) omitted (5.9.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/6), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-cda6697838e6a39b03259abc790960d5]: Sch. 18 para. 3(2)(fa) inserted (1.12.2023) by [Northern Ireland Troubles (Legacy and Reconciliation) Act 2023 (c. 41)](https://www.legislation.gov.uk/ukpga/2023/41), [s. 63(4)](https://www.legislation.gov.uk/ukpga/2023/41/section/63/4), [Sch. 13 para. 10](https://www.legislation.gov.uk/ukpga/2023/41/schedule/13/paragraph/10) (with [s. 61](https://www.legislation.gov.uk/ukpga/2023/41/section/61)); [S.I. 2023/1293](https://www.legislation.gov.uk/uksi/2023/1293), [reg. 2(k)](https://www.legislation.gov.uk/uksi/2023/1293/regulation/2/k)
[^key-cdd8c10a5150531bb30b7690485fc5fc]: Pt. 2 Ch. 3 applied (31.12.2020) by Regulation (EU) No. 625/2017, Art. 143 (as substituted by [The Official Controls (Animals, Feed and Food, Plant Health etc.) (Amendment) (EU Exit) Regulations 2020 (S.I. 2020/1481)](https://www.legislation.gov.uk/uksi/2020/1481), [regs. 1](https://www.legislation.gov.uk/uksi/2020/1481/regulation/1), [27(3)](https://www.legislation.gov.uk/uksi/2020/1481/regulation/27/3) (with [reg. 46](https://www.legislation.gov.uk/uksi/2020/1481/regulation/46)))
@@ -19354,6 +19762,8 @@
[^key-cef4c775a0b9e54df85f16deac5eafea]: [Sch. A1](https://www.legislation.gov.uk/ukpga/2018/12/schedule/A1) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 72(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/72/8), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(b)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/b)
[^key-cf05969d527787ceebd91cdb9d0c97c8]: Words in s. 76(1)(c) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 7(4)(b)(i)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/7/4/b/i); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-cf185b11f6eb430ea7b837e8c88bd7b6]: Words in s. 80(4) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 46(4)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/46/4) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-cf7b12fa6e29df3664f564217fb41aec]: [Sch. 19 para. 320](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/320) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -19374,8 +19784,12 @@
[^key-d114d373a470ef9c52798d2916ae07af]: Words in Sch. 2 para. 1 cross-heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(4)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/4) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-d1152f324a931564f92cc8544265fbed]: Word in [s. 82(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/82/1) inserted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 89(2)(b)(i)](https://www.legislation.gov.uk/ukpga/2025/18/section/89/2/b/i), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/a)
[^key-d142e8d668e46fcefe4fda5df5ec3327]: Sch. 3 para. 3 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-d148ab93ff75155701358f9231d9b294]: S. 44 cross-heading substituted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 79(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/79/3), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/a) (with [reg. 3](https://www.legislation.gov.uk/uksi/2025/996/regulation/3))
[^key-d16c7a54102fa53493454b8eb8c8f1f3]: S. 23 omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 31](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/31) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-d171d83535850d556ca50d4c0a9131d1]: Words in [Sch. 19 para. 432(5)(a)](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/432/5/a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 100(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/100/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -19398,6 +19812,8 @@
[^key-d2b9ba5521020831be5beef0f2b1990f]: Words in s. 173(2)(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 73](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/73) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-d2e0447457ca59340f34c196ea9c9bbb]: Words in s. 45(5) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 76(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/76/5), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(h)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/h) (with [reg. 4](https://www.legislation.gov.uk/uksi/2026/82/regulation/4))
[^key-d2fd9c6100b620310997d76d277b9f80]: [Sch. 19 para. 99](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/99) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-d30e265bd0e7290a2fd7d7064c8670b8]: [Sch. 19 para. 262](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/262) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -19410,10 +19826,12 @@
[^key-d3e6a542361c641611591efb60fe9e38]: [Sch. 19 para. 137](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/137) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-d41dc001718a68d14976eac66448eb8a]: Words in Sch. 1 para. 4(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 91(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/91/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-d4911fd8900176bfede61e0e047b8c61]: Word in Sch. 1 para. 10(1)(a) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 28(3)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/28/3); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z12)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z12)
[^key-d49a6d2b560c968a1b1a08e01ce6a029]: S. 3(14)(b) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 4(7)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/4/7/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-d49e29b37e647fdc02fe14d8a452418e]: Words in Sch. 21 para. 9(3)(a) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 25(6)(b)(i)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/25/6/b/i) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-d4f3fe3c5fbdf78dd7e443f27080c092]: [Sch. 7 para. 44](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/44) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-d50b2691f5d850d9368511bef6e62dee]: [Sch. 19 para. 321](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/321) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -19422,10 +19840,14 @@
[^key-d5814a5c9f9acb766d2ce56a6703bb8e]: [Sch. 11 para. 8](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/8) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-d584974284089f57966a7096404fc460]: Words in s. 73(5)(a) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 40(4)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/40/4) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-d5d81d1e5de7c304de8030c77285cf59]: Words in s. 52(4) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 6 para. 13(4)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/6/paragraph/13/4); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z8)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z8) (with [reg. 5](https://www.legislation.gov.uk/uksi/2026/82/regulation/5))
[^key-d66a0382c6eee93acf592ffe2d2762bb]: Words in s. 119A(1) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 20(2)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/20/2) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-d6f4e27ae8c0a8a0d6b9afb5b4427125]: S. 7(1)(ba) inserted (25.1.2023) by [Advanced Research and Invention Agency Act 2022 (c. 4)](https://www.legislation.gov.uk/ukpga/2022/4), [s. 13(1)](https://www.legislation.gov.uk/ukpga/2022/4/section/13/1), [Sch. 3 para. 14(a)](https://www.legislation.gov.uk/ukpga/2022/4/schedule/3/paragraph/14/a); [S.I. 2023/58](https://www.legislation.gov.uk/uksi/2023/58), [reg. 2](https://www.legislation.gov.uk/uksi/2023/58/regulation/2)
[^key-d7b53c8fbbc309eb53cd104cacb820d5]: S. 146A inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 98(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/98/3), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(q)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/q)
[^key-d7d2530b8c04272f421e5f13fc49a57f]: [Sch. 15 para. 15](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/15) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-d7f2eb02ca7f034aafd56f74b579aba9]: [Sch. 19 para. 161](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/161) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -19440,29 +19862,37 @@
[^key-d8d73be9be172f479c33caf3c2fc1670]: Words in s. 210(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 89](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/89) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-d8e364c911e63ea578fc0534de164ddf]: Words in [s. 136(1)(b)](https://www.legislation.gov.uk/ukpga/2018/12/section/136/1/b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 57](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/57) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-d905a49f85abea49a90d25e4d78b00cb]: Words in s. 174(2)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 74](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/74) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-d90ea73c93bcf268873fb7da4680904a]: [Sch. 19 para. 165](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/165) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-d90f8aa7af43aed9d99961342328f905]: Words in s. 36(1)(b) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 71(8)(b)(i)](https://www.legislation.gov.uk/ukpga/2025/18/section/71/8/b/i), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(d)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/d)
[^key-d926ea66208808cf0ac6cd8080a79d94]: Sch. 1 para. 16 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-d94801f9ba7734b896eb73e9c7d3ab3c]: Word in s. 6 substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 67(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/67/2), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(a)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/a)
[^key-d975bf9312ec73c1e21013621d4551b6]: Sch. 2 para. 14 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-d99c33910706cc9759a015d3c9510423]: Words in s. 48(4) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(5)(b)(ii)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/5/b/ii), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-d9d4a5328d371f45edc310525d5e56ca]: S. 195 in force at 23.7.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 3(l)](https://www.legislation.gov.uk/uksi/2018/625/regulation/3/l)
[^key-d9da4db861a50088202986f496b2f52f]: S. 17A and cross-heading omitted (5.2.2026) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 12](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/12) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-d9e75b820dadd4eac2b1032ec6c6a4da]: [Sch. 19 para. 258](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/258) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-d9ef046124282afd82fbdc97d2c50598]: [Sch. 7 para. 38](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/38) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-d9fc1bc3658d88f2d897556d637f92a5]: Word in Sch. 21 para. 9(1) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 25(6)(a)(ii)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/25/6/a/ii) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-da4d8d7b0fe43481acfe3f79e34c5771]: [Sch. 19 para. 188](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/188) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-da5474989e672f513cfd5369bd8c73d9]: [Sch. 19 para. 41](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/41) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-da640f7e42c73ddf470ab5d98d90bf50]: Sch. 2 para. 7 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-dab432b68eaa55e8793ff7fdf2cde91f]: S. 53(4A) inserted (19.6.2025 for specified purposes) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 75(2)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/75/2/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h)
[^key-dab432b68eaa55e8793ff7fdf2cde91f]: S. 53(4A) inserted (19.6.2025 for specified purposes, 5.2.2026 in so far as not already in force) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 75(2)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/75/2/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(g)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/g)
[^key-dab6528400a65dd48f125dfd149128c0]: Words in [Sch. 3 Pt. 1](https://www.legislation.gov.uk/ukpga/2018/12/schedule/3/part/1) heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -19472,12 +19902,18 @@
[^key-dbdad71b9ade64a8f7fdfc45c071f848]: Words in Sch. 3 para. 17(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(15)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/15) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-dbea2923e027af3545aabd9fb13d1561]: Words in s. 53(1) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 6 para. 14(2)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/6/paragraph/14/2); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z8)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z8) (with [reg. 5](https://www.legislation.gov.uk/uksi/2026/82/regulation/5))
[^key-dc25bdac0f1e8b11ebb0a1d301e0e786]: Words in s. 149(2)(e) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 21](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/21) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-dc321b64fd0fcd1ec60ef61441b8fafc]: [Sch. 8 para. 6](https://www.legislation.gov.uk/ukpga/2018/12/schedule/8/paragraph/6) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-dc40b789ba49496fa957bb0b48f33a2b]: [Sch. 19 para. 77](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/77) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-dc44819fb13fa8e6ea18a61ad3fab776]: [Sch. 19 para. 276](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/276) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-dcdb72650fa4d8b42926e24c738770ee]: [S. 82(2A)](https://www.legislation.gov.uk/ukpga/2018/12/section/82/2A) inserted (19.6.2025 for specified purposes, 17.11.2025 in so far as not already in force) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 89(2)(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/89/2/c), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/a)
[^key-dce28071963c6ace834d117354904185]: [Sch. 7 para. 14](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/14) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-dd0f181b5dd17d7042dc7e38ce07044c]: S. 111 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
@@ -19488,8 +19924,14 @@
[^key-dd757ab40e97ddf846173abfa98de010]: [Sch. 19 para. 70](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/70) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-dd7f364bfaec19b43609544d1cd6ce0d]: S. 75(8) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 18](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/18) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-dd8583cf6b3633e3cd4398106baef5a8]: [Sch. 19 para. 249](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/249) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-dd90705502d2af3349fa679fa27d61cb]: S. 97(6) omitted (5.2.2026) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 80(5)(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/80/5/c), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(j)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/j) (with [reg. 5](https://www.legislation.gov.uk/uksi/2026/82/regulation/5))
[^key-ddb140ac11da0a454924fd8b8ffdd0b4]: Words in s. 78(6) omitted (5.2.2026) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 10(9)(c)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/10/9/c); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-ddb24038c52777eed313664ed44d18e8]: [Sch. 19 para. 212](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/212) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ddb56eb702b1a635c52b24c4ba095ef3]: Words in s. 25(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 33(2)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/33/2/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -19498,12 +19940,20 @@
[^key-de38b60ee34fb320e926b3a6a4bfa2b2]: [Sch. 19 para. 183](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/183) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-de4ac3966480d314214c8b4e0b2726c1]: Words in s. 48(6)(a) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(5)(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/5/c), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-de4e64996aab70646e626d9af11ff8da]: S. 135(4) omitted (5.2.2026) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 94(2)(e)](https://www.legislation.gov.uk/ukpga/2025/18/section/94/2/e), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(p)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/p)
[^key-de7ac3b59d15240bff2525e5f4ee0096]: [Sch. 19 para. 218](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/218) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-deba1ccec93c5dcf33f3a26797f2173c]: S. 109 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-ded61f002bfbb5bef7671b46575c415a]: Sch. 16 para. 2(2)(3) omitted (5.2.2026) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 101(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/101/2), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(t)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/t) (with [reg. 6](https://www.legislation.gov.uk/uksi/2026/82/regulation/6))
[^key-deebf9ef3b2556d2b0b7321f2152e6b2]: [Sch. 19 para. 315](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/315) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-deff4dd564b399ee67ce282b983c6ef7]: Words in s. 96(3) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 80(4)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/80/4/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(j)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/j) (with [reg. 5](https://www.legislation.gov.uk/uksi/2026/82/regulation/5))
[^key-df310fa6ee2a3dff0c63be234a5da9cb]: [Sch. 19 para. 383](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/383) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-df4d3f41a1a238306f55678d6a3b9c30]: Sch. 20 para. 32 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -19520,12 +19970,18 @@
[^key-e0073adcf48ad8394f78eb971946c0b3]: Words in s. 12(1)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 15](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/15) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-e02ec6f854ccde9464ef3e9f5f9141a4]: S. 76(2A) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 7(6)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/7/6); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-e0842c692626b5e774c6753f0719945c]: Words in Sch. 2 para. 16(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(14)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/14) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-e0af39578686eeb0c305a1a1b1364dea]: Words in s. 74B(5) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 5(6)(a)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/5/6/a); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-e0bccd6b1e4e022c2e677ed1bdb9d8d1]: S. 183A and cross-heading inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 106(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/106/2), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(k)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/k)
[^key-e0d2f2b8d26ec60067558dd0962095b3]: Words in s. 187(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 81(5)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/81/5/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-e12b78e0c76fbc4614664fe94a4d6885]: Words in s. 73(5)(a) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 3(6)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/3/6); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-e19adfb1f3c5862f38fc50a0d9f8f97e]: [Sch. 19 para. 160](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/160) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e19cbfe5436f8c558c28e7bfce051537]: Words in s. 15(2)(d) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 19(6)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/19/6/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -19536,11 +19992,13 @@
[^key-e22a317e4dc955876132ce146811edf9]: [Sch. 19 para. 340](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/340) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e2348e78adbd3029a227efae614695f4]: S. 74B heading substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 5(2)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/5/2); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-e2376d4e7ebdd9a757cdbb27840c896f]: Act modified (14.2.2020) by [The Northamptonshire (Structural Changes) Order 2020 (S.I. 2020/156)](https://www.legislation.gov.uk/uksi/2020/156), [arts. 1](https://www.legislation.gov.uk/uksi/2020/156/article/1), [17(2)(e)](https://www.legislation.gov.uk/uksi/2020/156/article/17/2/e)
[^key-e25930aa3cf639fbe9dcbc865cf147f2]: S. 113 in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-e25dd9b1b973623ef52f15cab26e68cb]: [Sch. 8 para. 8](https://www.legislation.gov.uk/ukpga/2018/12/schedule/8/paragraph/8) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-e25dd9b1b973623ef52f15cab26e68cb]: Sch. 8 para. 8 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-e277a02441fd6aacb99d8f3da6909db8]: [Sch. 8 para. 4](https://www.legislation.gov.uk/ukpga/2018/12/schedule/8/paragraph/4) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
@@ -19556,6 +20014,8 @@
[^key-e2dd47d0a543b3e922e9c971f2a8baa4]: Words in s. 24(5) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 32(5)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/32/5/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-e2f701e524ebd1a8781ec9a99b82c6d9]: Words in Sch. 20 para. 58(1) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 115(9)](https://www.legislation.gov.uk/ukpga/2025/18/section/115/9), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(y)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/y) (with [regs. 8-11](https://www.legislation.gov.uk/uksi/2026/82/regulation/8))
[^key-e36726ddad796892b59de71bc71fac9c]: [Sch. 11 para. 4](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/4) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-e36f3d79dc2160326592a45b956bcee2]: Words in s. 80(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 46(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/46/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -19564,18 +20024,24 @@
[^key-e3c229800630400cd31ee2e7333a1763]: Words in [s. 120(2)](https://www.legislation.gov.uk/ukpga/2018/12/section/120/2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 52(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/52/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-e3d2ddb984625a2f569456c91752d449]: Words in s. 74B(6)(b) omitted (5.2.2026) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 5(8)(b)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/5/8/b); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-e3d81e9f8b5c66334909f95bff82cae4]: S. 105 in force at 16.9.2019 by [S.I. 2019/1188](https://www.legislation.gov.uk/uksi/2019/1188), [reg. 2(e)](https://www.legislation.gov.uk/uksi/2019/1188/regulation/2/e)
[^key-e470ab8179af8528ddd36f612bb0f69d]: Words in s. 28(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 36(4)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/36/4) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-e4afbc3f11ae48f0f055c87060290428]: [Sch. 19 para. 385](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/385) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e4b6bf252710a06423eb0634fadfe1eb]: Words in s. 182(8) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 22(5)(a)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/22/5/a) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-e4bd601efb2a0a88b3b1622f2115e194]: Words in s. 192(6) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 26](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/26); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(y)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/y)
[^key-e4d19bddc6c0328454f09fd547393db8]: [Sch. 19 para. 268](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/268) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e51209f96eafbb1ab258e63be1650a81]: [Sch. 19 para. 136](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/136) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e52d8b5b76715f576de2f9602dc519b7]: Words in s. 73(1) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 3(3)(a)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/3/3/a); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-e5b2150a1d39bc03193da3965332e3b3]: Sch. 2 paras. 4A, 4B and cross-headings substituted (8.3.2024) by [The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024 (S.I. 2024/342)](https://www.legislation.gov.uk/uksi/2024/342), [regs. 1(2)](https://www.legislation.gov.uk/uksi/2024/342/regulation/1/2), [3](https://www.legislation.gov.uk/uksi/2024/342/regulation/3)
[^key-e61c7bcd6ea2ed4e56a76b4a860e3400]: S. 147 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
@@ -19588,20 +20054,22 @@
[^key-e6d674ace935bcf1083b558a35b32428]: Words in s. 15(2)(c) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 19(5)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/19/5/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-e712c58086f46cef490d2739c32196e8]: Words in s. 206 Table substituted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 90(9)(a)(i)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/9/a/i), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/b)
[^key-e72064e13dd75d5efe7864fb56a44ab9]: [Sch. 19 para. 298](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/298) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e73ac3d5a9d77806ecf02f4d54d01d6d]: Words in [s. 160 cross-heading](https://www.legislation.gov.uk/ukpga/2018/12/part/6/crossheading/guidance) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 102(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/102/3), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(i)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/i)
[^key-e73ac3d5a9d77806ecf02f4d54d01d6d]: Words in s. 160 cross-heading inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 102(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/102/3), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(i)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/i)
[^key-e75907eba429315009a11c3d22ff06fd]: [Sch. 19 para. 202](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/202) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e779a2cbb005a1cb60490514350355b6]: Word in s. 48(4) substituted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(5)(b)(i)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/5/b/i), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-e7856245e743d7a5de4a1d03a5a413ed]: Words in s. 2(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 3](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-e792a8125d606098513f47d2e25be7fe]: Words in [s. 115(7)](https://www.legislation.gov.uk/ukpga/2018/12/section/115/7) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 47(8)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/47/8) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-e7ffa3e81bd3a810e9d34eb945cfc66c]: [Sch. 19 para. 163](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/163) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e814ef10951e6e4e2aa0170b5a7394df]: S. 18(2)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 24(4)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/24/4) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-e81956df0d06f6110c0b4ac40cb98a27]: [Sch. 19 para. 269](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/269) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e8392aedf57540894d7ffc3e0da6093d]: Words in Sch. 2 para. 27(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(23)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/23/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -19618,6 +20086,8 @@
[^key-e966768c7106fe0dc55d7c693755813e]: Sch. 20 para. 4 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e99058667b9492995c12419ae6af932c]: Words in s. 74B(5) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 5(6)(b)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/5/6/b); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-e99403db3867a4daaebe4da8128b05b5]: [Sch. 19 para. 369](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/369) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e9b848f9dfd63036d3e70f0dd8886750]: [Sch. 7 para. 34](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/34) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
@@ -19640,10 +20110,16 @@
[^key-eb4cab607306f7c1339e70bed947d88d]: Sch. 20 para. 15 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-eb5829a0c87d7e2a3d3519615683d044]: S. 135(1A) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 94(2)(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/94/2/c), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(p)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/p)
[^key-eb657c142c3f50225154d09ddb60518c]: [Sch. 8 para. 9](https://www.legislation.gov.uk/ukpga/2018/12/schedule/8/paragraph/9) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-eb777efcc08de23adede3dd754e4fc67]: S. 78(1A) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 10(4)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/10/4); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-eb8139f6b70ca4dec02be30470479741]: Words in s. 15(2)(f) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 19(8)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/19/8/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-eba1269b77655cf79896f883a1632572]: S. 160(1)(ba) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 100(6)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/100/6/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(s)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/s)
[^key-ebbf8e6619bc3e211728d99978469935]: [Sch. 19 para. 326](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/326) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ebc3859cb98a52a9be07b9734f108537]: [Sch. 19 para. 407](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/407) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -19656,6 +20132,8 @@
[^key-ec4c69b934ac57e2e43214a23dcbb96d]: [Sch. 11 para. 9](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/9) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-ec6f56978250d6a8ac23a54c34201ea0]: Word in [s. 82(1)(a)](https://www.legislation.gov.uk/ukpga/2018/12/section/82/1/a) substituted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 89(2)(b)(ii)](https://www.legislation.gov.uk/ukpga/2025/18/section/89/2/b/ii), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/a)
[^key-eced7daf0a93577817bcb97bd3948271]: S. 21 cross-heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 28](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/28) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-ed498558e2f05ed1eacf387d181f2ea5]: Words in Sch. 3 para. 20 cross-heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(18)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/18) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -19670,6 +20148,10 @@
[^key-ee309db6643b4037ea2a506821cd0818]: Sch. 20 para. 3 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ee5edfdcab0ee7308291688f5d50b0d9]: S. 44(4)(d) omitted (5.9.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(3)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/3/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-ee7439cfb2782d7a6babfbccedd14a04]: Words in s. 164(1) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 100(8)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/100/8/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(s)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/s)
[^key-ee8d24ff7579d381bcf3447e849bb137]: [Sch. 19 para. 303](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/303) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ee913b1171c2f96081016642901d4393]: [Sch. 7 para. 37](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/37) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
@@ -19688,8 +20170,14 @@
[^key-efefe38304f75aba67a62c87caf4f25e]: [Sch. 15 para. 17](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/17) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-f00075df90a95ee9a8cd7964240bac16]: Sch. 7 para. 57 inserted (5.1.2026) by [Border Security, Asylum and Immigration Act 2025 (c. 31)](https://www.legislation.gov.uk/ukpga/2025/31), [ss. 11](https://www.legislation.gov.uk/ukpga/2025/31/section/11), [65(1)](https://www.legislation.gov.uk/ukpga/2025/31/section/65/1) (with [s. 10](https://www.legislation.gov.uk/ukpga/2025/31/section/10)); [S.I. 2025/1318](https://www.legislation.gov.uk/uksi/2025/1318), [reg. 2(a)](https://www.legislation.gov.uk/uksi/2025/1318/regulation/2/a)
[^key-f01cfdd076622c51d98828fe590750f4]: [Sch. 19 para. 73](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/73) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-f06182bbe328e7cc054e5f63e790a846]: Sch. 21 para. 12(2) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 25(9)(c)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/25/9/c) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-f06c433a1f0d3269ad70e332bbfc3adf]: Word in s. 182(8) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 22(5)(b)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/22/5/b) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-f07eab9e4a9bf6d612d592a97af71a89]: [Sch. 19 para. 159](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/159) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-f106395db15e7bf5a355770eae3d3f6a]: [Sch. 19 para. 329](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/329) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -19700,16 +20188,22 @@
[^key-f13e34f57b68b2f3aa30277188bfcc15]: Sch. 1 para. 10 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-f1e72d6620cae06e2c6df77112c0cc3c]: Words in s. 18(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 24(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/24/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-f158013ab7dd597af9cb241fc75b8456]: S. 53(6)(7) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 75(2)(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/75/2/c), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(g)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/g)
[^key-f1ea12c4ad88d4f388ce1587dd4bb8fa]: [Sch. 19 para. 116](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/116) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-f21be6bd9397adb6cb7d1ab807fe908e]: S. 182(4) omitted (5.2.2026) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 22(2)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/22/2) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-f251ec0fb7d1f9d415237244a6167b7b]: [Sch. 19 para. 237](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/237) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-f26231d3616eb287b3ee33c4cae88815]: Words in Sch. 20 Pt. 3 heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 101(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/101/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-f2630d51dd1163fd5db4e508baac724b]: Words in s. 94(14) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 76(7)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/76/7/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(h)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/h) (with [reg. 4](https://www.legislation.gov.uk/uksi/2026/82/regulation/4))
[^key-f287d086a4e8e739fe2ef37b6accb6d4]: Sch. 20 para. 36 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-f2cee165d9a934aed6aaf388aefae5c2]: Sch. 21 para. 9(4)(aa) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 25(6)(c)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/25/6/c) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-f2da6f3a2b23afc935273439d0cf1789]: Words in s. 15(2)(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 19(4)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/19/4/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-f2e7bbf27eee985d9a2bb76f58d3deb1]: [Sch. 19 para. 219](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/219) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -19718,6 +20212,8 @@
[^key-f3538c932d11050dee0f2e1eb61020d3]: Words in s. 11(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 14](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/14) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-f355423658395e822e4494dd0c757c36]: Word in s. 73(1)(a) omitted (5.2.2026) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 3(3)(b)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/3/3/b); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-f36da07bc6957dc9cf0e7e6dcb8769d0]: [S. 116(A1)](https://www.legislation.gov.uk/ukpga/2018/12/section/116/A1) inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 48(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/48/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-f36e3f8d2e9c3f68d669cb6b0bbd97d6]: [Sch. 7 para. 3](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/3) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
@@ -19728,12 +20224,16 @@
[^key-f3f9b2e5f89457aeaa4f41a30c82f461]: [Sch. 7 para. 41](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/41) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-f43a6187e9bc6e537dc0ba0627f09cc0]: Words in [s. 83(2)](https://www.legislation.gov.uk/ukpga/2018/12/section/83/2) substituted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 90(4)(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/4/c), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/b)
[^key-f43ca2a3521eaade711bc4bf7677fd8d]: Words in s. 209(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 88](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/88) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-f47223315e48d2332450a35ce52125d7]: S. 184(4)(a)(b) substituted for words (1.4.2025) by [The Disclosure (Scotland) Act 2020 (Consequential Provisions and Modifications) Order 2025 (S.I. 2025/423)](https://www.legislation.gov.uk/uksi/2025/423), [art. 2(1)](https://www.legislation.gov.uk/uksi/2025/423/article/2/1), [Sch. 2 para. 3(2)](https://www.legislation.gov.uk/uksi/2025/423/schedule/2/paragraph/3/2)
[^key-f4979cce47b9db75cf9c23da4f9fa151]: Words in s. 149(4)(c) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 61](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/61) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-f49a68891d68ece6c5bea29963860fb9]: Words in s. 54(2) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 76(6)(b)(ii)](https://www.legislation.gov.uk/ukpga/2025/18/section/76/6/b/ii), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(h)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/h) (with [reg. 4](https://www.legislation.gov.uk/uksi/2026/82/regulation/4))
[^key-f4afc6d6129e6908fd5ea3cb69bb36df]: S. 28(5) inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 36(5)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/36/5) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-f4bf067041e8f9f8848359b6b4e202b0]: S. 207(3) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 87(5)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/87/5) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -19742,16 +20242,24 @@
[^key-f583eaf405e87a78ff32fe446bbd4660]: [S. 55(1)(e)](https://www.legislation.gov.uk/ukpga/2018/12/section/55/1/e) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 84(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/84/2), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(d)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/d)
[^key-f58654c59abfc48179fb052b3bb3eb5c]: Words in s. 87(1)(b) substituted (5.2.2026) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 71(9)(b)(ii)](https://www.legislation.gov.uk/ukpga/2025/18/section/71/9/b/ii), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(d)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/d)
[^key-f5f2be2d52fde50a90249c3696ee9e5c]: S. 207(6) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 87(7)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/87/7) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-f61b1c41d1ef400486d9a7c32e3ef26b]: [Sch. 16 para. 5](https://www.legislation.gov.uk/ukpga/2018/12/schedule/16/paragraph/5) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-f6981cb83d7c96ee86796f35063db417]: S. 186(3)(c) omitted (20.8.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 106(4)(d)(ii)](https://www.legislation.gov.uk/ukpga/2025/18/section/106/4/d/ii), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(k)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/k)
[^key-f75032a14bb0c5fa124d986aadfb4ead]: Words in s. 78(6) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 10(9)(b)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/10/9/b); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-f78da6f023a80509141fa555013b5b91]: Act modified (23.5.2019) by [The Buckinghamshire (Structural Changes) Order 2019 (S.I. 2019/957)](https://www.legislation.gov.uk/uksi/2019/957), [arts. 1](https://www.legislation.gov.uk/uksi/2019/957/article/1), [15(2)](https://www.legislation.gov.uk/uksi/2019/957/article/15/2)
[^key-f7d821b6c7a960f9c5c64c3d1877b6db]: Words in s. 76(3) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 7(7)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/7/7); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-f838d49e21c426886f987f4284f2defe]: Words in Sch. 3 para. 12(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(14)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/14) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-f87d6b233ea8a6202e701a03a1004ec7]: Words in s. 97(1)(a) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 80(5)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/80/5/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(j)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/j) (with [reg. 5](https://www.legislation.gov.uk/uksi/2026/82/regulation/5))
[^key-f89e2d4a625a493b7c0cd20626e0b437]: Words in Sch. 3 para. 19 cross-heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(16)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/16) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-f9037392e04ce91d10ca238c50493e35]: [Sch. 7 para. 21](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/21) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
@@ -19770,6 +20278,12 @@
[^key-fa38f60b5d4f99f26df799872e6cdbe5]: Words in [s. 115(9)](https://www.legislation.gov.uk/ukpga/2018/12/section/115/9) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 47(10)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/47/10) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-fa4e7554d445d66534e30acb6686394b]: S. 94(14A)(14B) inserted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 76(7)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/76/7/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(h)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/h) (with [reg. 4](https://www.legislation.gov.uk/uksi/2026/82/regulation/4))
[^key-fa62a71a5dc3350beb4ec0c525bfbdb3]: S. 26(2)(f)(ai) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/2), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-fa7ac0a67482002a01f5620160e274c2]: S. 74B(1)(2) omitted (5.2.2026) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 5(3)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/5/3); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-faa82338427aa33729b4502a5d841e1d]: [Sch. 19 para. 266](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/266) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-fb61e29e24493921fc39e369e4a42620]: [Sch. 19 para. 357](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/357) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -19800,6 +20314,10 @@
[^key-fdbc640373aa15e11b3c435f27bfb9a5]: [Sch. 19 para. 98](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/98) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-fdc3238a0e9e132b97466766f336017c]: Sch. 21 para. 6(2) substituted (5.2.2026) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 9 para. 25(4)(b)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/paragraph/25/4/b) (with [Sch. 9 Pt. 2](https://www.legislation.gov.uk/ukpga/2025/18/schedule/9/part/2)); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z11)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z11)
[^key-fdd11964dd5f70e3e98b54f18f45480b]: Words in s. 44(5) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(3)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/3/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-fde9fcf105d0042f1bda9820bf84606a]: [Sch. 19 para. 112](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/112) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-fe184c23ee47121bd5d9ccc551211b0c]: [Sch. 19 para. 191](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/191) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -19818,6 +20336,8 @@
[^key-ff22ac74c2a5beddde84ab38a67d210a]: Words in Sch. 13 para. 1(1)(e) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 97(2)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/97/2/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-ff454fa84136ab51d3f46aa48bc8ca42]: Words in s. 74B(6)(a) omitted (5.2.2026) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 8 para. 5(7)(b)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/8/paragraph/5/7/b); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(z10)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/z10)
[^key-ff63110f11b2b9882390f31a36181e9a]: [Sch. 19 para. 80](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/80) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-ff84a0a5b654d268377d223457dbe16d]: [S. 116(1)(a)](https://www.legislation.gov.uk/ukpga/2018/12/section/116/1/a) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 48(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/48/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -19840,6 +20360,8 @@
[^M_F_d572f402-2b66-4807-ea89-c9fa6447e306]: Words in s. 207(7) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 87(8)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/87/7) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^M_F_dd2a1277-a0f9-4a09-8bfa-fa41e3d1758a]: S. 199(1) omitted (5.2.2026) by virtue of [The Data (Use and Access) Act 2025 (Consequential and Other Amendments) Regulations 2025 (S.I. 2025/1331)](https://www.legislation.gov.uk/uksi/2025/1331), [regs. 2(2)](https://www.legislation.gov.uk/uksi/2025/1331/regulation/2/2), [3](https://www.legislation.gov.uk/uksi/2025/1331/regulation/3); [S.I. 2026/82](https://www.legislation.gov.uk/uksi/2026/82), [reg. 2(s)](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/s)
[^M_I_001184dc-ddbe-45f4-bebc-3ba7048d50bc]: S. 17 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_00c31825-5cfe-4783-9f84-25a44cf57ad7]: S. 138 in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
@@ -19910,8 +20432,6 @@
[^M_I_28822e5a-7910-498b-b1e2-072272c03889]: S. 187 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^M_I_29681cd4-4b4a-447a-e2a1-57524db1d0fe]: S. 19 in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_2d9df10b-98d2-4b7a-d660-77cd9369a5d3]: Sch. 1 para. 1 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_2e29e5e1-8c41-46fc-a235-4e7cf9f16ca8]: Sch. 1 para. 39 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
@@ -20036,8 +20556,6 @@
[^M_I_6e4ced79-902f-4770-e83a-88b5e6a453bb]: S. 106 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^M_I_700ae3c2-cd7e-4d99-f1ed-8e44ca22b9a2]: S. 49 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_704d1a2f-01f6-43d0-b29b-6c6f0d266fc1]: S. 198 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^M_I_71950d7e-e7f1-400d-9c57-0b88753b8e0c]: S. 61 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
@@ -20066,7 +20584,7 @@
[^M_I_79c91ef1-9e52-4174-d7df-1e4ebb635fb1]: S. 129 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_7e22bcd2-6790-4c27-f846-8a797b1d9af6]: [S. 75](https://www.legislation.gov.uk/ukpga/2018/12/section/75) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_7e22bcd2-6790-4c27-f846-8a797b1d9af6]: S. 75 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_801a1b0a-c984-4f73-8ba2-f8e1aded63a1]: S. 51 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
@@ -20118,8 +20636,6 @@
[^M_I_9b03e9ed-2411-4cba-9edd-c070b61a84dd]: S. 94 in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^M_I_9c0d6c64-5423-4080-8352-7bb8d2632c1d]: S. 14 in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_a0eafee7-b1a2-4679-980c-920a0708b921]: S. 212 in force at Royal Assent, see [s. 212(2)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2)
[^M_I_a2d52cf4-c053-479c-c668-54966a9a7c22]: S. 181 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
@@ -20194,7 +20710,7 @@
[^M_I_c1f33cf3-e662-4b89-ea75-a314be526ffa]: S. 48 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_c242106f-aec0-42e7-f82c-694506ebb5cb]: [S. 54](https://www.legislation.gov.uk/ukpga/2018/12/section/54) in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_c242106f-aec0-42e7-f82c-694506ebb5cb]: S. 54 in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_c31292b9-3b55-4525-fc37-2e8b8ac3de16]: S. 119 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
@@ -20218,8 +20734,6 @@
[^M_I_cec05f16-9b5b-470b-ac33-a60370739aab]: S. 211 in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^M_I_d0223e53-0bd7-42a8-873e-c6d82c40d2f4]: S. 50 in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_d0d73c42-8e30-469d-f331-baaea535f1cb]: Sch. 3 para. 7 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_d12995b4-0d48-4403-a1e6-4860af1c5761]: S. 30 in force in so far as not already in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
@@ -20250,8 +20764,6 @@
[^M_I_dcaef763-924e-4781-d81d-b11a8ad30472]: S. 33 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_dce41456-1292-42fc-86ad-012f24a66ab8]: S. 18 in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_dd2d81f5-ec2f-4277-e4c8-6dee20e72e31]: S. 11 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_e0e612ed-1ee3-42f6-ce07-e7e69f860bfc]: S. 166 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
@@ -20288,291 +20800,763 @@
[^M_I_ffacd87e-5a20-492e-de3c-99476f317c17]: S. 80 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-9dc954c44dc2f1d5fb977d7d90900abc]: Word in s. 44 heading omitted (5.9.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 79(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/79/4), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/a) (with [reg. 3](https://www.legislation.gov.uk/uksi/2025/996/regulation/3))
[^key-d148ab93ff75155701358f9231d9b294]: S. 44 cross-heading substituted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 79(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/79/3), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/a) (with [reg. 3](https://www.legislation.gov.uk/uksi/2025/996/regulation/3))
[^key-197984193b1a0c63c5cf1d6bdb297f95]: S. 45 cross-heading omitted (5.9.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 79(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/79/5), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/a) (with [reg. 3](https://www.legislation.gov.uk/uksi/2025/996/regulation/3))
[^key-a31bbbaf0702a16d218d015081e896e0]: S. 45A inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 79(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/79/6), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/a) (with [reg. 3](https://www.legislation.gov.uk/uksi/2025/996/regulation/3))
[^key-43bee759a5f6cbf8926b877ad7d6d594]: S. 78A inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(7)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/7), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-fa62a71a5dc3350beb4ec0c525bfbdb3]: S. 26(2)(f)(ai) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/2), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-cd796f7f465a287a7ad8f6cceb0ffdd1]: S. 68(7)(d) omitted (5.9.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/6), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-51a420e340d7561e52b67143aef34c49]: S. 186(3)(ca) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(10)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/10), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-79ecfa480be800660f1c1ae8309a399e]: Words in s. 43(1)(a) substituted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 79(2)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/79/2/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/a) (with [reg. 3](https://www.legislation.gov.uk/uksi/2025/996/regulation/3))
[^key-873a9a81f73c6a07542ec3514b86b3e0]: Words in s. 43(1)(b) substituted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 79(2)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/79/2/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/a) (with [reg. 3](https://www.legislation.gov.uk/uksi/2025/996/regulation/3))
[^key-ee5edfdcab0ee7308291688f5d50b0d9]: S. 44(4)(d) omitted (5.9.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(3)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/3/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-fdd11964dd5f70e3e98b54f18f45480b]: Words in s. 44(5) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(3)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/3/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-4e053c869dd0d1212f96f10b0bd1f15c]: Words in s. 44(7)(a) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(3)(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/3/c), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-0aec7eae8fcc0cb7a6400cb54bac6096]: S. 45(4)(d) omitted (5.9.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(4)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/4/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-c4f6f551c02ad0529dcfe52319f44e5b]: Words in s. 45(5) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(4)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/4/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-3eaa0823ead96c831913592484a5d070]: Words in s. 45(7)(a) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(4)(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/4/c), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-1851ffdfb55a1ae4837371dce443325b]: Words in s. 110(2)(a) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(9)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/9/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-4d9aa0606c413206cb1320a83695979d]: Words in s. 110(2)(b) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(9)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/9/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-94d96ee0fcb3bd0d69d2d1921830ed5c]: Words in s. 110(2)(c) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(9)(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/9/c), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-591ce9de9eda44e5f845b9c965e14c54]: S. 48(3)(d) omitted (5.9.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(5)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/5/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-e779a2cbb005a1cb60490514350355b6]: Word in s. 48(4) substituted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(5)(b)(i)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/5/b/i), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-d99c33910706cc9759a015d3c9510423]: Words in s. 48(4) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(5)(b)(ii)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/5/b/ii), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-de4ac3966480d314214c8b4e0b2726c1]: Words in s. 48(6)(a) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(5)(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/5/c), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-14dc1bd03f341f46d16e2b23a8854253]: S. 51(1)(ba) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 79(7)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/79/7/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/a) (with [reg. 3](https://www.legislation.gov.uk/uksi/2025/996/regulation/3))
[^key-8d58a5c874287d0bdc585648c49f5321]: S. 51(2)(aa) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 79(7)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/79/7/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/a) (with [reg. 3](https://www.legislation.gov.uk/uksi/2025/996/regulation/3))
[^key-83cd0e4be4bc9319fbb76e9a6ba71e9c]: S. 51(4)(aa) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 79(7)(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/79/7/c), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/a) (with [reg. 3](https://www.legislation.gov.uk/uksi/2025/996/regulation/3))
[^key-8497f1214ba7ccd2b9dc5d3d6fe6bba4]: Word in s. 51(6) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 79(7)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/79/7/d), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/a) (with [reg. 3](https://www.legislation.gov.uk/uksi/2025/996/regulation/3))
[^key-4849df2d1d93b321b98b1225cfbb8277]: S. 79(3A) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(8)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/8/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-5633966e010ddf6145173a099d2c2156]: Words in s. 79(5) substituted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(8)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/8/d), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-4f3513a26367d91804bfa7f435078e46]: Words in s. 79(7) substituted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(8)(e)(i)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/8/e/i), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-4f560578ecfbff00c81b108cc574f95c]: Words in s. 79(7) substituted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(8)(e)(ii)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/8/e/ii), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-bed1bbe545b86b3f34cd73fe1006e0b1]: Words in s. 79(8) substituted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(8)(f)(i)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/8/f/i), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-23f61e511accf4c5242cc571d1f808b8]: Words in s. 79(8) substituted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(8)(f)(ii)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/8/f/ii), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-a168ba5289668a8cd5edfcb49d96d728]: Words in s. 79(10) substituted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(8)(g)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/8/g), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-68225e3df25a9f0f2570cf0783246f60]: Words in s. 79(11) substituted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(8)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/8/h), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-7f421b709d4b29a3c22625c805399f04]: Words in s. 79(12) substituted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(8)(i)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/8/i), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-82414ea480fe391b01b01fb4e26587de]: S. 79(13) omitted (5.9.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(8)(j)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/8/j), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-b621b1bce175765bffd77f862862781f]: S. 79(1)-(3) omitted (5.9.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(8)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/8/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-71f3222fd4b877a586e08d163019b411]: Words in s. 79(4) substituted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(8)(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/8/c), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-dcdb72650fa4d8b42926e24c738770ee]: [S. 82(2A)](https://www.legislation.gov.uk/ukpga/2018/12/section/82/2A) inserted (19.6.2025 for specified purposes, 17.11.2025 in so far as not already in force) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 89(2)(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/89/2/c), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/a)
[^key-47b298b6510458494f665aeeee02e734]: [S. 82(4)](https://www.legislation.gov.uk/ukpga/2018/12/section/82/4) inserted (19.6.2025 for specified purposes, 17.11.2025 in so far as not already in force) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 89(2)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/89/2/d), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/a)
[^key-3be04071b6e982862efa5dedc98b91c5]: [Ss. 82A-82E](https://www.legislation.gov.uk/ukpga/2018/12/section/82A) inserted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 89(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/89/3), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/a)
[^key-494dd52ba56482beabc25e56147b27ce]: Words in [s. 1(5)](https://www.legislation.gov.uk/ukpga/2018/12/section/1/5) inserted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 90(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/2), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/b)
[^key-a563ca7f29827ed10138447c14ed491d]: [S. 29(1A)](https://www.legislation.gov.uk/ukpga/2018/12/section/29/1A) inserted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 90(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/3), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/b)
[^key-2f056c8fbea11fd72923190c3a60a7e8]: [S. 82(A1)](https://www.legislation.gov.uk/ukpga/2018/12/section/82/A1) inserted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 89(2)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/89/2/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/a)
[^key-d1152f324a931564f92cc8544265fbed]: Word in [s. 82(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/82/1) inserted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 89(2)(b)(i)](https://www.legislation.gov.uk/ukpga/2025/18/section/89/2/b/i), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/a)
[^key-ec6f56978250d6a8ac23a54c34201ea0]: Word in [s. 82(1)(a)](https://www.legislation.gov.uk/ukpga/2018/12/section/82/1/a) substituted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 89(2)(b)(ii)](https://www.legislation.gov.uk/ukpga/2025/18/section/89/2/b/ii), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/a)
[^key-bbf1a58d25121030163f2ecc32091b86]: Word in [s. 82(1)(b)](https://www.legislation.gov.uk/ukpga/2018/12/section/82/1/b) substituted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 89(2)(b)(iii)](https://www.legislation.gov.uk/ukpga/2025/18/section/89/2/b/iii), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/a)
[^key-08ad9f9df54aea437bd161c772023bf2]: [S. 83(A1)](https://www.legislation.gov.uk/ukpga/2018/12/section/83/A1) inserted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 90(4)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/4/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/b)
[^key-f43a6187e9bc6e537dc0ba0627f09cc0]: Words in [s. 83(2)](https://www.legislation.gov.uk/ukpga/2018/12/section/83/2) substituted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 90(4)(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/4/c), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/b)
[^key-5323f01b951ce1dc681a7e41c427fe5a]: Words in [s. 83(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/83/1) substituted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 90(4)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/4/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/b)
[^key-0a7db461f51968f8ba878ebd21f8457e]: [S. 84(2A)](https://www.legislation.gov.uk/ukpga/2018/12/section/84/2A) inserted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 90(5)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/5/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/b)
[^key-38fa0eb45714967ac6481ea2074debe8]: [S. 84(6B)](https://www.legislation.gov.uk/ukpga/2018/12/section/84/6B) inserted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 90(5)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/5/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/b)
[^key-24005f7ff051c74ba6fbee3b3344f7d6]: Word in [s. 104(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/104/1) substituted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 90(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/6), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/b)
[^key-4d0adcfaa451f8df9766cc65dfba95e8]: Words in [s. 202(1)(a)(i)](https://www.legislation.gov.uk/ukpga/2018/12/section/202/1/a/i) inserted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 90(7)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/7), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/b)
[^key-482cfc0bdfdc1cd7467d24b06e056b53]: Word in [s. 203(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/203/1) inserted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 90(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/8), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/b)
[^key-e712c58086f46cef490d2739c32196e8]: Words in [s. 206](https://www.legislation.gov.uk/ukpga/2018/12/section/206) Table substituted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 90(9)(a)(i)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/9/a/i), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/b)
[^key-a182758c8bbfb23b0f4de56a33affea8]: Words in [s. 206](https://www.legislation.gov.uk/ukpga/2018/12/section/206) Table substituted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 90(9)(a)(ii)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/9/a/ii), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/b)
[^key-cb7a6630c560b4d7f879a0ea0c77fbd1]: Words in [s. 206](https://www.legislation.gov.uk/ukpga/2018/12/section/206) Table inserted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 90(9)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/9/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/b)
[^key-f00075df90a95ee9a8cd7964240bac16]: Sch. 7 para. 57 inserted (5.1.2026) by [Border Security, Asylum and Immigration Act 2025 (c. 31)](https://www.legislation.gov.uk/ukpga/2025/31), [ss. 11](https://www.legislation.gov.uk/ukpga/2025/31/section/11), [65(1)](https://www.legislation.gov.uk/ukpga/2025/31/section/65/1) (with [s. 10](https://www.legislation.gov.uk/ukpga/2025/31/section/10)); [S.I. 2025/1318](https://www.legislation.gov.uk/uksi/2025/1318), [reg. 2(a)](https://www.legislation.gov.uk/uksi/2025/1318/regulation/2/a)
[^key-63330d56a2e81707f9cd5b177a000af0]: Words in [s. 183A(4)](https://www.legislation.gov.uk/ukpga/2018/12/section/183A/4) substituted (29.1.2026) by [The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (S.I. 2026/82)](https://www.legislation.gov.uk/uksi/2026/82), [reg. 12(2)](https://www.legislation.gov.uk/uksi/2026/82/regulation/12/2)
[^key-79af9794db26153d08755ea59021b7f1]: Words in [s. 183B(5)(b)](https://www.legislation.gov.uk/ukpga/2018/12/section/183B/5/b) substituted (29.1.2026) by [The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (S.I. 2026/82)](https://www.legislation.gov.uk/uksi/2026/82), [reg. 12(3)](https://www.legislation.gov.uk/uksi/2026/82/regulation/12/3)
[^key-789b1fb0bff945a128559c3def13e851]: Words in [s. 186A(5)](https://www.legislation.gov.uk/ukpga/2018/12/section/186A/5) substituted (29.1.2026) by [The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (S.I. 2026/82)](https://www.legislation.gov.uk/uksi/2026/82), [reg. 12(4)](https://www.legislation.gov.uk/uksi/2026/82/regulation/12/4)
[^key-fd7d8643e5cf863864df9476b9a7e1d8]: [Act](https://www.legislation.gov.uk/ukpga/2018/12) modified (10.3.2026) by [The Surrey (Structural Changes) Order 2026 (S.I. 2026/264)](https://www.legislation.gov.uk/uksi/2026/264), [arts. 1(1)](https://www.legislation.gov.uk/uksi/2026/264/article/1/1), [28(2)(e)](https://www.legislation.gov.uk/uksi/2026/264/article/28/2/e), [40(2)(e)](https://www.legislation.gov.uk/uksi/2026/264/article/40/2/e)
#### Limits on fees that may be charged by controllers
##### 17A
- (1) The Secretary of State may by regulations specify any of the following which the Secretary of State considers ensures an adequate level of protection of personal data—
- (a) a third country,
- (b) a territory or one or more sectors within a third country,
- (c) an international organisation, or
- (d) a description of such a country, territory, sector or organisation.
- (2) For the purposes of the UK GDPR and this Part of this Act, a transfer of personal data to a third country or an international organisation is based on adequacy regulations if, at the time of the transfer, regulations made under this section are in force which specify, or specify a description which includes—
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 17B
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 17C
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### National security and defence exemption
##### 74A
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 74B
- (1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (3) The Secretary of State must, on an ongoing basis, monitor developments in third countries and international organisations that could affect decisions to make regulations giving approval under section 74AA or to amend or revoke such regulations.
- (4) Where the Secretary of State becomes aware that the data protection test is no longer met in relation to transfers approved, or of a description approved, in regulations under section 74AA, the Secretary of State must, to the extent necessary, amend or revoke the regulations.
- (5) Where regulations under section 74AA are amended or revoked in accordance with subsection (4), the Secretary of State must enter into consultations with the third country or international organisation concerned with a view to improving the protection provided to data subjects with regard to the processing of personal data in the country or by the organisation.
- (6) The Secretary of State must publish—
- (a) a list of the third countries ... and international organisations, and the descriptions of such countries ... and organisations, which are for the time being approved by regulations under section 74AA as places or persons to which personal data may be transferred, and
- (b) a list of the third countries ... and international organisations, and the descriptions of such countries ... and organisations, which have been but are no longer approved by such regulations.
- (7) In the case of regulations under section 74AA which approve only certain transfers to a third country or international organisation that are specified or described in the regulations (in accordance with section 74AA(4)(b))—
- (a) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (b) the lists published under subsection (6) must specify or describe the relevant transfers.
##### 119A
- (1) The Commissioner may issue a document specifying standard data protection clauses which the Commissioner considers are capable of securing that the data protection test set out in Article 46 of the UK GDPR or section 75 of this Act (or both) is met in relation to transfers of personal data.
- (2) The Commissioner may issue a document that amends or withdraws a document issued under subsection (1).
- (3) A document issued under this section—
- (a) must specify when it comes into force,
- (aa) may make provision generally or in relation to types of transfer described in the document,
- (b) may make different provision for different purposes, and
- (c) may include transitional provision or savings.
- (4) Before issuing a document under this section, the Commissioner must consult the Secretary of State and such of the following as the Commissioner considers appropriate—
- (a) trade associations;
- (b) data subjects;
- (c) persons who appear to the Commissioner to represent the interests of data subjects.
- (5) After a document is issued under this section—
- (a) the Commissioner must send a copy to the Secretary of State, and
- (b) the Secretary of State must lay it before Parliament.
- (6) If, within the 40-day period, either House of Parliament resolves not to approve the document then, with effect from the end of the day on which the resolution is passed, the document is to be treated as not having been issued under this section (so that the document, and any amendment or withdrawal made by the document, is to be disregarded for the purposes of Article 46(2)(d) of the UK GDPR).
- (7) Nothing in subsection (6)—
- (a) affects any transfer of personal data previously made in reliance on the document, or
- (b) prevents a further document being laid before Parliament.
- (8) The Commissioner must publish—
- (a) a document issued under this section, and
- (b) a notice identifying any document which, under subsection (6), is treated as not having been issued under this section.
- (9) The Commissioner must keep under review the clauses specified in a document issued under this section for the time being in force.
- (10) In this section, “*the 40-day period*” means—
- (a) if the document is laid before both Houses of Parliament on the same day, the period of 40 days beginning with that day, or
- (b) if the document is laid before the Houses of Parliament on different days, the period of 40 days beginning with the later of those days.
- (11) In calculating the 40-day period, no account is to be taken of any whole days that fall within a period during which Parliament is dissolved or prorogued or during which both Houses of Parliament are adjourned for more than 4 days.
- (12) In this section, “*trade association*” includes a body representing controllers or processors.
## SCHEDULE 21
## Part 1 — Interpretation
#### Merger of the directly applicable GDPR and the applied GDPR
##### 1
In this Schedule, “*the applied GDPR*” means the EU GDPR as applied by Chapter 3 of Part 2 before IP completion day.
## Part 2 — Continuation of existing acts etc
##### 2
- (1) On and after IP completion day, references in an enactment to the UK GDPR (including the reference in the definition of “the data protection legislation” in section 3(9)) include—
- (a) the EU GDPR as it was directly applicable to the United Kingdom before IP completion day, read with Chapter 2 of Part 2 of this Act as it had effect before IP completion day, and
- (b) the applied GDPR, read with Chapter 3 of Part 2 of this Act as it had effect before IP completion day.
- (2) On and after IP completion day, references in an enactment to, or to a provision of, Chapter 2 of Part 2 of this Act (including general references to this Act or to Part 2 of this Act) include that Chapter or that provision as applied by Chapter 3 of Part 2 of this Act as it had effect before IP completion day.
- (3) Sub-paragraphs (1) and (2) have effect—
- (a) in relation to references in this Act, except as otherwise provided;
- (b) in relation to references in other enactments, unless the context otherwise requires.
##### 3
- (1) Anything done in connection with the EU GDPR as it was directly applicable to the United Kingdom before IP completion day, the applied GDPR or this Act—
- (a) if in force or effective immediately before IP completion day, continues to be in force or effective on and after IP completion day, and
- (b) if in the process of being done immediately before IP completion day, continues to be done on and after IP completion day.
- (2) References in this paragraph to anything done include references to anything omitted to be done.
## Part 3 — Transfers to third countries and international organisations
##### 4
- (1) On and after IP completion day, for the purposes of the UK GDPR and Part 2 of this Act, a transfer of personal data to a third country or an international organisation is to be treated as approved by regulations made under Article 45A of the UK GDPR if, at the time of the transfer, paragraph 5 specifies, or specifies a description which includes—
- (a) in the case of a third country, the country or a relevant territory or sector within the country, or
- (b) in the case of an international organisation, the organisation.
- (3) Regulations under this section may specify that the Secretary of State considers that an adequate level of protection of personal data is ensured only for a transfer specified or described in the regulations and, if they do so, only such a transfer may rely on those regulations for the purposes of subsection (2).
- (4) Article 45(2) of the UK GDPR makes provision about the assessment of the adequacy of the level of protection for the purposes of this section and section 17B.
- (5) Regulations under this section—
- (a) where they relate to a third country, must specify their territorial and sectoral application;
- (b) where applicable, must specify the independent supervisory authority or authorities referred to in Article 45(2)(b) of the UK GDPR.
- (6) Regulations under this section may, among other things—
- (a) provide that in relation to a country, territory, sector, organisation or transfer specified, or falling within a description specified, in the regulations, section 17B(1) has effect as if it required the reviews described there to be carried out at such shorter intervals as are specified in the regulations;
- (b) identify a transfer of personal data by any means, including by reference to the controller or processor, the recipient, the personal data transferred or the means by which the transfer is made or by reference to relevant legislation, lists or other documents, as they have effect from time to time;
- (c) confer a discretion on a person.
- (7) Regulations under this section are subject to the negative resolution procedure.
##### 17B
- (1) For so long as regulations under section 17A are in force which specify, or specify a description which includes, a third country, a territory or sector within a third country or an international organisation, the Secretary of State must carry out a review of whether the country, territory, sector or organisation ensures an adequate level of protection of personal data at intervals of not more than 4 years.
- (2) Each review under subsection (1) must take into account all relevant developments in the third country or international organisation.
- (3) The Secretary of State must, on an ongoing basis, monitor developments in third countries and international organisations that could affect decisions to make regulations under section 17A or to amend or revoke such regulations.
- (4) Where the Secretary of State becomes aware that a country, territory, sector or organisation specified, or falling within a description specified, in regulations under section 17A no longer ensures an adequate level of protection of personal data, whether as a result of a review under this section or otherwise, the Secretary of State must, to the extent necessary, amend or revoke the regulations.
- (5) Where regulations under section 17A are amended or revoked in accordance with subsection (4), the Secretary of State must enter into consultations with the third country or international organisation concerned with a view to remedying the lack of an adequate level of protection.
- (6) The Secretary of State must publish—
- (a) a list of the third countries, territories and specified sectors within a third country and international organisations, and the descriptions of such countries, territories, sectors and organisations, which are for the time being specified in regulations under section 17A, and
- (b) a list of the third countries, territories and specified sectors within a third country and international organisations, and the descriptions of such countries, territories, sectors and organisations, which have been but are no longer specified in such regulations.
- (7) In the case of regulations under section 17A which specify that an adequate level of protection of personal data is ensured only for a transfer specified or described in the regulations—
- (a) the duty under subsection (1) is only to carry out a review of the level of protection ensured for such a transfer, and
- (b) the lists published under subsection (6) must specify or describe the relevant transfers.
##### 17C
- (1) The Secretary of State may by regulations specify standard data protection clauses which the Secretary of State considers provide appropriate safeguards for the purposes of transfers of personal data to a third country or an international organisation in reliance on Article 46 of the UK GDPR (and see also section 119A).
- (2) The Secretary of State must keep under review the standard data protection clauses specified in regulations under this section that are for the time being in force.
- (3) Regulations under this section are subject to the negative resolution procedure.
- (2) Sub-paragraph (1) has effect subject to provision in paragraph 5 providing that only particular transfers to the country, territory, sector or organisation may rely on a particular provision of paragraph 5 for the purposes of sub-paragraph (1).
- (3) The Secretary of State may by regulations—
- (a) repeal sub-paragraphs (1) and (2) and paragraph 5;
- (b) amend paragraph 5 so as to omit a third country, territory, sector or international organisation specified, or of a description specified, in that paragraph;
- (c) amend paragraph 5 so as to replace a reference to, or description of, a third country, territory, sector or organisation with a narrower reference or description, including by specifying or describing particular transfers of personal data and making provision described in sub-paragraph (2).
- (4) Regulations under this paragraph may, among other things——
- (a) identify a transfer of personal data by any means, including by reference to the controller or processor, the recipient, the personal data transferred or the means by which the transfer is made or by reference to relevant legislation, schemes, lists or other arrangements or documents, as they have effect from time to time;
- (b) confer a discretion on a person.
- (5) Regulations under this paragraph are subject to the negative resolution procedure.
- (6) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 5
- (1) The following are specified for the purposes of paragraph 4(1)—
- (a) an EEA state;
- (b) Gibraltar;
- (c) a Union institution, body, office or agency set up by, or on the basis of, the Treaty on the European Union, the Treaty on the Functioning of the European Union or the Euratom Treaty;
- (d) an equivalent institution, body, office or agency set up by, or on the basis of, the Treaties establishing the European Economic Area;
- (e) a third country which is the subject of a decision listed in sub-paragraph (2), other than a decision that, immediately before IP completion day, had been repealed or was suspended;
- (f) a third country, territory or sector within a third country or international organisation which is the subject of an adequacy decision made by the European Commission before IP completion day on the basis of Article 45(3) of the EU GDPR, other than a decision that, immediately before IP completion day, had been repealed or was suspended.
- (2) The decisions mentioned in sub-paragraph (1)(e) are the following—
- (a) Commission Decision [2000/518/EC](https://www.legislation.gov.uk/eudn/2000/518) of 26th July 2000 pursuant to Directive [95/46/EC](https://www.legislation.gov.uk/eudr/1995/46) of the European Parliament and of the Council on the adequate protection of personal data provided in Switzerland;
- (b) Commission Decision [2002/2/EC](https://www.legislation.gov.uk/eudn/2002/2) of 20th December 2001 pursuant to Directive [95/46/EC](https://www.legislation.gov.uk/eudr/1995/46) of the European Parliament and of the Council on the adequate protection of personal data provided by the Canadian Personal Information Protection and Electronic Documents Act;
- (c) Commission Decision [2003/490/EC](https://www.legislation.gov.uk/eudn/2003/490) of 30th June 2003 pursuant to Directive [95/46/EC](https://www.legislation.gov.uk/eudr/1995/46) of the European Parliament and of the Council on the adequate protection of personal data in Argentina;
- (d) Commission Decision [2003/821/EC](https://www.legislation.gov.uk/eudn/2003/821) of 21st November 2003 on the adequate protection of personal data in Guernsey;
- (e) Commission Decision [2004/411/EC](https://www.legislation.gov.uk/eudn/2004/411) of 28th April 2004 on the adequate protection of personal data in the Isle of Man;
- (f) Commission Decision [2008/393/EC](https://www.legislation.gov.uk/eudn/2008/393) of 8th May 2008 pursuant to Directive [95/46/EC](https://www.legislation.gov.uk/eudr/1995/46) of the European Parliament and of the Council on the adequate protection of personal data in Jersey;
- (g) Commission Decision 2010/146/EU of 5th March 2010 pursuant to Directive [95/46/EC](https://www.legislation.gov.uk/eudr/1995/46) of the European Parliament and of the Council on the adequate protection provided by the Faeroese Act on processing of personal data;
- (h) Commission Decision 2010/625/EU of 19th October 2010 pursuant to Directive [95/46/EC](https://www.legislation.gov.uk/eudr/1995/46) of the European Parliament and of the Council on the adequate protection of personal data in Andorra;
- (i) Commission Decision 2011/61/EU of 31st January 2011 pursuant to Directive [95/46/EC](https://www.legislation.gov.uk/eudr/1995/46) of the European Parliament and of the Council on the adequate protection of personal data by the State of Israel with regard to automated processing of personal data;
- (j) Commission Implementing Decision 2012/484/EU of 21st August 2012 pursuant to Directive [95/46/EC](https://www.legislation.gov.uk/eudr/1995/46) of the European Parliament and of the Council on the adequate protection of personal data by the Eastern Republic of Uruguay with regard to automated processing of personal data;
- (k) Commission Implementing Decision 2013/65/EU of 19th December 2012 pursuant to Directive [95/46/EC](https://www.legislation.gov.uk/eudr/1995/46) of the European Parliament and of the Council on the adequate protection of personal data by New Zealand;
- (m) Commission Implementing Decision (EU) 2019/419 of 23rd January 2019 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by Japan under the Act on the Protection of Personal Information.
- (3) Where a decision described in sub-paragraph (1)(e) or (f) states that an adequate level of protection of personal data is ensured only for a transfer specified or described in the decision, only such a transfer may rely on that provision and that decision for the purposes of paragraph 4(1).
- (4) The references to a decision in sub-paragraphs (1)(e) and (f) and (2) are to the decision as it had effect in EU law immediately before IP completion day, subject to sub-paragraphs (5) and (6).
- (5) For the purposes of this paragraph, where a reference to legislation, a list or another document in a decision described in sub-paragraph (1)(e) or (f) is a reference to the legislation, list or document as it has effect from time to time, it is to be treated as a reference to the legislation, list or other document as it has effect at the time of the transfer.
- (6) For the purposes of this paragraph, where a decision described in sub-paragraph (1)(e) or (f) relates to—
- (a) transfers from the European Union (or the European Community) or the European Economic Area, or
- (b) transfers to which the EU GDPR applies,
it is to be treated as relating to equivalent transfers to or from the United Kingdom or transfers to which the UK GDPR applies (as appropriate).
##### 6
- (1) In the provisions listed in sub-paragraph (2)—
- (a) references to regulations made under Article 45A of the UK GDPR (other than references to making such regulations) include the provision made in paragraph 5;
- (b) references to the revocation of such regulations include the repeal of all or part of paragraph 5.
- (2) Those provisions are Articles 13(1)(f), 14(1)(f), 45C, 49(1) and 49A(1) of the UK GDPR.
- (3) In its application to transfers treated as approved by virtue of paragraph 1, Article 45C(5) of the UK GDPR (transfers approved by regulations: monitoring) has effect as if the reference to Article 45A(4)(b) were omitted.
##### 7
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 8
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 9
- (1) The requirement for safeguards to be provided under Article 46(1A)(a)(i) of the UK GDPR may be satisfied on and after IP completion day as described in sub-paragraphs (2) to (4), subject to sub-paragraph (5).
- (2) The safeguards may be provided for by any binding corporate rules authorised by the Commissioner which, immediately before IP completion day, provided for the appropriate safeguards referred to in Article 46(1) of the EU GDPR by virtue of Article 46(5) of the EU GDPR.
- (3) The safeguards may be provided for by a version of binding corporate rules described in sub-paragraph (2) incorporating changes where—
- (a) all of the changes are made in consequence of the withdrawal of the United Kingdom from the EU , of provision made by regulations under section 8 or 23 of the European Union (Withdrawal) Act 2018 or of the amendment of Chapter 5 of the UK GDPR by the Data (Use and Access) Act 2025, and
- (b) none of the changes alters the effect of the rules.
- (4) The following changes are to be treated as falling within sub-paragraph (3)(a) and (b)—
- (a) changing references to adequacy decisions made by the European Commission into references to equivalent provision made by regulations under section 17A or by or under paragraphs 4 to 6 of this Schedule;
- (aa) changing references to provision made by regulations under section 17A into references to provision made by regulations made under Article 45A of the UK GDPR;
- (b) changing references to transferring personal data outside the European Union or the European Economic Area into references to transferring personal data outside the United Kingdom.
- (5) Sub-paragraphs (2) to (4) cease to apply in relation to binding corporate rules if, on or after IP completion day, the Commissioner withdraws the authorisation of the rules (or, where sub-paragraph (3) is relied on, the authorisation of the rules mentioned in sub-paragraph (2)).
- (5A) For the purposes of sub-paragraph (2), binding corporate rules which, immediately before IP completion day, provided for the appropriate safeguards referred to in Article 46(1) of the EU GDPR by virtue of Article 46(5) of the EU GDPR but which were authorised other than by the Commissioner are to be treated as authorised by the Commissioner where—
- (a) a valid notification of the rules has been made to the Commissioner,
- (b) the Commissioner has approved them, and
- (c) that approval has not been withdrawn.
- (5B) A notification is valid if it—
- (a) is made by a controller or processor established in the United Kingdom,
- (b) is made to the Commissioner before the end of the period of 6 months beginning with IP completion day, and
- (c) includes—
- (i) the name and contact details of the data protection officer or other contact point for the controller or processor, and
- (ii) such other information as the Commissioner may reasonably require.
- (5C) Where a valid notification is made the Commissioner must, without undue delay—
- (a) decide whether or not to approve the rules, and
- (b) notify the controller or processor of that decision.
- (6) The Commissioner must keep the operation of this paragraph under review.
- (7) In this paragraph—
- “*adequacy decision*” means a decision made on the basis of—Article 45(3) of the EU GDPR, orArticle 25(6) of Directive [95/46/EC](https://www.legislation.gov.uk/eudr/1995/46) of the European Parliament and of the Council of 24th October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data;
- “*binding corporate rules*” has the meaning given in Article 4(20) of the UK GDPR.
- (8) This paragraph has effect in addition to Article 46(2) and (3) of the UK GDPR.
##### 10
- (1) On and after IP completion day, for the purposes of Part 3 of this Act, a transfer of personal data to a third country or an international organisation is to be treated as approved by regulations made under section 74AA if, at the time of the transfer, paragraph 11 specifies, or specifies a description which includes—
- (a) in the case of a third country, the country or a relevant territory or sector within the country, or
- (b) in the case of an international organisation, the organisation.
- (2) Sub-paragraph (1) has effect subject to provision in paragraph 11 providing that only particular transfers to the country, territory, sector or organisation may rely on a particular provision of paragraph 11 for the purposes of sub-paragraph (1).
- (3) The Secretary of State may by regulations—
- (a) repeal sub-paragraphs (1) and (2) and paragraph 11;
- (b) amend paragraph 11 so as to omit a third country, territory, sector or international organisation specified, or of a description specified, in that paragraph;
- (c) amend paragraph 11 so as to replace a reference to, or description of, a third country, territory, sector or organisation with a narrower reference or description, including by specifying or describing particular transfers of personal data and by making provision described in sub-paragraph (2).
- (4) Regulations under this paragraph may, among other things—
- (a) identify a transfer of personal data by any means, including by reference to the controller or processor, the recipient, the personal data transferred or the means by which the transfer is made or by reference to relevant legislation, schemes, lists or other arrangements or documents, as they have effect from time to time;
- (b) confer a discretion on a person.
- (5) Regulations under this paragraph are subject to the negative resolution procedure.
- (6) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
##### 11
- (1) The following are specified for the purposes of paragraph 10(1)—
- (a) an EEA state;
- (aa) Switzerland;
- (b) Gibraltar;
- (c) a third country, a territory or sector within a third country or an international organisation which is the subject of an adequacy decision made by the European Commission before IP completion day on the basis of Article 36(3) of the Law Enforcement Directive, other than a decision that, immediately before IP completion day, had been repealed or was suspended.
- (2) Where a decision described in sub-paragraph (1)(c) states that an adequate level of protection of personal data is ensured only for a transfer specified or described in the decision, only such a transfer may rely on that provision and that decision for the purposes of paragraph 10(1).
- (3) The reference to a decision in sub-paragraph (1)(c) is to the decision as it had effect in EU law immediately before IP completion day, subject to sub-paragraphs (4) and (5).
- (4) For the purposes of this paragraph, where a reference to legislation, a list or another document in a decision described in sub-paragraph (1)(c) is a reference to the legislation, list or document as it has effect from time to time, it is to be treated as a reference to the legislation, list or other document as it has effect at the time of the transfer.
- (5) For the purposes of this paragraph, where a decision described in sub-paragraph (1)(c) relates to—
- (a) transfers from the European Union (or the European Community) or the European Economic Area, or
- (b) transfers to which the Law Enforcement Directive applies,
it is to be treated as relating to equivalent transfers from the United Kingdom or transfers to which Part 3 of this Act applies (as appropriate).
##### 12
- (1) In sections 74B and 76(A1)—
- (a) references to regulations made under section 74AA (other than references to making such regulations) include the provision made in paragraph 11;
- (b) references to the revocation of such regulations include the repeal of all or part of paragraph 11.
- (2) In its application to transfers treated as approved by virtue of paragraph 10, section 74B(7) (transfers approved by regulations: monitoring) has effect as if the reference to section 74AA(4)(b) were omitted.
## Part 4 — Repeal of provisions in Chapter 3 of Part 2
##### 13
- (1) Regulations made under section 23 before IP completion day continue in force until they are revoked, despite the repeal of that section by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019.
- (2) The provisions listed in section 186(3) include regulations made under section 23 before IP completion day (and not revoked).
- (3) Sub-paragraphs (1) and (2) do not have effect so far as otherwise provided by the law of England and Wales, Scotland or Northern Ireland.
##### 14
- (1) This paragraph applies to a certificate issued under section 27 of this Act which has effect immediately before IP completion day.
- (2) A reference in the certificate to a provision of the applied GDPR has effect, on and after IP completion day, as it if were a reference to the corresponding provision of the UK GDPR or this Act.
## Part 5 — The Information Commissioner
##### 15
The repeal of section 132(2)(d) by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 has effect only in relation to a disclosure of information made on or after IP completion day.
## Part 6 — Enforcement
##### 16
In relation to an infringement, before IP completion day, of a provision of the EU GDPR (as it was directly applicable to the United Kingdom) or the applied GDPR—
- (a) Article 83(5) and (6) of the UK GDPR and section 157(5)(a) and (b) of this Act have effect as if for “£17,500,000” there were substituted “ 20 million Euros ”;
- (b) Article 83(4) of the UK GDPR and section 157(6)(a) and (b) of this Act have effect as if for “£8,700,000” there were substituted “ 10 million Euros ”;
- (c) the maximum amount of a penalty in sterling must be determined by applying the spot rate of exchange set by the Bank of England on the day on which the penalty notice is given under section 155 of this Act.
#### The applied GPDR
##### 17
- (1) This paragraph applies where—
- (a) proceedings are brought against a decision made by the Commissioner before IP completion day, and
- (b) the Commissioner's decision was preceded by an opinion or decision of the European Data Protection Board in accordance with the consistency mechanism referred to in Article 63 of the EU GDPR.
- (2) The Commissioner must forward the Board's opinion or decision to the court or tribunal dealing with the proceedings.
### Immigration: safeguards: immigration exemption decisions
##### 4A
- (1) A decision under paragraph 4(1) as to whether, and the extent to which, the application of the relevant UK GDPR provisions would be likely to prejudice any of the matters mentioned in paragraph 4(1)(a) and (b) (referred to in this paragraph as “*an immigration exemption decision*”) must be made in accordance with this paragraph.
- (2) An immigration exemption decision must be made—
- (a) on a case by case basis,
- (b) separately in respect of each of the relevant UK GDPR provisions mentioned in paragraph 4(2)(a) to (f) which relates to the data subject, and
- (c) afresh on each occasion on which the Secretary of State considers disapplying or restricting the application of any of the relevant UK GDPR provisions mentioned in paragraph 4(2)(a) to (f) in relation to the data subject.
- (3) When making an immigration exemption decision, the Secretary of State must take into account all the circumstances of the case, including at least the following—
- (a) any potential vulnerability of the data subject that is relevant to the decision,
- (b) all the rights and freedoms of the data subject including the data subject’s Convention rights, and
- (c) any relevant duties or obligations of the United Kingdom, the Secretary of State or any other person, including—
- (i) the United Kingdom’s obligations under the Refugee Convention and the Trafficking Convention,
- (ii) any duty under section 55 of the Borders, Citizenship and Immigration Act 2009 (duty regarding the welfare of children), and
- (iii) the need to ensure compliance with the UK GDPR.
- (4) A decision that the application of a particular relevant UK GDPR provision mentioned in paragraph 4(2)(a) to (f) (or that provision in combination with the provision mentioned in paragraph 4(2)(g), so far as it applies) would be likely to prejudice any of the matters mentioned in paragraph 4(1)(a) and (b) may be made only if—
- (a) the application of that provision or those provisions would give rise to a substantial risk of prejudice to any of the matters mentioned in paragraph 4(1)(a) and (b),
- (b) that risk outweighs the risk of prejudice to the interests of the data subject concerned that would arise if the exemption in paragraph 4(1) were to apply in relation to that provision or those provisions, and
- (c) the application of the exemption in relation to that provision or those provisions is necessary and proportionate to the risks in the particular case.
- (5) In this paragraph—
- “*Convention rights*” has the same meaning as in the Human Rights Act 1998 (see section 1(1) of that Act);
- “*the Refugee Convention*” means the Convention relating to the Status of Refugees, done at Geneva on 28 July 1951, and its Protocol;
- “*the Trafficking Convention*” means the Council of Europe Convention on Action against Trafficking in Human Beings, done at Warsaw on 16 May 2005.
### Immigration: safeguard: record of decision that exemption applies
##### 4B
- (1) Where the Secretary of State makes a decision mentioned in paragraph 4A(4), the Secretary of State must keep a record of it and the reasons for it.
- (2) Where sub-paragraph (1) applies, the Secretary of State must also inform the data subject of the decision unless, in the particular circumstances of the case, the Secretary of State considers that doing so may be prejudicial to any of the matters mentioned in paragraph 4(1)(a) and (b).
##### 15A
The Provost Marshal for serious crime.
##### 18A
The Service Police Complaints Commissioner.
#### The applied GPDR
#### GDPR: right to an effective remedy against the Commissioner
#### GDPR: right to an effective remedy against the Commissioner
##### 183B
- (1) This section is about the relationship between—
- (a) a pre-commencement enactment which imposes a duty, or confers a power, to process personal data, and
- (b) a provision of the main data protection legislation containing a requirement relating to the processing of personal data.
- (2) The relationship is not changed by section 5(A1) of the European Union (Withdrawal) Act 2018 (removal of the principle of supremacy of EU law) (or the repeal of section 5(1) to (3) of that Act).
- (3) Where the provision described in subsection (1)(b) is a provision of, or made under, the UK GDPR, section 5(A2) of the European Union (Withdrawal) Act 2018 (assimilated direct legislation subject to domestic enactments) does not apply to the relationship.
- (4) Nothing is to be implied about a relationship described in subsection (1) merely due to the fact that express provision with similar effect to section 183A(1) (or applying that provision) is made in connection with one such relationship but not another.
- (5) In this section—
- (a) “*the main data protection legislation*” and “*requirement*” have the same meaning as in section 183A, and
- (b) “*pre-commencement enactment*” means an enactment so far as passed or made before 20th August 2025.
- (6) Section 183A(5) applies for the purposes of subsection (1)(a) of this section as it applies for the purposes of section 183A(1).
##### 186A
- (1) This section is about the relationship between—
- (a) a pre-commencement enactment which prohibits or restricts the disclosure of information or authorises the withholding of information, and
- (b) a provision of the UK GDPR or this Act listed in section 186(2).
- (2) The relationship is not changed by section 5(A1) of the European Union (Withdrawal) Act 2018 (removal of the principle of supremacy of EU law) (or the repeal of section 5(1) to (3) of that Act).
- (3) Subsection (1) of section 186 does not apply to the relationship so far as there is a contrary intention, whether express or implied (taking account of, among other things, subsection (2) of this section).
- (4) Nothing is to be implied about a relationship described in subsection (1) merely due to the fact that express provision stating that section 186(1) applies (or with similar effect) is made in connection with one such relationship but not another.
- (5) In this section, “*pre-commencement enactment*” means an enactment so far as passed or made before 20th August 2025, other than an enactment contained in, or made under, a provision listed in section 186(2) or (3).
#### Protection of personal data
### Relevant international law
##### 9A
- (1) Processing of personal data meets the requirement in Article 6(3), 8A(3)(e), 9(2)(g) or 10(1) of the UK GDPR for a basis in, or authorisation by, relevant international law only if it meets a condition in Schedule A1.
- (2) A condition in Schedule A1 may be relied on for the purposes of any of those provisions, unless that Schedule provides otherwise.
- (3) The Secretary of State may by regulations amend Schedule A1 by adding, varying or omitting—
- (a) conditions,
- (b) provision about the purposes for which a condition may be relied on, and
- (c) safeguards in connection with processing carried out in reliance on a condition in the Schedule.
- (4) Regulations under this section may only add a condition relating entirely or partly to a treaty ratified by the United Kingdom.
- (5) Regulations under this section are subject to the affirmative resolution procedure.
- (6) In this section, “*treaty*” and “*ratified*” have the same meaning as in Part 2 of the Constitutional Reform and Governance Act 2010 (see section 25 of that Act).
#### Limits on fees that may be charged by controllers
#### National security and defence exemption
##### 74A
- (1) The Secretary of State may by regulations specify any of the following which the Secretary of State considers ensures an adequate level of protection of personal data—
- (a) a third country,
- (b) a territory or one or more sectors within a third country,
- (c) an international organisation, or
- (d) a description of such a country, territory, sector or organisation.
- (2) For the purposes of this Part of this Act, a transfer of personal data to a third country or an international organisation is based on adequacy regulations if, at the time of the transfer, regulations made under this section are in force which specify, or specify a description which includes—
- (a) in the case of a third country, the country or a relevant territory or sector within the country, and
- (b) in the case of an international organisation, the organisation,
and such a transfer does not require specific authorisation.
- (3) Regulations under this section may specify that the Secretary of State considers that an adequate level of protection of personal data is ensured only for a transfer specified or described in the regulations and, if they do so, only such a transfer may rely on those regulations for the purposes of subsection (2).
- (4) When assessing the adequacy of the level of protection for the purposes of this section or section 74B, the Secretary of State must, in particular, take account of—
- (a) the rule of law, respect for human rights and fundamental freedoms, relevant legislation, both general and sectoral, including concerning public security, defence, national security and criminal law and the access of public authorities to personal data, as well as the implementation of such legislation, data protection rules, professional rules and security measures, including rules for the onward transfer of personal data to another third country or international organisation, which are complied with in that country or international organisation, case-law, as well as effective and enforceable data subject rights and effective administrative and judicial redress for the data subjects whose personal data is transferred,
- (b) the existence and effective functioning of one or more independent supervisory authorities in the third country or to which an international organisation is subject, with responsibility for ensuring and enforcing compliance with data protection rules, including adequate enforcement powers, for assisting and advising data subjects in exercising their rights and for cooperation with the Commissioner, and
- (c) the international commitments the third country or international organisation concerned has entered into, or other obligations arising from legally binding conventions or instruments as well as from its participation in multilateral or regional systems, in particular in relation to the protection of personal data.
- (5) Regulations under this section—
- (a) where they relate to a third country, must specify their territorial and sectoral application;
- (b) where applicable, must specify the independent supervisory authority or authorities referred to in subsection (4)(b).
- (6) Regulations under this section may, among other things—
- (a) provide that, in relation to a country, territory, sector, organisation or territory specified, or falling within a description specified, in the regulations, section 74B(1) has effect as if it required the reviews described there to be carried out at such shorter intervals as are specified in the regulations;
- (b) identify a transfer of personal data by any means, including by reference to the controller or processor, the recipient, the personal data transferred or the means by which the transfer is made or by reference to relevant legislation, lists or other documents, as they have effect from time to time;
- (c) confer a discretion on a person.
- (7) Regulations under this section are subject to the negative resolution procedure.
##### 74B
- (1) For so long as regulations under section 74A are in force which specify, or specify a description which includes, a third country, a territory or sector within a third country or an international organisation, the Secretary of State must carry out a review of whether the country, territory, sector or organisation ensures an adequate level of protection of personal data at intervals of not more than 4 years.
- (2) Each review under subsection (1) must take into account all relevant developments in the third country or international organisation.
- (3) The Secretary of State must, on an ongoing basis, monitor developments in third countries and international organisations that could affect decisions to make regulations under section 74A or to amend or revoke such regulations.
- (4) Where the Secretary of State becomes aware that a country, territory, sector or organisation specified, or falling within a description specified, in regulations under section 74A no longer ensures an adequate level of protection of personal data, whether as a result of a review under this section or otherwise, the Secretary of State must, to the extent necessary, amend or revoke the regulations.
- (5) Where regulations under section 74A are amended or revoked in accordance with subsection (4), the Secretary of State must enter into consultations with the third country or international organisation concerned with a view to remedying the lack of an adequate level of protection.
- (6) The Secretary of State must publish—
- (a) a list of the third countries, territories and specified sectors within a third country and international organisations, and the descriptions of such countries, territories, sectors and organisations, which are for the time being specified in regulations under section 74A, and
- (b) a list of the third countries, territories and specified sectors within a third country and international organisations, and the descriptions of such countries, territories, sectors and organisations, which have been but are no longer specified in such regulations.
- (7) In the case of regulations under section 74A which specify that an adequate level of protection of personal data is ensured only for a transfer specified or described in the regulations—
- (a) the duty under subsection (1) is only to carry out a review of the level of protection ensured for such a transfer, and
- (b) the lists published under subsection (6) must specify or describe the relevant transfers.
##### 119A
- (1) The Commissioner may issue a document specifying standard data protection clauses which the Commissioner considers provide appropriate safeguards for the purposes of transfers of personal data to a third country or an international organisation in reliance on Article 46 of the UK GDPR (and see also section 17C).
- (2) The Commissioner may issue a document that amends or withdraws a document issued under subsection (1).
- (3) A document issued under this section—
- (a) must specify when it comes into force,
- (b) may make different provision for different purposes, and
- (c) may include transitional provision or savings.
- (4) Before issuing a document under this section, the Commissioner must consult the Secretary of State and such of the following as the Commissioner considers appropriate—
##### 42A
- (1) The Secretary of State may by regulations—
- (a) make provision so that an additional description of processing of personal data is sensitive processing for the purposes of this Part,
- (b) make provision so that added processing is not sensitive processing for the purposes of this Part,
- (c) make provision so that a protected condition in Schedule 8 may or may not be relied on in connection with added processing, and
- (d) make provision varying such a condition as it relates to added processing.
- (2) In subsection (1)—
- “*added processing*” means a description of processing which is sensitive processing by virtue of provision made under subsection (1)(a);
- “*protected condition in Schedule 8*” means a condition in that Schedule other than one that was added to the Schedule by regulations under section 35(6).
- (3) Regulations under this section may amend this Part and sections 205 and 206.
- (4) Regulations under this section are subject to the affirmative resolution procedure.
##### 50A
- (1) For the purposes of sections 50B and 50C—
- (a) a decision is based solely on automated processing if there is no meaningful human involvement in the taking of the decision, and
- (b) a decision is a significant decision, in relation to a data subject, if—
- (i) it produces an adverse legal effect for the data subject, or
- (ii) it has a similarly significant adverse effect for the data subject.
- (2) When considering whether there is meaningful human involvement in the taking of a decision, a person must consider, among other things, the extent to which the decision is reached by means of profiling.
##### 50B
- (1) A significant decision based entirely or partly on sensitive processing may not be taken based solely on automated processing, unless one of the following conditions is met.
- (2) The first condition is that the decision is based entirely on processing of personal data to which the data subject has given explicit consent.
- (3) The second condition is that the decision is required or authorised by law.
##### 50C
- (1) Subject to subsection (3), where a significant decision taken by or on behalf of a controller in relation to a data subject is—
- (a) based entirely or partly on personal data, and
- (b) based solely on automated processing,
the controller must ensure that safeguards for the data subject’s rights, freedoms and legitimate interests are in place which comply with subsection (2) and any regulations under section 50D(4).
- (2) The safeguards must consist of or include measures which—
- (a) provide the data subject with information about decisions described in subsection (1) taken in relation to the data subject;
- (b) enable the data subject to make representations about such decisions;
- (c) enable the data subject to obtain human intervention on the part of the controller in relation to such decisions;
- (d) enable the data subject to contest such decisions.
- (3) Subsections (1) and (2) do not apply in relation to a significant decision if—
- (a) exemption from those provisions is required for a reason listed in subsection (4),
- (b) the controller reconsiders the decision as soon as reasonably practicable, and
- (c) there is meaningful human involvement in the reconsideration of the decision.
- (4) Those reasons are—
- (a) to avoid obstructing an official or legal inquiry, investigation or procedure;
- (b) to avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;
- (c) to protect public security;
- (d) to safeguard national security;
- (e) to protect the rights and freedoms of others.
- (5) When considering whether there is meaningful human involvement in the reconsideration of a decision, a person must consider, among other things, the extent to which the conclusion reached on reconsideration is reached by means of profiling.
##### 50D
- (1) The Secretary of State may by regulations provide that, for the purposes of sections 50A(1)(a) and 50C(3)(c), there is, or is not, to be taken to be meaningful human involvement in the taking or reconsideration of a decision in cases described in the regulations.
- (2) The Secretary of State may by regulations provide that, for the purposes of section 50A(1)(b)(ii), a description of decision is, or is not, to be taken to have a similarly significant adverse effect for the data subject.
- (3) Regulations under subsection (1) or (2) may amend section 50A.
- (4) The Secretary of State may by regulations make the following types of provision about the safeguards required under section 50C(1)—
- (a) provision requiring the safeguards to include measures in addition to those described in section 50C(2),
- (b) provision imposing requirements which supplement what section 50C(2) requires the safeguards to consist of or include (including, for example, provision about how and when things described in section 50C(2) must be done or be capable of being done), and
- (c) provision about measures which are not to be taken to satisfy one or more of paragraphs (a) to (d) of section 50C(2).
- (5) Regulations under this section are subject to the affirmative resolution procedure.
##### 74AA
- (1) For the purposes of section 73, the Secretary of State may by regulations approve transfers of personal data to—
- (a) a third country, or
- (b) an international organisation.
- (2) The Secretary of State may only make regulations under this section approving transfers to a third country or international organisation if the Secretary of State considers that the data protection test is met in relation to the transfers (see section 74AB).
- (3) In making regulations under this section, the Secretary of State may have regard to any matter which the Secretary of State considers relevant, including the desirability of facilitating transfers of personal data to and from the United Kingdom.
- (4) Regulations under this section may, among other things—
- (a) make provision by reference to a third country or international organisation specified in the regulations or a description of country or organisation;
- (b) approve all transfers of personal data to a third country or international organisation or only transfers specified or described in the regulations;
- (c) identify a transfer of personal data by any means, including by reference to—
- (i) a sector or geographic area within a third country,
- (ii) the controller or processor,
- (iii) the recipient of the personal data,
- (iv) the personal data transferred,
- (v) the means by which the transfer is made, or
- (vi) relevant legislation, schemes, lists or other arrangements or documents, as they have effect from time to time;
- (d) confer a discretion on a person.
- (5) Regulations under this section are subject to the negative resolution procedure.
##### 74AB
- (1) For the purposes of section 74AA, the data protection test is met in relation to transfers to a third country or international organisation if the standard of the protection provided for data subjects with regard to law enforcement processing of personal data in the country or by the organisation is not materially lower than the standard of the protection provided for data subjects by or under—
- (a) this Part, and
- (b) Parts 5 to 7, so far as relevant to law enforcement processing.
- (2) In considering whether the data protection test is met in relation to transfers of personal data to a third country or international organisation, the Secretary of State must consider, among other things—
- (a) respect for the rule of law and for human rights in the country or by the organisation,
- (b) the existence, and powers, of an authority responsible for enforcing the protection of data subjects with regard to the processing of personal data in the country or by the organisation,
- (c) arrangements for judicial or non-judicial redress for data subjects in connection with such processing,
- (d) rules about the transfer of personal data from the country or by the organisation to other countries or international organisations,
- (e) relevant international obligations of the country or organisation, and
- (f) the constitution, traditions and culture of the country or organisation.
- (3) In subsections (1) and (2)—
- (a) the references to the protection provided for data subjects are to that protection taken as a whole,
- (b) the references to law enforcement processing are to processing by a competent authority for any of the law enforcement purposes or equivalent types of processing in the third country or by the international organisation (as appropriate), and
- (c) the references to processing of personal data in the third country or by the international organisation are references only to the processing of personal data transferred to the country or organisation by means of processing to which this Act applies as described in section 207(2).
- (4) When the data protection test is applied only to certain transfers to a third country or international organisation that are specified or described, or to be specified or described, in regulations (in accordance with section 74AA(4)(b))—
- (a) the references in subsections (1) to (3) to personal data are to be read as references only to personal data likely to be the subject of such transfers, and
- (b) the reference in subsection (2)(d) to transfer to other countries or international organisations is to be read as including transfer within the third country or international organisation.
##### 91A
- (1) The Secretary of State may by regulations—
- (a) make provision so that an additional description of processing of personal data is sensitive processing for the purposes of this Part,
- (b) make provision so that added processing is not sensitive processing for the purposes of this Part,
- (c) make provision so that a protected condition in Schedule 10 may or may not be relied on in connection with added processing, and
- (d) make provision varying such a condition as it relates to added processing.
- (2) In subsection (1)—
- “*added processing*” means a description of processing which is sensitive processing by virtue of provision made under subsection (1)(a);
- “*protected condition in Schedule 10*” means a condition in that Schedule other than one that was added to the Schedule by regulations under section 86(3).
- (3) Regulations under this section may amend this Part and sections 205 and 206.
- (4) Regulations under this section are subject to the affirmative resolution procedure.
##### 124A
- (1) The Commissioner must prepare appropriate codes of practice giving guidance as to good practice in the processing of personal data if required to do so by regulations made by the Secretary of State.
- (2) Regulations under this section—
- (a) must describe the personal data or processing to which the code of practice is to relate, and
- (b) may describe the persons or classes of person to whom it is to relate.
- (3) Where a code under this section is in force, the Commissioner may prepare amendments of the code or a replacement code.
- (4) Before preparing a code or amendments under this section, the Commissioner must consult the Secretary of State and such of the following as the Commissioner considers appropriate—
- (a) trade associations;
@@ -20580,1500 +21564,772 @@
- (c) persons who appear to the Commissioner to represent the interests of data subjects.
- (5) After a document is issued under this section—
- (a) the Commissioner must send a copy to the Secretary of State, and
- (b) the Secretary of State must lay it before Parliament.
- (6) If, within the 40-day period, either House of Parliament resolves not to approve the document then, with effect from the end of the day on which the resolution is passed, the document is to be treated as not having been issued under this section (so that the document, and any amendment or withdrawal made by the document, is to be disregarded for the purposes of Article 46(2)(d) of the UK GDPR).
- (7) Nothing in subsection (6)—
- (a) affects any transfer of personal data previously made in reliance on the document, or
- (b) prevents a further document being laid before Parliament.
- (8) The Commissioner must publish—
- (a) a document issued under this section, and
- (b) a notice identifying any document which, under subsection (6), is treated as not having been issued under this section.
- (9) The Commissioner must keep under review the clauses specified in a document issued under this section for the time being in force.
- (10) In this section, “*the 40-day period*” means—
- (a) if the document is laid before both Houses of Parliament on the same day, the period of 40 days beginning with that day, or
- (b) if the document is laid before the Houses of Parliament on different days, the period of 40 days beginning with the later of those days.
- (11) In calculating the 40-day period, no account is to be taken of any whole days that fall within a period during which Parliament is dissolved or prorogued or during which both Houses of Parliament are adjourned for more than 4 days.
- (12) In this section, “*trade association*” includes a body representing controllers or processors.
## SCHEDULE 21
## Part 1 — Interpretation
- (5) A code under this section may include transitional provision or savings.
- (6) Regulations under this section are subject to the negative resolution procedure.
- (7) In this section—
- “*good practice in the processing of personal data*” means such practice in the processing of personal data as appears to the Commissioner to be desirable having regard to the interests of data subjects and others, including compliance with the requirements of the data protection legislation;
- “*trade association*” includes a body representing controllers or processors.
##### 124B
- (1) This section applies where a code is prepared under section 121, 122, 123, 124 or 124A, subject to subsection (11).
- (2) The Commissioner must establish a panel of individuals to consider the code.
- (3) The panel must consist of—
- (a) individuals the Commissioner considers have expertise in the subject matter of the code, and
- (b) individuals the Commissioner considers—
- (i) are likely to be affected by the code, or
- (ii) represent persons likely to be affected by the code.
- (4) Before the panel begins to consider the code, the Commissioner must—
- (a) publish the code in draft, and
- (b) publish a statement that—
- (i) states that a panel has been established to consider the code,
- (ii) identifies the members of the panel,
- (iii) explains the process by which they were selected, and
- (iv) explains the reasons for their selection.
- (5) Where at any time it appears to the Commissioner that a member of the panel is not willing or able to serve as a member of the panel, the Commissioner may select another individual to be a member of the panel.
- (6) Where the Commissioner selects an individual to be a member of the panel under subsection (5), the Commissioner must publish a statement that—
- (a) identifies the member of the panel,
- (b) explains the process by which the member was selected, and
- (c) explains the reasons for the member’s selection.
- (7) The Commissioner must make arrangements—
- (a) for the members of the panel to consider the code with one another (whether in person or otherwise), and
- (b) for the panel to prepare and submit to the Commissioner a report on the code within such reasonable period as is determined by the Commissioner.
- (8) If the panel submits to the Commissioner a report on the code within the period determined by the Commissioner, the Commissioner must as soon as reasonably practicable—
- (a) make any alterations to the code that the Commissioner considers appropriate in the light of the report, and
- (b) publish—
- (i) the code in draft,
- (ii) the report or a summary of it, and
- (iii) in a case where a recommendation in the report to alter the code has not been accepted by the Commissioner, an explanation of why it has not been accepted.
- (9) The Commissioner may pay remuneration and expenses to the members of the panel.
- (10) This section applies in relation to amendments prepared under section 121, 122, 123, 124 or 124A as it applies in relation to codes prepared under those sections, subject to subsection (11).
- (11) The Secretary of State may by regulations provide that this section does not apply, or applies with modifications, in the case of—
- (a) a code prepared under section 124A, or
- (b) an amendment of such a code,
that is specified or described in the regulations.
- (12) Regulations under this section are subject to the negative resolution procedure.
##### 124C
- (1) Where a code is prepared under section 121, 122, 123, 124 or 124A, the Commissioner must carry out and publish an assessment of—
- (a) who would be likely to be affected by the code, and
- (b) the effect the code would be likely to have on them.
- (2) This section applies in relation to amendments prepared under section 121, 122, 123, 124 or 124A as it applies in relation to codes prepared under those sections.
##### 164A
- (1) A data subject may make a complaint to the controller if the data subject considers that, in connection with personal data relating to the data subject, there is an infringement of the UK GDPR or Part 3 of this Act.
- (2) A controller must facilitate the making of complaints under this section by taking steps such as providing a complaint form which can be completed electronically and by other means.
- (3) If a controller receives a complaint under this section, the controller must acknowledge receipt of the complaint within the period of 30 days beginning when the complaint is received.
- (4) If a controller receives a complaint under this section, the controller must without undue delay—
- (a) take appropriate steps to respond to the complaint, and
- (b) inform the complainant of the outcome of the complaint.
- (5) The reference in subsection (4)(a) to taking appropriate steps to respond to the complaint includes—
- (a) making enquiries into the subject matter of the complaint, to the extent appropriate, and
- (b) informing the complainant about progress on the complaint.
##### 164B
- (1) The Secretary of State may by regulations require a controller to notify the Commissioner of the number of complaints made to the controller under section 164A in periods specified or described in the regulations.
- (2) Regulations under this section may provide that a controller is required to make a notification to the Commissioner in respect of a period only in circumstances specified in the regulations.
- (3) Regulations under this section may include—
- (a) provision about a matter listed in subsection (4), or
- (b) provision conferring power on the Commissioner to determine those matters.
- (4) The matters are—
- (a) the form and manner in which a notification must be made,
- (b) the time at which, or period within which, a notification must be made, and
- (c) how the number of complaints made to a controller during a period is to be calculated.
- (5) Regulations under this section are subject to the negative resolution procedure.
## Schedule 12A
#### Number of members
##### 1
- (1) The Commission is not to be regarded—
- (a) as a servant or agent of the Crown, or
- (b) as enjoying any status, immunity or privilege of the Crown.
- (2) The Commission’s property is not to be regarded—
- (a) as property of the Crown, or
- (b) as property held on behalf of the Crown.
##### 2
- (1) The number of members of the Commission is to be determined by the Secretary of State.
- (2) That number must not be—
- (a) less than 3, or
- (b) more than 14.
- (3) The Secretary of State may by regulations substitute a different number for the number for the time being specified in sub-paragraph (2)(b).
- (4) Regulations under this paragraph are subject to the negative resolution procedure.
##### 3
- (1) The Commission is to consist of—
- (a) the non-executive members, and
- (b) the executive members.
- (2) The non-executive members are—
- (a) a chair appointed by His Majesty by Letters Patent on the recommendation of the Secretary of State, and
- (b) such other members as the Secretary of State may appoint.
- (3) The executive members are—
- (a) a chief executive appointed by the non-executive members or in accordance with paragraph 25, and
- (b) such other members, if any, as the non-executive members may appoint.
- (4) The Secretary of State must consult the chair of the Commission before appointing a non-executive member.
- (5) The non-executive members must consult the Secretary of State before appointing the chief executive.
- (6) The non-executive members must consult the chief executive about whether there should be any executive members within sub-paragraph (3)(b) and, if so, how many there should be.
- (7) The Secretary of State may by direction set a maximum and a minimum number of executive members.
- (8) The Commission may appoint one of the non-executive members as a deputy to the chair.
##### 4
The Secretary of State must exercise the powers conferred on the Secretary of State by paragraphs 2 and 3 so as to secure that the number of non-executive members of the Commission is, so far as practicable, at all times greater than the number of executive members.
##### 5
- (1) The Secretary of State may not recommend a person for appointment as the chair of the Commission unless the person has been selected on merit on the basis of fair and open competition.
- (2) A person may not be appointed as a member of the Commission unless the person has been selected on merit on the basis of fair and open competition.
##### 6
- (1) Before—
- (a) recommending a person for appointment as the chair of the Commission, or
- (b) appointing a person as a non-executive member of the Commission,
the Secretary of State must be satisfied that the person does not have a conflict of interest.
- (2) The Secretary of State must check from time to time that none of the non-executive members has a conflict of interest.
- (3) The Secretary of State may require a non-executive member to provide whatever information the Secretary of State considers necessary for the purpose of checking that the member does not have a conflict of interest.
- (4) A non-executive member who is required to provide information under sub-paragraph (3) must provide it within such period as may be specified by the Secretary of State.
- (5) In this Schedule, “*conflict of interest*”, in relation to a person, means a financial or other interest which is likely to affect prejudicially the discharge by the person of the person’s functions as a member of the Commission.
##### 7
- (1) The chair of the Commission holds and vacates office in accordance with the terms of the chair’s appointment, subject to the provisions of this paragraph.
- (2) The chair must be appointed for a term of not more than 7 years.
- (3) On the recommendation of the Secretary of State, His Majesty may by Letters Patent extend the term of the chair’s appointment but not so the term as extended is more than 7 years.
- (4) A person cannot be appointed as the chair more than once.
- (5) The chair may be relieved from office by His Majesty at the chair’s own request.
- (6) The chair may be removed from office by His Majesty on an Address from both Houses of Parliament.
- (7) No motion is to be made in either House of Parliament for such an Address unless the Secretary of State has presented a report to that House stating that the Secretary of State is satisfied that—
- (a) the chair is guilty of serious misconduct,
- (b) the chair has a conflict of interest (see paragraph 6(5)),
- (c) the chair has failed to comply with paragraph 6(4), or
- (d) the chair is unable, unfit or unwilling to carry out the chair’s functions.
##### 8
- (1) A deputy chair of the Commission may resign that office by giving written notice to the Commission.
- (2) A deputy chair of the Commission ceases to hold that office on ceasing to be a non-executive member of the Commission.
- (3) A deputy chair of the Commission may be removed from that office by the Commission.
##### 9
- (1) This paragraph applies to a non-executive member of the Commission appointed by the Secretary of State.
- (2) The member holds and vacates office in accordance with the terms of their appointment, subject to the provisions of this paragraph.
- (3) The member must be appointed for a term of not more than 7 years.
- (4) The Secretary of State may extend the term of the member’s appointment but not so that the term as extended is more than 7 years.
- (5) The Secretary of State may not appoint the member as a non-executive member of the Commission on a subsequent occasion.
- (6) The member may resign from office by giving written notice to the Secretary of State and the Commission.
- (7) The Secretary of State may remove the member from office by written notice if satisfied that—
- (a) the member is guilty of serious misconduct,
- (b) the member has a conflict of interest (see paragraph 6(5)),
- (c) the member has failed to comply with paragraph 6(4), or
- (d) the member is unable, unfit or unwilling to carry out the member’s functions.
- (8) At the time of removing the member from office the Secretary of State must make public the decision to do so.
- (9) The Secretary of State must—
- (a) give the member a statement of reasons for the removal, and
- (b) if asked to do so by the member, publish the statement.
##### 10
- (1) The Commission may pay to the non-executive members of the Commission such remuneration and allowances as the Secretary of State may determine.
- (2) The Commission may pay, or make provision for paying, to or in respect of the non-executive members of the Commission, such sums by way of pensions, allowances or gratuities (including pensions, allowances or gratuities paid by way of compensation in respect of loss of office) as the Secretary of State may determine.
- (3) The Commission may make a payment to a person of such amount as the Secretary of State may determine where—
- (a) the person ceases to be a non-executive member of the Commission otherwise than on the expiry of the person’s term of office, and
- (b) it appears to the Secretary of State that there are special circumstances which make it appropriate for the person to receive compensation.
##### 11
- (1) The executive members of the Commission are to be employees of the Commission.
- (2) The executive members are to be employed by the Commission on such terms and conditions, including those as to remuneration, as the non-executive members of the Commission may determine.
- (3) The Commission must—
- (a) pay to or in respect of the executive members of the Commission such pensions, allowances or gratuities (including pensions, allowances or gratuities paid by way of compensation in respect of loss of office) as the non-executive members of the Commission may determine, and
- (b) provide and maintain for them such pension schemes (whether contributory or not) as the non-executive members of the Commission may determine.
##### 12
- (1) The Commission may—
- (a) appoint other employees, and
- (b) make such other arrangements for the staffing of the Commission as it considers appropriate.
- (2) In appointing an employee, the Commission must have regard to the principle of selection on merit on the basis of fair and open competition.
- (3) Employees appointed by the Commission are to be appointed on such terms and conditions, including those as to remuneration, as the Commission may determine.
- (4) The Commission may—
- (a) pay to or in respect of those employees such pensions, allowances or gratuities (including pensions, allowances or gratuities paid by way of compensation in respect of loss of employment) as the Commission may determine, and
- (b) provide and maintain for them such pension schemes (whether contributory or not) as the Commission may determine.
##### 13
- (1) The Commission may establish committees.
- (2) A committee of the Commission may consist of or include persons who are neither members nor employees of the Commission.
- (3) But a committee of the Commission to which functions are delegated under paragraph 14(1)(c) must include at least one person who is either a member or an employee of the Commission.
- (4) Where a person who is neither a member nor an employee of the Commission is a member of a committee of the Commission, the Commission may pay to that person such remuneration and expenses as it may determine.
##### 14
- (1) The Commission may delegate any of its functions to—
- (a) a member of the Commission,
- (b) an employee of the Commission, or
- (c) a committee of the Commission.
- (2) A function is delegated under sub-paragraph (1) to the extent and on the terms that the Commission determines.
- (3) A committee of the Commission may delegate any function delegated to it to a member of the committee.
- (4) A function is delegated under sub-paragraph (3) to the extent and on the terms that the committee determines.
- (5) The power of a committee of the Commission to delegate a function, and to determine the extent and terms of the delegation, is subject to the Commission’s power to direct what a committee established by it may and may not do.
- (6) The delegation of a function by the Commission or a committee of the Commission under this paragraph does not prevent the Commission or the committee from exercising that function.
##### 15
The Commission may require a committee of the Commission to give the Commission advice about matters relating to the discharge of the Commission’s functions.
##### 16
- (1) The Commission may make arrangements for regulating—
- (a) its own procedure, and
- (b) the procedure of a committee of the Commission.
- (2) The non-executive members of the Commission may by majority make arrangements for regulating the procedure for the carrying out of the separate functions which are conferred on them under this Schedule.
- (3) Arrangements under this paragraph may include arrangements as to quorum and the making of decisions by a majority.
- (4) The Commission must publish arrangements which it makes under this paragraph.
- (5) This paragraph is subject to paragraph 18.
##### 17
The Commission must make arrangements for the keeping of proper records of—
- (a) its proceedings,
- (b) the proceedings of a committee of the Commission,
- (c) the proceedings at a meeting of the non-executive members of the Commission,
- (d) anything done by a member or employee of the Commission under paragraph 14(1), and
- (e) anything done by a member of a committee of the Commission under paragraph 14(3).
##### 18
- (1) This paragraph applies if—
- (a) a member of the Commission has a direct or indirect interest in a matter falling to be considered at a meeting of the Commission,
- (b) a non-executive member of the Commission has a direct or indirect interest in a matter falling to be considered at a meeting of the non-executive members, or
- (c) a member of a committee of the Commission has a direct or indirect interest in a matter falling to be considered at a meeting of the committee.
- (2) The member with the interest must declare it.
- (3) The declaration must be recorded in the minutes of the meeting.
- (4) The member with the interest may not take part in a discussion or decision at the meeting relating to the matter, unless—
- (a) in the case of a meeting of the Commission, the other members of the Commission who are present have resolved unanimously that the interest is to be disregarded,
- (b) in the case of a meeting of the non-executive members, the other non-executive members who are present have resolved unanimously that the interest is to be disregarded, or
- (c) in the case of a meeting of a committee, the other members of the committee who are present have, in the manner authorised by the Commission, resolved that the interest is to be disregarded.
- (5) In giving authorisation for the purposes of sub-paragraph (4)(c), the Commission must secure that a resolution for those purposes does not allow a member to take part in a discussion or decision at a meeting of a committee to which functions are delegated under paragraph 14(1)(c) unless the number of other members of the committee in favour of the resolution—
- (a) is not less than two thirds of those who are both present and entitled to vote on the resolution, and
- (b) is not less than its quorum.
- (6) For the purposes of this paragraph, a notification given at or sent to a meeting of the Commission that a person—
- (a) is a member of a company or firm, and
- (b) is to be regarded as interested in any matter involving that company or firm,
is to be regarded as compliance with sub-paragraph (2) in relation to any such matter for the purposes of that meeting and subsequent meetings of the Commission, of the non-executive members or of a committee.
- (7) For the purposes of this paragraph, a notification given at or sent to a meeting of the non-executive members of the Commission or of a committee of the Commission that—
- (a) a person is a member of a company or firm, and
- (b) is to be regarded as interested in any matter involving that company or firm,
is to be regarded as compliance with sub-paragraph (2) in relation to any such matter for the purposes of that meeting and subsequent meetings of the non-executive members or (as the case may be) of the committee.
- (8) A notification described in sub-paragraph (6) or (7) remains in force until it is withdrawn.
- (9) A person required to make a declaration for the purposes of this paragraph in relation to any meeting—
- (a) is not required to attend the meeting, but
- (b) is to be taken to have complied with the requirements of this paragraph if the person takes reasonable steps to secure that notice of the person’s interest is read out, and taken into consideration, at the meeting in question.
##### 19
- (1) The validity of proceedings of the Commission, of the non-executive members of the Commission or of a committee of the Commission is not affected by—
- (a) a vacancy in the membership of the Commission or of the committee,
- (b) a defect in the appointment of a member of the Commission,
- (c) a failure of the Secretary of State to comply with the requirements of paragraph 4, or
- (d) a failure to comply with arrangements under paragraph 16 or with a requirement under paragraph 18.
- (2) Nothing in sub-paragraph (1)(d) validates proceedings of a meeting which is inquorate unless it is inquorate by reason only of a matter within sub-paragraph (1)(b) or (c).
##### 20
The Secretary of State may make payments to the Commission.
##### 21
- (1) All fees, charges, penalties and other sums received by the Commission in carrying out its functions are to be paid to the Secretary of State.
- (2) Sub-paragraph (1) does not apply where the Secretary of State otherwise directs.
- (3) Any sums received by the Secretary of State under this paragraph are to be paid into the Consolidated Fund.
##### 22
- (1) The Commission must keep proper accounts and proper records in relation to them.
- (2) The Commission must prepare a statement of accounts in respect of each financial year in the form specified by the Secretary of State.
- (3) The Commission must send a copy of each statement of accounts to the Secretary of State and the Comptroller and Auditor General before the end of August next following the financial year to which the statement relates.
- (4) The Comptroller and Auditor General must—
- (a) examine, certify and report on the statement of accounts, and
- (b) send a copy of the certified statement and the report to the Secretary of State.
- (5) The Secretary of State must lay before Parliament each document received under sub-paragraph (4)(b).
- (6) In this paragraph “*financial year*” means—
- (a) the period beginning with the date on which the Commission is established and ending with the 31 March following that date, and
- (b) each successive period of 12 months.
##### 23
- (1) The application of the Commission’s seal must be authenticated by the signature of—
- (a) the chair of the Commission, or
- (b) another person authorised for that purpose by the Commission.
- (2) A document purporting to be duly executed under the Commission’s seal or signed on its behalf—
- (a) is to be received in evidence, and
- (b) is to be taken to be executed or signed in that way, unless the contrary is shown.
- (3) This paragraph does not extend to Scotland.
##### 24
The Commission may do anything it thinks appropriate for the purposes of, or in connection with, its functions.
##### 25
- (1) The first chief executive of the Commission is to be appointed by the chair of the Commission.
- (2) Before making the appointment the chair must consult the Secretary of State.
- (3) The appointment must be for a term of not more than 2 years.
- (4) The chair may extend the term of the appointment but not so the term as extended is more than 2 years.
- (5) For the term of appointment, the person appointed under sub-paragraph (1) is “the interim chief executive”.
- (6) Until the expiry of the term of appointment, the powers conferred on the non-executive members by paragraph 11(2) and (3) are exercisable in respect of the interim chief executive by the chair (instead of by the non-executive members).
- (7) In sub-paragraphs (5) and (6), the references to the term of appointment are to the term of appointment described in sub-paragraph (3), including any extension of the term under sub-paragraph (4).
##### 26
In this Schedule—
- (a) references to pensions, allowances or gratuities include references to any similar benefits provided on death or retirement, and
- (b) references to the payment of pensions, allowances or gratuities to or in respect of a person include references to the making of payments towards the provision of pensions, allowances or gratuities to be paid to or in respect of a person.
#### Merger of the directly applicable GDPR and the applied GDPR
##### 1
In this Schedule, “*the applied GDPR*” means the EU GDPR as applied by Chapter 3 of Part 2 before IP completion day.
## Part 2 — Continuation of existing acts etc
##### 2
- (1) On and after IP completion day, references in an enactment to the UK GDPR (including the reference in the definition of “the data protection legislation” in section 3(9)) include—
- (a) the EU GDPR as it was directly applicable to the United Kingdom before IP completion day, read with Chapter 2 of Part 2 of this Act as it had effect before IP completion day, and
- (b) the applied GDPR, read with Chapter 3 of Part 2 of this Act as it had effect before IP completion day.
- (2) On and after IP completion day, references in an enactment to, or to a provision of, Chapter 2 of Part 2 of this Act (including general references to this Act or to Part 2 of this Act) include that Chapter or that provision as applied by Chapter 3 of Part 2 of this Act as it had effect before IP completion day.
- (3) Sub-paragraphs (1) and (2) have effect—
- (a) in relation to references in this Act, except as otherwise provided;
- (b) in relation to references in other enactments, unless the context otherwise requires.
##### 3
- (1) Anything done in connection with the EU GDPR as it was directly applicable to the United Kingdom before IP completion day, the applied GDPR or this Act—
- (a) if in force or effective immediately before IP completion day, continues to be in force or effective on and after IP completion day, and
- (b) if in the process of being done immediately before IP completion day, continues to be done on and after IP completion day.
- (2) References in this paragraph to anything done include references to anything omitted to be done.
## Part 3 — Transfers to third countries and international organisations
##### 4
- (1) On and after IP completion day, for the purposes of the UK GDPR and Part 2 of this Act, a transfer of personal data to a third country or an international organisation is based on adequacy regulations if, at the time of the transfer, paragraph 5 specifies, or specifies a description which includes—
- (a) in the case of a third country, the country or a relevant territory or sector within the country, or
- (b) in the case of an international organisation, the organisation.
- (2) Sub-paragraph (1) has effect subject to provision in paragraph 5 providing that only particular transfers to the country, territory, sector or organisation may rely on a particular provision of paragraph 5 for the purposes of sub-paragraph (1).
- (3) The Secretary of State may by regulations—
- (a) repeal sub-paragraphs (1) and (2) and paragraph 5;
- (b) amend paragraph 5 so as to omit a third country, territory, sector or international organisation specified, or of a description specified, in that paragraph;
- (c) amend paragraph 5 so as to replace a reference to, or description of, a third country, territory, sector or organisation with a narrower reference or description, including by specifying or describing particular transfers of personal data and making provision described in sub-paragraph (2).
- (4) Regulations under this paragraph may, among other things——
- (a) identify a transfer of personal data by any means, including by reference to the controller or processor, the recipient, the personal data transferred or the means by which the transfer is made or by reference to relevant legislation, lists or other documents, as they have effect from time to time;
- (b) confer a discretion on a person.
- (5) Regulations under this paragraph are subject to the negative resolution procedure.
- (6) Sub-paragraphs (1) and (2) have effect in addition to section 17A(2) and (3).
##### 5
- (1) The following are specified for the purposes of paragraph 4(1)—
- (a) an EEA state;
- (b) Gibraltar;
- (c) a Union institution, body, office or agency set up by, or on the basis of, the Treaty on the European Union, the Treaty on the Functioning of the European Union or the Euratom Treaty;
- (d) an equivalent institution, body, office or agency set up by, or on the basis of, the Treaties establishing the European Economic Area;
- (e) a third country which is the subject of a decision listed in sub-paragraph (2), other than a decision that, immediately before IP completion day, had been repealed or was suspended;
- (f) a third country, territory or sector within a third country or international organisation which is the subject of an adequacy decision made by the European Commission before IP completion day on the basis of Article 45(3) of the EU GDPR, other than a decision that, immediately before IP completion day, had been repealed or was suspended.
- (2) The decisions mentioned in sub-paragraph (1)(e) are the following—
- (a) Commission Decision [2000/518/EC](https://www.legislation.gov.uk/eudn/2000/518) of 26th July 2000 pursuant to Directive [95/46/EC](https://www.legislation.gov.uk/eudr/1995/46) of the European Parliament and of the Council on the adequate protection of personal data provided in Switzerland;
- (b) Commission Decision [2002/2/EC](https://www.legislation.gov.uk/eudn/2002/2) of 20th December 2001 pursuant to Directive [95/46/EC](https://www.legislation.gov.uk/eudr/1995/46) of the European Parliament and of the Council on the adequate protection of personal data provided by the Canadian Personal Information Protection and Electronic Documents Act;
- (c) Commission Decision [2003/490/EC](https://www.legislation.gov.uk/eudn/2003/490) of 30th June 2003 pursuant to Directive [95/46/EC](https://www.legislation.gov.uk/eudr/1995/46) of the European Parliament and of the Council on the adequate protection of personal data in Argentina;
- (d) Commission Decision [2003/821/EC](https://www.legislation.gov.uk/eudn/2003/821) of 21st November 2003 on the adequate protection of personal data in Guernsey;
- (e) Commission Decision [2004/411/EC](https://www.legislation.gov.uk/eudn/2004/411) of 28th April 2004 on the adequate protection of personal data in the Isle of Man;
- (f) Commission Decision [2008/393/EC](https://www.legislation.gov.uk/eudn/2008/393) of 8th May 2008 pursuant to Directive [95/46/EC](https://www.legislation.gov.uk/eudr/1995/46) of the European Parliament and of the Council on the adequate protection of personal data in Jersey;
- (g) Commission Decision 2010/146/EU of 5th March 2010 pursuant to Directive [95/46/EC](https://www.legislation.gov.uk/eudr/1995/46) of the European Parliament and of the Council on the adequate protection provided by the Faeroese Act on processing of personal data;
- (h) Commission Decision 2010/625/EU of 19th October 2010 pursuant to Directive [95/46/EC](https://www.legislation.gov.uk/eudr/1995/46) of the European Parliament and of the Council on the adequate protection of personal data in Andorra;
- (i) Commission Decision 2011/61/EU of 31st January 2011 pursuant to Directive [95/46/EC](https://www.legislation.gov.uk/eudr/1995/46) of the European Parliament and of the Council on the adequate protection of personal data by the State of Israel with regard to automated processing of personal data;
- (j) Commission Implementing Decision 2012/484/EU of 21st August 2012 pursuant to Directive [95/46/EC](https://www.legislation.gov.uk/eudr/1995/46) of the European Parliament and of the Council on the adequate protection of personal data by the Eastern Republic of Uruguay with regard to automated processing of personal data;
- (k) Commission Implementing Decision 2013/65/EU of 19th December 2012 pursuant to Directive [95/46/EC](https://www.legislation.gov.uk/eudr/1995/46) of the European Parliament and of the Council on the adequate protection of personal data by New Zealand;
- (m) Commission Implementing Decision (EU) 2019/419 of 23rd January 2019 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by Japan under the Act on the Protection of Personal Information.
- (3) Where a decision described in sub-paragraph (1)(e) or (f) states that an adequate level of protection of personal data is ensured only for a transfer specified or described in the decision, only such a transfer may rely on that provision and that decision for the purposes of paragraph 4(1).
- (4) The references to a decision in sub-paragraphs (1)(e) and (f) and (2) are to the decision as it had effect in EU law immediately before IP completion day, subject to sub-paragraphs (5) and (6).
- (5) For the purposes of this paragraph, where a reference to legislation, a list or another document in a decision described in sub-paragraph (1)(e) or (f) is a reference to the legislation, list or document as it has effect from time to time, it is to be treated as a reference to the legislation, list or other document as it has effect at the time of the transfer.
- (6) For the purposes of this paragraph, where a decision described in sub-paragraph (1)(e) or (f) relates to—
- (a) transfers from the European Union (or the European Community) or the European Economic Area, or
- (b) transfers to which the EU GDPR applies,
it is to be treated as relating to equivalent transfers to or from the United Kingdom or transfers to which the UK GDPR applies (as appropriate).
##### 6
- (1) In the provisions listed in sub-paragraph (2)—
- (a) references to regulations made under section 17A (other than references to making such regulations) include the provision made in paragraph 5;
- (b) references to the revocation of such regulations include the repeal of all or part of paragraph 5.
- (2) Those provisions are—
- (a) Articles 13(1)(f), 14(1)(f), 45(1) and (7), 46(1) and 49(1) of the UK GDPR;
- (b) sections 17B(1), (3), (6) and (7) and 18(2) of this Act.
##### 7
- (1) Subject to paragraph 8, the appropriate safeguards referred to in Article 46(1) of the UK GDPR may be provided for on and after IP completion day as described in this paragraph.
- (2) The safeguards may be provided for by any standard data protection clauses included in an arrangement which, if the arrangement had been entered into immediately before IP completion day, would have provided for the appropriate safeguards referred to in Article 46(1) of the EU GDPR by virtue of Article 46(2)(c) or (d) or (5) of the EU GDPR.
- (3) The safeguards may be provided for by a version of standard data protection clauses described in sub-paragraph (2) incorporating changes where—
- (a) all of the changes are made in consequence of the withdrawal of the United Kingdom from the EU or provision made by regulations under section 8 or 23 of the European Union (Withdrawal) Act 2018 (or both), and
- (b) none of the changes alters the effect of the clauses.
- (4) The following changes are to be treated as falling within sub-paragraph (3)(a) and (b)—
- (a) changing references to adequacy decisions made by the European Commission into references to equivalent provision made by regulations under section 17A or by or under paragraphs 4 to 6 of this Schedule;
- (b) changing references to transferring personal data outside the European Union or the European Economic Area into references to transferring personal data outside the United Kingdom.
- (5) In the case of a transfer of personal data made under arrangements entered into before IP completion day, the safeguards may be provided for on and after IP completion day by standard data protection clauses not falling within sub-paragraph (2) which—
- (a) formed part of the arrangements immediately before IP completion day, and
- (b) at that time, provided for the appropriate safeguards referred to in Article 46(1) of the EU GDPR by virtue of Article 46(2)(c) or (d) or (5) of the EU GDPR.
- (6) The Secretary of State and the Commissioner must keep the operation of this paragraph under review.
- (7) In this paragraph, “*adequacy decision*” means a decision made on the basis of—
- (a) Article 45(3) of the EU GDPR, or
- (b) Article 25(6) of Directive [95/46/EC](https://www.legislation.gov.uk/eudr/1995/46) of the European Parliament and of the Council of 24th October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.
- (8) This paragraph has effect in addition to Article 46(2) and (3) of the UK GDPR.
##### 8
- (1) Paragraph 7 does not apply to the extent that it has been disapplied by—
- (a) regulations made by the Secretary of State, or
- (b) a document issued by the Commissioner.
- (2) Regulations under this paragraph are subject to the negative resolution procedure.
- (3) Subsections (3) to (8) and (10) to (12) of section 119A apply in relation to a document issued by the Commissioner under this paragraph as they apply to a document issued by the Commissioner under section 119A(2).
##### 9
- (1) The appropriate safeguards referred to in Article 46(1) of the UK GDPR may be provided for on and after IP completion day as described sub-paragraphs (2) to (4), subject to sub-paragraph (5).
- (2) The safeguards may be provided for by any binding corporate rules authorised by the Commissioner which, immediately before IP completion day, provided for the appropriate safeguards referred to in Article 46(1) of the EU GDPR by virtue of Article 46(5) of the EU GDPR.
- (3) The safeguards may be provided for by a version of binding corporate rules described in sub-paragraph (2) incorporating changes where—
- (a) all of the changes are made in consequence of the withdrawal of the United Kingdom from the EU or provision made by regulations under section 8 or 23 of the European Union (Withdrawal) Act 2018 (or both), and
- (b) none of the changes alters the effect of the rules.
- (4) The following changes are to be treated as falling within sub-paragraph (3)(a) and (b)—
- (a) changing references to adequacy decisions made by the European Commission into references to equivalent provision made by regulations under section 17A or by or under paragraphs 4 to 6 of this Schedule;
- (b) changing references to transferring personal data outside the European Union or the European Economic Area into references to transferring personal data outside the United Kingdom.
- (5) Sub-paragraphs (2) to (4) cease to apply in relation to binding corporate rules if, on or after IP completion day, the Commissioner withdraws the authorisation of the rules (or, where sub-paragraph (3) is relied on, the authorisation of the rules mentioned in sub-paragraph (2)).
- (5A) For the purposes of sub-paragraph (2), binding corporate rules which, immediately before IP completion day, provided for the appropriate safeguards referred to in Article 46(1) of the EU GDPR by virtue of Article 46(5) of the EU GDPR but which were authorised other than by the Commissioner are to be treated as authorised by the Commissioner where—
- (a) a valid notification of the rules has been made to the Commissioner,
- (b) the Commissioner has approved them, and
- (c) that approval has not been withdrawn.
- (5B) A notification is valid if it—
- (a) is made by a controller or processor established in the United Kingdom,
- (b) is made to the Commissioner before the end of the period of 6 months beginning with IP completion day, and
- (c) includes—
- (i) the name and contact details of the data protection officer or other contact point for the controller or processor, and
- (ii) such other information as the Commissioner may reasonably require.
- (5C) Where a valid notification is made the Commissioner must, without undue delay—
- (a) decide whether or not to approve the rules, and
- (b) notify the controller or processor of that decision.
- (6) The Commissioner must keep the operation of this paragraph under review.
- (7) In this paragraph—
- “*adequacy decision*” means a decision made on the basis of—Article 45(3) of the EU GDPR, orArticle 25(6) of Directive [95/46/EC](https://www.legislation.gov.uk/eudr/1995/46) of the European Parliament and of the Council of 24th October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data;
- “*binding corporate rules*” has the meaning given in Article 4(20) of the UK GDPR.
- (8) This paragraph has effect in addition to Article 46(2) and (3) of the UK GDPR.
##### 10
- (1) On and after IP completion day, for the purposes of Part 3 of this Act, a transfer of personal data to a third country or an international organisation is based on adequacy regulations if, at the time of the transfer, paragraph 11 specifies, or specifies a description which includes—
- (a) in the case of a third country, the country or a relevant territory or sector within the country, or
- (b) in the case of an international organisation, the organisation.
- (2) Sub-paragraph (1) has effect subject to provision in paragraph 11 providing that only particular transfers to the country, territory, sector or organisation may rely on a particular provision of paragraph 11 for the purposes of sub-paragraph (1).
- (3) The Secretary of State may by regulations—
- (a) repeal sub-paragraphs (1) and (2) and paragraph 11;
- (b) amend paragraph 11 so as to omit a third country, territory, sector or international organisation specified, or of a description specified, in that paragraph;
- (c) amend paragraph 11 so as to replace a reference to, or description of, a third country, territory, sector or organisation with a narrower reference or description, including by specifying or describing particular transfers of personal data and by making provision described in sub-paragraph (2).
- (4) Regulations under this paragraph may, among other things—
- (a) identify a transfer of personal data by any means, including by reference to the controller or processor, the recipient, the personal data transferred or the means by which the transfer is made or by reference to relevant legislation, lists or other documents, as they have effect from time to time;
- (b) confer a discretion on a person.
- (5) Regulations under this paragraph are subject to the negative resolution procedure.
- (6) Sub-paragraphs (1) and (2) have effect in addition to section 74A(2) and (3).
##### 11
- (1) The following are specified for the purposes of paragraph 10(1)—
- (a) an EEA state;
- (aa) Switzerland;
- (b) Gibraltar;
- (c) a third country, a territory or sector within a third country or an international organisation which is the subject of an adequacy decision made by the European Commission before IP completion day on the basis of Article 36(3) of the Law Enforcement Directive, other than a decision that, immediately before IP completion day, had been repealed or was suspended.
- (2) Where a decision described in sub-paragraph (1)(c) states that an adequate level of protection of personal data is ensured only for a transfer specified or described in the decision, only such a transfer may rely on that provision and that decision for the purposes of paragraph 10(1).
- (3) The reference to a decision in sub-paragraph (1)(c) is to the decision as it had effect in EU law immediately before IP completion day, subject to sub-paragraphs (4) and (5).
- (4) For the purposes of this paragraph, where a reference to legislation, a list or another document in a decision described in sub-paragraph (1)(c) is a reference to the legislation, list or document as it has effect from time to time, it is to be treated as a reference to the legislation, list or other document as it has effect at the time of the transfer.
- (5) For the purposes of this paragraph, where a decision described in sub-paragraph (1)(c) relates to—
- (a) transfers from the European Union (or the European Community) or the European Economic Area, or
- (b) transfers to which the Law Enforcement Directive applies,
it is to be treated as relating to equivalent transfers from the United Kingdom or transfers to which Part 3 of this Act applies (as appropriate).
##### 12
In section 74B(1), (3), (6) and (7)—
- (a) references to regulations made under section 74A (other than references to making such regulations) include the provision made in paragraph 11;
- (b) references to the revocation of such regulations include the repeal of all or part of paragraph 11.
## Part 4 — Repeal of provisions in Chapter 3 of Part 2
##### 13
- (1) Regulations made under section 23 before IP completion day continue in force until they are revoked, despite the repeal of that section by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019.
- (2) The provisions listed in section 186(3) include regulations made under section 23 before IP completion day (and not revoked).
- (3) Sub-paragraphs (1) and (2) do not have effect so far as otherwise provided by the law of England and Wales, Scotland or Northern Ireland.
##### 14
- (1) This paragraph applies to a certificate issued under section 27 of this Act which has effect immediately before IP completion day.
- (2) A reference in the certificate to a provision of the applied GDPR has effect, on and after IP completion day, as it if were a reference to the corresponding provision of the UK GDPR or this Act.
## Part 5 — The Information Commissioner
##### 15
The repeal of section 132(2)(d) by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 has effect only in relation to a disclosure of information made on or after IP completion day.
## Part 6 — Enforcement
##### 16
In relation to an infringement, before IP completion day, of a provision of the EU GDPR (as it was directly applicable to the United Kingdom) or the applied GDPR—
- (a) Article 83(5) and (6) of the UK GDPR and section 157(5)(a) and (b) of this Act have effect as if for “£17,500,000” there were substituted “ 20 million Euros ”;
- (b) Article 83(4) of the UK GDPR and section 157(6)(a) and (b) of this Act have effect as if for “£8,700,000” there were substituted “ 10 million Euros ”;
- (c) the maximum amount of a penalty in sterling must be determined by applying the spot rate of exchange set by the Bank of England on the day on which the penalty notice is given under section 155 of this Act.
#### The applied GPDR
##### 17
- (1) This paragraph applies where—
- (a) proceedings are brought against a decision made by the Commissioner before IP completion day, and
- (b) the Commissioner's decision was preceded by an opinion or decision of the European Data Protection Board in accordance with the consistency mechanism referred to in Article 63 of the EU GDPR.
- (2) The Commissioner must forward the Board's opinion or decision to the court or tribunal dealing with the proceedings.
### Immigration: safeguards: immigration exemption decisions
##### 4A
- (1) A decision under paragraph 4(1) as to whether, and the extent to which, the application of the relevant UK GDPR provisions would be likely to prejudice any of the matters mentioned in paragraph 4(1)(a) and (b) (referred to in this paragraph as “*an immigration exemption decision*”) must be made in accordance with this paragraph.
- (2) An immigration exemption decision must be made—
- (a) on a case by case basis,
- (b) separately in respect of each of the relevant UK GDPR provisions mentioned in paragraph 4(2)(a) to (f) which relates to the data subject, and
- (c) afresh on each occasion on which the Secretary of State considers disapplying or restricting the application of any of the relevant UK GDPR provisions mentioned in paragraph 4(2)(a) to (f) in relation to the data subject.
- (3) When making an immigration exemption decision, the Secretary of State must take into account all the circumstances of the case, including at least the following—
- (a) any potential vulnerability of the data subject that is relevant to the decision,
- (b) all the rights and freedoms of the data subject including the data subject’s Convention rights, and
- (c) any relevant duties or obligations of the United Kingdom, the Secretary of State or any other person, including—
- (i) the United Kingdom’s obligations under the Refugee Convention and the Trafficking Convention,
- (ii) any duty under section 55 of the Borders, Citizenship and Immigration Act 2009 (duty regarding the welfare of children), and
- (iii) the need to ensure compliance with the UK GDPR.
- (4) A decision that the application of a particular relevant UK GDPR provision mentioned in paragraph 4(2)(a) to (f) (or that provision in combination with the provision mentioned in paragraph 4(2)(g), so far as it applies) would be likely to prejudice any of the matters mentioned in paragraph 4(1)(a) and (b) may be made only if—
- (a) the application of that provision or those provisions would give rise to a substantial risk of prejudice to any of the matters mentioned in paragraph 4(1)(a) and (b),
- (b) that risk outweighs the risk of prejudice to the interests of the data subject concerned that would arise if the exemption in paragraph 4(1) were to apply in relation to that provision or those provisions, and
- (c) the application of the exemption in relation to that provision or those provisions is necessary and proportionate to the risks in the particular case.
- (5) In this paragraph—
- “*Convention rights*” has the same meaning as in the Human Rights Act 1998 (see section 1(1) of that Act);
- “*the Refugee Convention*” means the Convention relating to the Status of Refugees, done at Geneva on 28 July 1951, and its Protocol;
- “*the Trafficking Convention*” means the Council of Europe Convention on Action against Trafficking in Human Beings, done at Warsaw on 16 May 2005.
### Immigration: safeguard: record of decision that exemption applies
##### 4B
- (1) Where the Secretary of State makes a decision mentioned in paragraph 4A(4), the Secretary of State must keep a record of it and the reasons for it.
- (2) Where sub-paragraph (1) applies, the Secretary of State must also inform the data subject of the decision unless, in the particular circumstances of the case, the Secretary of State considers that doing so may be prejudicial to any of the matters mentioned in paragraph 4(1)(a) and (b).
##### 15A
The Provost Marshal for serious crime.
##### 18A
The Service Police Complaints Commissioner.
#### The applied GPDR
#### GDPR: right to an effective remedy against the Commissioner
#### GDPR: right to an effective remedy against the Commissioner
##### 183B
- (1) This section is about the relationship between—
- (a) a pre-commencement enactment which imposes a duty, or confers a power, to process personal data, and
- (b) a provision of the main data protection legislation containing a requirement relating to the processing of personal data.
- (2) The relationship is not changed by section 5(A1) of the European Union (Withdrawal) Act 2018 (removal of the principle of supremacy of EU law) (or the repeal of section 5(1) to (3) of that Act).
- (3) Where the provision described in subsection (1)(b) is a provision of, or made under, the UK GDPR, section 5(A2) of the European Union (Withdrawal) Act 2018 (assimilated direct legislation subject to domestic enactments) does not apply to the relationship.
- (4) Nothing is to be implied about a relationship described in subsection (1) merely due to the fact that express provision with similar effect to section 183A(1) (or applying that provision) is made in connection with one such relationship but not another.
- (5) In this section—
- (a) “*the main data protection legislation*” and “*requirement*” have the same meaning as in section 183A, and
- (b) “*pre-commencement enactment*” means an enactment so far as passed or made before 20th August 2025.
- (6) Section 183A(5) applies for the purposes of subsection (1)(a) of this section as it applies for the purposes of section 183A(1).
##### 186A
- (1) This section is about the relationship between—
- (a) a pre-commencement enactment which prohibits or restricts the disclosure of information or authorises the withholding of information, and
- (b) a provision of the UK GDPR or this Act listed in section 186(2).
- (2) The relationship is not changed by section 5(A1) of the European Union (Withdrawal) Act 2018 (removal of the principle of supremacy of EU law) (or the repeal of section 5(1) to (3) of that Act).
- (3) Subsection (1) of section 186 does not apply to the relationship so far as there is a contrary intention, whether express or implied (taking account of, among other things, subsection (2) of this section).
- (4) Nothing is to be implied about a relationship described in subsection (1) merely due to the fact that express provision stating that section 186(1) applies (or with similar effect) is made in connection with one such relationship but not another.
- (5) In this section, “*pre-commencement enactment*” means an enactment so far as passed or made before 20th August 2025, other than an enactment contained in, or made under, a provision listed in section 186(2) or (3).
#### Overview
### Relevant international law
##### 9A
- (1) Processing of personal data meets the requirement in Article 6(3), 8A(3)(e), 9(2)(g) or 10(1) of the UK GDPR for a basis in, or authorisation by, relevant international law only if it meets a condition in Schedule A1.
- (2) A condition in Schedule A1 may be relied on for the purposes of any of those provisions, unless that Schedule provides otherwise.
- (3) The Secretary of State may by regulations amend Schedule A1 by adding, varying or omitting—
- (a) conditions,
- (b) provision about the purposes for which a condition may be relied on, and
- (c) safeguards in connection with processing carried out in reliance on a condition in the Schedule.
- (4) Regulations under this section may only add a condition relating entirely or partly to a treaty ratified by the United Kingdom.
- (5) Regulations under this section are subject to the affirmative resolution procedure.
- (6) In this section, “*treaty*” and “*ratified*” have the same meaning as in Part 2 of the Constitutional Reform and Governance Act 2010 (see section 25 of that Act).
#### Special categories of personal data etc: supplementary
#### Manual unstructured data used in longstanding historical research
##### 42A
- (1) The Secretary of State may by regulations—
- (a) make provision so that an additional description of processing of personal data is sensitive processing for the purposes of this Part,
- (b) make provision so that added processing is not sensitive processing for the purposes of this Part,
- (c) make provision so that a protected condition in Schedule 8 may or may not be relied on in connection with added processing, and
- (d) make provision varying such a condition as it relates to added processing.
- (2) In subsection (1)—
- “*added processing*” means a description of processing which is sensitive processing by virtue of provision made under subsection (1)(a);
- “*protected condition in Schedule 8*” means a condition in that Schedule other than one that was added to the Schedule by regulations under section 35(6).
- (3) Regulations under this section may amend this Part and sections 205 and 206.
- (4) Regulations under this section are subject to the affirmative resolution procedure.
##### 50A
- (1) For the purposes of sections 50B and 50C—
- (a) a decision is based solely on automated processing if there is no meaningful human involvement in the taking of the decision, and
- (b) a decision is a significant decision, in relation to a data subject, if—
- (i) it produces an adverse legal effect for the data subject, or
- (ii) it has a similarly significant adverse effect for the data subject.
- (2) When considering whether there is meaningful human involvement in the taking of a decision, a person must consider, among other things, the extent to which the decision is reached by means of profiling.
##### 50B
- (1) A significant decision based entirely or partly on sensitive processing may not be taken based solely on automated processing, unless one of the following conditions is met.
- (2) The first condition is that the decision is based entirely on processing of personal data to which the data subject has given explicit consent.
- (3) The second condition is that the decision is required or authorised by law.
##### 50C
- (1) Subject to subsection (3), where a significant decision taken by or on behalf of a controller in relation to a data subject is—
- (a) based entirely or partly on personal data, and
- (b) based solely on automated processing,
the controller must ensure that safeguards for the data subject’s rights, freedoms and legitimate interests are in place which comply with subsection (2) and any regulations under section 50D(4).
- (2) The safeguards must consist of or include measures which—
- (a) provide the data subject with information about decisions described in subsection (1) taken in relation to the data subject;
- (b) enable the data subject to make representations about such decisions;
- (c) enable the data subject to obtain human intervention on the part of the controller in relation to such decisions;
- (d) enable the data subject to contest such decisions.
- (3) Subsections (1) and (2) do not apply in relation to a significant decision if—
- (a) exemption from those provisions is required for a reason listed in subsection (4),
- (b) the controller reconsiders the decision as soon as reasonably practicable, and
- (c) there is meaningful human involvement in the reconsideration of the decision.
- (4) Those reasons are—
- (a) to avoid obstructing an official or legal inquiry, investigation or procedure;
- (b) to avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;
- (c) to protect public security;
- (d) to safeguard national security;
- (e) to protect the rights and freedoms of others.
- (5) When considering whether there is meaningful human involvement in the reconsideration of a decision, a person must consider, among other things, the extent to which the conclusion reached on reconsideration is reached by means of profiling.
##### 50D
- (1) The Secretary of State may by regulations provide that, for the purposes of sections 50A(1)(a) and 50C(3)(c), there is, or is not, to be taken to be meaningful human involvement in the taking or reconsideration of a decision in cases described in the regulations.
- (2) The Secretary of State may by regulations provide that, for the purposes of section 50A(1)(b)(ii), a description of decision is, or is not, to be taken to have a similarly significant adverse effect for the data subject.
- (3) Regulations under subsection (1) or (2) may amend section 50A.
- (4) The Secretary of State may by regulations make the following types of provision about the safeguards required under section 50C(1)—
- (a) provision requiring the safeguards to include measures in addition to those described in section 50C(2),
- (b) provision imposing requirements which supplement what section 50C(2) requires the safeguards to consist of or include (including, for example, provision about how and when things described in section 50C(2) must be done or be capable of being done), and
- (c) provision about measures which are not to be taken to satisfy one or more of paragraphs (a) to (d) of section 50C(2).
- (5) Regulations under this section are subject to the affirmative resolution procedure.
##### 74AA
- (1) For the purposes of section 73, the Secretary of State may by regulations approve transfers of personal data to—
- (a) a third country, or
##### 40A
- (1) This section is about processing of personal data that is carried out in reliance on the consent of the data subject.
- (2) The controller must be able to demonstrate that the data subject consented to the processing.
- (3) If the data subject’s consent is given in writing as part of a document which also concerns other matters, the request for consent must be made—
- (a) in a manner which clearly distinguishes the request from the other matters,
- (b) in an intelligible and easily accessible form, and
- (c) in clear and plain language.
- (4) Any part of a document described in subsection (3) which constitutes an infringement of this Part is not binding.
- (5) The data subject may withdraw the consent at any time (but the withdrawal of consent does not affect the lawfulness of processing in reliance on the consent before its withdrawal).
- (6) Processing may only be carried out in reliance on consent if—
- (a) before the consent is given, the controller or processor informs the data subject of the right to withdraw it, and
- (b) it is as easy for the data subject to withdraw the consent as to give it.
- (7) When assessing whether consent is freely given, account must be taken of, among other things, whether the provision of a service is conditional on consent to the processing of personal data that is not necessary for the provision of that service.
##### 141A
- (1) This section applies in relation to a notice authorised or required by this Act to be given to a person by the Commissioner.
- (2) The notice may be given to the person by—
- (a) delivering it by hand to a relevant individual,
- (b) leaving it at the person’s proper address,
- (c) sending it by post to the person at that address, or
- (d) sending it by email to the person’s email address.
- (3) A “*relevant individual*” means—
- (a) in the case of a notice to an individual, that individual;
- (b) in the case of a notice to a body corporate (other than a partnership), an officer of that body;
- (c) in the case of a notice to a partnership, a partner in the partnership or a person who has the control or management of the partnership business;
- (d) in the case of a notice to an unincorporated body (other than a partnership), a member of its governing body.
- (4) For the purposes of subsection (2)(b) and (c), and section 7 of the Interpretation Act 1978 (services of documents by post) in its application to those provisions, a person’s proper address is—
- (a) in a case where the person has specified an address as one at which the person, or someone acting on the person’s behalf, will accept service of notices or other documents, that address;
- (b) in any other case, the address determined in accordance with subsection (5).
- (5) The address is—
- (a) in a case where the person is a body corporate with a registered office in the United Kingdom, that office;
- (b) in a case where paragraph (a) does not apply and the person is a body corporate, partnership or unincorporated body with a principal office in the United Kingdom, that office;
- (c) in any other case, an address in the United Kingdom at which the Commissioner believes, on reasonable grounds, that the notice will come to the attention of the person.
- (6) A person’s email address is—
- (a) an email address published for the time being by that person as an address for contacting that person, or
- (b) if there is no such published address, an email address by means of which the Commissioner believes, on reasonable grounds, that the notice will come to the attention of that person.
- (7) A notice sent by email is treated as given 48 hours after it was sent, unless the contrary is proved.
- (8) In this section, “*officer*”, in relation to a body corporate, means a director, manager, secretary or other similar officer of the body.
- (9) This section does not limit other lawful means of giving a notice.
##### 45A
- (1) Sections 44(2) and 45(1) do not require the controller to give the data subject—
- (a) information in respect of which a claim to legal professional privilege or, in Scotland, confidentiality of communications could be maintained in legal proceedings, or
- (b) information in respect of which a duty of confidentiality is owed by a professional legal adviser to a client of the adviser.
- (2) A controller relying on the exemption in subsection (1) must inform the data subject in writing without undue delay of—
- (a) the decision to rely on the exemption,
- (b) the reason for the decision,
- (c) the data subject’s right to make a request to the Commissioner under section 51,
- (d) the data subject’s right to lodge a complaint with the Commissioner under section 165, and
- (e) the data subject’s right to apply to a court under section 167.
- (3) Subsection (2)(a) and (b) do not apply to the extent that complying with them would—
- (a) undermine a claim described in subsection (1)(a), or
- (b) conflict with a duty described in subsection (1)(b).
- (4) The controller must—
- (a) record the reason for a decision to rely on the exemption in subsection (1), and
- (b) if requested to do so by the Commissioner, make the record available to the Commissioner.
- (5) The reference in subsection (1) to sections 44(2) and 45(1) includes sections 35 to 40 so far as their provisions correspond to the rights and obligations provided for in sections 44(2) and 45(1).
### Codes of conduct
##### 71A
- (1) The Commissioner must encourage expert public bodies to produce codes of conduct intended to contribute to compliance with this Part.
- (2) Under subsection (1), the Commissioner must, among other things, encourage the production of codes which take account of the specific features of the various processing sectors.
- (3) For the purposes of this section—
- (a) “*public body*” means a body or other person whose functions are, or include, functions of a public nature, and
- (b) a public body is “expert” if, in the Commissioner’s opinion, the body has the knowledge and experience needed to produce a code of conduct described in subsection (1).
- (4) A code of conduct described in subsection (1) may, for example, make provision with regard to—
- (a) lawful and fair processing;
- (b) the collection of personal data;
- (c) the information provided to the public and to data subjects;
- (d) the exercise of the rights of data subjects;
- (e) the measures and procedures referred to in sections 56, 57 and 62;
- (f) the notification of personal data breaches to the Commissioner and the communication of personal data breaches to data subjects;
- (g) the transfer of personal data to third countries or international organisations;
- (h) out-of-court proceedings and other dispute resolution procedures for resolving disputes between controllers and data subjects with regard to processing.
- (5) The Commissioner must encourage expert public bodies to submit codes of conduct described in subsection (1) to the Commissioner in draft.
- (6) Where an expert public body does so, the Commissioner must—
- (a) provide the body with an opinion on whether the code correctly reflects the requirements of this Part,
- (b) decide whether to approve the code, and
- (c) if the code is approved, register and publish the code.
- (7) Subsections (5) and (6) apply in relation to amendments of a code of conduct that is for the time being approved under this section as they apply in relation to a code.
##### 78A
- (1) A provision mentioned in subsection (2) does not apply to personal data processed for law enforcement purposes if exemption from the provision is required for the purposes of safeguarding national security.
- (2) The provisions are—
- (a) Chapter 2 of this Part (principles), except for the provisions listed in subsection (3);
- (b) Chapter 3 of this Part (rights of the data subject);
- (c) in Chapter 4 of this Part—
- (i) section 67 (notification of personal data breach to the Commissioner);
- (ii) section 68 (communication of personal data breach to the data subject);
- (d) Chapter 5 of this Part (transfers of personal data to third countries etc), except for the provisions listed in subsection (4);
- (e) in Part 5—
- (i) section 119 (inspection in accordance with international obligations);
- (ia) section 119A (standard clauses for transfers to third countries);
- (ii) in Schedule 13 (other general functions of the Commissioner), paragraphs 1(1)(a) and (g) and 2;
- (f) in Part 6—
- (i) sections 142 to 154 and Schedule 15 (Commissioner’s notices and powers of entry and inspection);
- (ii) sections 170 to 173 (offences relating to personal data);
- (g) in Part 7, section 187 (representation of data subjects).
- (3) The provisions of Chapter 2 of this Part (principles) which are excepted from the list in subsection (2) are—
- (a) section 35(1) (the first data protection principle) so far as it requires processing of personal data to be lawful;
- (b) section 35(2) to (5) (lawfulness of processing and restrictions on sensitive processing);
- (c) section 42 (safeguards: sensitive processing);
- (d) Schedule 8 (conditions for sensitive processing).
- (4) The provisions of Chapter 5 of this Part (transfers of personal data to third countries etc) which are excepted from the list in subsection (2) are—
- (a) the following provisions of section 73—
- (i) subsection (1)(a) (conditions for transfer), so far as it relates to the condition in subsection (2) of that section, and subsection (2) (transfer must be necessary for a law enforcement purpose);
- (ii) subsections (1)(b), (5) and (6) (conditions for transfer of personal data originally made available by a member State);
- (b) section 78 (subsequent transfers).
##### 82A
- (1) For the purposes of this Part, the Secretary of State may give a notice designating processing of personal data by a qualifying competent authority (a “designation notice”) where—
- (a) an application for designation of the processing is made in accordance with this section, and
- (b) the Secretary of State considers that designation of the processing is required for the purposes of safeguarding national security.
- (2) The Secretary of State may only designate processing by a qualifying competent authority that is carried out by the authority as a joint controller with at least one intelligence service.
- (3) The Secretary of State may not designate processing by a qualifying competent authority that consists of the transfer of personal data to—
- (a) a country or territory outside the United Kingdom, or
- (b) an international organisation.
- (2) The Secretary of State may only make regulations under this section approving transfers to a third country or international organisation if the Secretary of State considers that the data protection test is met in relation to the transfers (see section 74AB).
- (3) In making regulations under this section, the Secretary of State may have regard to any matter which the Secretary of State considers relevant, including the desirability of facilitating transfers of personal data to and from the United Kingdom.
- (4) Regulations under this section may, among other things—
- (a) make provision by reference to a third country or international organisation specified in the regulations or a description of country or organisation;
- (b) approve all transfers of personal data to a third country or international organisation or only transfers specified or described in the regulations;
- (c) identify a transfer of personal data by any means, including by reference to—
- (i) a sector or geographic area within a third country,
- (ii) the controller or processor,
- (iii) the recipient of the personal data,
- (iv) the personal data transferred,
- (v) the means by which the transfer is made, or
- (vi) relevant legislation, schemes, lists or other arrangements or documents, as they have effect from time to time;
- (d) confer a discretion on a person.
- (5) Regulations under this section are subject to the negative resolution procedure.
##### 74AB
- (1) For the purposes of section 74AA, the data protection test is met in relation to transfers to a third country or international organisation if the standard of the protection provided for data subjects with regard to law enforcement processing of personal data in the country or by the organisation is not materially lower than the standard of the protection provided for data subjects by or under—
- (a) this Part, and
- (b) Parts 5 to 7, so far as relevant to law enforcement processing.
- (2) In considering whether the data protection test is met in relation to transfers of personal data to a third country or international organisation, the Secretary of State must consider, among other things—
- (a) respect for the rule of law and for human rights in the country or by the organisation,
- (b) the existence, and powers, of an authority responsible for enforcing the protection of data subjects with regard to the processing of personal data in the country or by the organisation,
- (c) arrangements for judicial or non-judicial redress for data subjects in connection with such processing,
- (d) rules about the transfer of personal data from the country or by the organisation to other countries or international organisations,
- (e) relevant international obligations of the country or organisation, and
- (f) the constitution, traditions and culture of the country or organisation.
- (3) In subsections (1) and (2)—
- (a) the references to the protection provided for data subjects are to that protection taken as a whole,
- (b) the references to law enforcement processing are to processing by a competent authority for any of the law enforcement purposes or equivalent types of processing in the third country or by the international organisation (as appropriate), and
- (c) the references to processing of personal data in the third country or by the international organisation are references only to the processing of personal data transferred to the country or organisation by means of processing to which this Act applies as described in section 207(2).
- (4) When the data protection test is applied only to certain transfers to a third country or international organisation that are specified or described, or to be specified or described, in regulations (in accordance with section 74AA(4)(b))—
- (a) the references in subsections (1) to (3) to personal data are to be read as references only to personal data likely to be the subject of such transfers, and
- (b) the reference in subsection (2)(d) to transfer to other countries or international organisations is to be read as including transfer within the third country or international organisation.
##### 91A
- (1) The Secretary of State may by regulations—
- (a) make provision so that an additional description of processing of personal data is sensitive processing for the purposes of this Part,
- (b) make provision so that added processing is not sensitive processing for the purposes of this Part,
- (c) make provision so that a protected condition in Schedule 10 may or may not be relied on in connection with added processing, and
- (d) make provision varying such a condition as it relates to added processing.
- (2) In subsection (1)—
- “*added processing*” means a description of processing which is sensitive processing by virtue of provision made under subsection (1)(a);
- “*protected condition in Schedule 10*” means a condition in that Schedule other than one that was added to the Schedule by regulations under section 86(3).
- (3) Regulations under this section may amend this Part and sections 205 and 206.
- (4) Regulations under this section are subject to the affirmative resolution procedure.
##### 124A
- (1) The Commissioner must prepare appropriate codes of practice giving guidance as to good practice in the processing of personal data if required to do so by regulations made by the Secretary of State.
- (2) Regulations under this section—
- (a) must describe the personal data or processing to which the code of practice is to relate, and
- (b) may describe the persons or classes of person to whom it is to relate.
- (3) Where a code under this section is in force, the Commissioner may prepare amendments of the code or a replacement code.
- (4) Before preparing a code or amendments under this section, the Commissioner must consult the Secretary of State and such of the following as the Commissioner considers appropriate—
- (a) trade associations;
- (b) data subjects;
- (c) persons who appear to the Commissioner to represent the interests of data subjects.
- (5) A code under this section may include transitional provision or savings.
- (6) Regulations under this section are subject to the negative resolution procedure.
- (7) In this section—
- “*good practice in the processing of personal data*” means such practice in the processing of personal data as appears to the Commissioner to be desirable having regard to the interests of data subjects and others, including compliance with the requirements of the data protection legislation;
- “*trade association*” includes a body representing controllers or processors.
##### 124B
- (1) This section applies where a code is prepared under section 121, 122, 123, 124 or 124A, subject to subsection (11).
- (2) The Commissioner must establish a panel of individuals to consider the code.
- (3) The panel must consist of—
- (a) individuals the Commissioner considers have expertise in the subject matter of the code, and
- (b) individuals the Commissioner considers—
- (i) are likely to be affected by the code, or
- (ii) represent persons likely to be affected by the code.
- (4) Before the panel begins to consider the code, the Commissioner must—
- (a) publish the code in draft, and
- (b) publish a statement that—
- (i) states that a panel has been established to consider the code,
- (ii) identifies the members of the panel,
- (iii) explains the process by which they were selected, and
- (iv) explains the reasons for their selection.
- (5) Where at any time it appears to the Commissioner that a member of the panel is not willing or able to serve as a member of the panel, the Commissioner may select another individual to be a member of the panel.
- (6) Where the Commissioner selects an individual to be a member of the panel under subsection (5), the Commissioner must publish a statement that—
- (a) identifies the member of the panel,
- (b) explains the process by which the member was selected, and
- (c) explains the reasons for the member’s selection.
- (7) The Commissioner must make arrangements—
- (a) for the members of the panel to consider the code with one another (whether in person or otherwise), and
- (b) for the panel to prepare and submit to the Commissioner a report on the code within such reasonable period as is determined by the Commissioner.
- (8) If the panel submits to the Commissioner a report on the code within the period determined by the Commissioner, the Commissioner must as soon as reasonably practicable—
- (a) make any alterations to the code that the Commissioner considers appropriate in the light of the report, and
- (b) publish—
- (i) the code in draft,
- (ii) the report or a summary of it, and
- (iii) in a case where a recommendation in the report to alter the code has not been accepted by the Commissioner, an explanation of why it has not been accepted.
- (9) The Commissioner may pay remuneration and expenses to the members of the panel.
- (10) This section applies in relation to amendments prepared under section 121, 122, 123, 124 or 124A as it applies in relation to codes prepared under those sections, subject to subsection (11).
- (11) The Secretary of State may by regulations provide that this section does not apply, or applies with modifications, in the case of—
- (a) a code prepared under section 124A, or
- (b) an amendment of such a code,
that is specified or described in the regulations.
- (12) Regulations under this section are subject to the negative resolution procedure.
##### 124C
- (1) Where a code is prepared under section 121, 122, 123, 124 or 124A, the Commissioner must carry out and publish an assessment of—
- (a) who would be likely to be affected by the code, and
- (b) the effect the code would be likely to have on them.
- (2) This section applies in relation to amendments prepared under section 121, 122, 123, 124 or 124A as it applies in relation to codes prepared under those sections.
##### 164A
- (1) A data subject may make a complaint to the controller if the data subject considers that, in connection with personal data relating to the data subject, there is an infringement of the UK GDPR or Part 3 of this Act.
- (2) A controller must facilitate the making of complaints under this section by taking steps such as providing a complaint form which can be completed electronically and by other means.
- (3) If a controller receives a complaint under this section, the controller must acknowledge receipt of the complaint within the period of 30 days beginning when the complaint is received.
- (4) If a controller receives a complaint under this section, the controller must without undue delay—
- (a) take appropriate steps to respond to the complaint, and
- (b) inform the complainant of the outcome of the complaint.
- (5) The reference in subsection (4)(a) to taking appropriate steps to respond to the complaint includes—
- (a) making enquiries into the subject matter of the complaint, to the extent appropriate, and
- (b) informing the complainant about progress on the complaint.
##### 164B
- (1) The Secretary of State may by regulations require a controller to notify the Commissioner of the number of complaints made to the controller under section 164A in periods specified or described in the regulations.
- (2) Regulations under this section may provide that a controller is required to make a notification to the Commissioner in respect of a period only in circumstances specified in the regulations.
- (3) Regulations under this section may include—
- (a) provision about a matter listed in subsection (4), or
- (b) provision conferring power on the Commissioner to determine those matters.
- (4) The matters are—
- (a) the form and manner in which a notification must be made,
- (b) the time at which, or period within which, a notification must be made, and
- (c) how the number of complaints made to a controller during a period is to be calculated.
- (5) Regulations under this section are subject to the negative resolution procedure.
## Schedule 12A
#### Status
##### 1
- (1) The Commission is not to be regarded—
- (a) as a servant or agent of the Crown, or
- (b) as enjoying any status, immunity or privilege of the Crown.
- (2) The Commission’s property is not to be regarded—
- (a) as property of the Crown, or
- (b) as property held on behalf of the Crown.
##### 2
- (1) The number of members of the Commission is to be determined by the Secretary of State.
- (2) That number must not be—
- (a) less than 3, or
- (b) more than 14.
- (3) The Secretary of State may by regulations substitute a different number for the number for the time being specified in sub-paragraph (2)(b).
- (4) Regulations under this paragraph are subject to the negative resolution procedure.
##### 3
- (1) The Commission is to consist of—
- (a) the non-executive members, and
- (b) the executive members.
- (2) The non-executive members are—
- (a) a chair appointed by His Majesty by Letters Patent on the recommendation of the Secretary of State, and
- (b) such other members as the Secretary of State may appoint.
- (3) The executive members are—
- (a) a chief executive appointed by the non-executive members or in accordance with paragraph 25, and
- (b) such other members, if any, as the non-executive members may appoint.
- (4) The Secretary of State must consult the chair of the Commission before appointing a non-executive member.
- (5) The non-executive members must consult the Secretary of State before appointing the chief executive.
- (6) The non-executive members must consult the chief executive about whether there should be any executive members within sub-paragraph (3)(b) and, if so, how many there should be.
- (7) The Secretary of State may by direction set a maximum and a minimum number of executive members.
- (8) The Commission may appoint one of the non-executive members as a deputy to the chair.
##### 4
The Secretary of State must exercise the powers conferred on the Secretary of State by paragraphs 2 and 3 so as to secure that the number of non-executive members of the Commission is, so far as practicable, at all times greater than the number of executive members.
##### 5
- (1) The Secretary of State may not recommend a person for appointment as the chair of the Commission unless the person has been selected on merit on the basis of fair and open competition.
- (2) A person may not be appointed as a member of the Commission unless the person has been selected on merit on the basis of fair and open competition.
##### 6
- (1) Before—
- (a) recommending a person for appointment as the chair of the Commission, or
- (b) appointing a person as a non-executive member of the Commission,
the Secretary of State must be satisfied that the person does not have a conflict of interest.
- (2) The Secretary of State must check from time to time that none of the non-executive members has a conflict of interest.
- (3) The Secretary of State may require a non-executive member to provide whatever information the Secretary of State considers necessary for the purpose of checking that the member does not have a conflict of interest.
- (4) A non-executive member who is required to provide information under sub-paragraph (3) must provide it within such period as may be specified by the Secretary of State.
- (5) In this Schedule, “*conflict of interest*”, in relation to a person, means a financial or other interest which is likely to affect prejudicially the discharge by the person of the person’s functions as a member of the Commission.
##### 7
- (1) The chair of the Commission holds and vacates office in accordance with the terms of the chair’s appointment, subject to the provisions of this paragraph.
- (2) The chair must be appointed for a term of not more than 7 years.
- (3) On the recommendation of the Secretary of State, His Majesty may by Letters Patent extend the term of the chair’s appointment but not so the term as extended is more than 7 years.
- (4) A person cannot be appointed as the chair more than once.
- (5) The chair may be relieved from office by His Majesty at the chair’s own request.
- (6) The chair may be removed from office by His Majesty on an Address from both Houses of Parliament.
- (7) No motion is to be made in either House of Parliament for such an Address unless the Secretary of State has presented a report to that House stating that the Secretary of State is satisfied that—
- (a) the chair is guilty of serious misconduct,
- (b) the chair has a conflict of interest (see paragraph 6(5)),
- (c) the chair has failed to comply with paragraph 6(4), or
- (d) the chair is unable, unfit or unwilling to carry out the chair’s functions.
##### 8
- (1) A deputy chair of the Commission may resign that office by giving written notice to the Commission.
- (2) A deputy chair of the Commission ceases to hold that office on ceasing to be a non-executive member of the Commission.
- (3) A deputy chair of the Commission may be removed from that office by the Commission.
##### 9
- (1) This paragraph applies to a non-executive member of the Commission appointed by the Secretary of State.
- (2) The member holds and vacates office in accordance with the terms of their appointment, subject to the provisions of this paragraph.
- (3) The member must be appointed for a term of not more than 7 years.
- (4) The Secretary of State may extend the term of the member’s appointment but not so that the term as extended is more than 7 years.
- (5) The Secretary of State may not appoint the member as a non-executive member of the Commission on a subsequent occasion.
- (6) The member may resign from office by giving written notice to the Secretary of State and the Commission.
- (7) The Secretary of State may remove the member from office by written notice if satisfied that—
- (a) the member is guilty of serious misconduct,
- (b) the member has a conflict of interest (see paragraph 6(5)),
- (c) the member has failed to comply with paragraph 6(4), or
- (d) the member is unable, unfit or unwilling to carry out the member’s functions.
- (8) At the time of removing the member from office the Secretary of State must make public the decision to do so.
- (9) The Secretary of State must—
- (a) give the member a statement of reasons for the removal, and
- (b) if asked to do so by the member, publish the statement.
##### 10
- (1) The Commission may pay to the non-executive members of the Commission such remuneration and allowances as the Secretary of State may determine.
- (2) The Commission may pay, or make provision for paying, to or in respect of the non-executive members of the Commission, such sums by way of pensions, allowances or gratuities (including pensions, allowances or gratuities paid by way of compensation in respect of loss of office) as the Secretary of State may determine.
- (3) The Commission may make a payment to a person of such amount as the Secretary of State may determine where—
- (a) the person ceases to be a non-executive member of the Commission otherwise than on the expiry of the person’s term of office, and
- (b) it appears to the Secretary of State that there are special circumstances which make it appropriate for the person to receive compensation.
##### 11
- (1) The executive members of the Commission are to be employees of the Commission.
- (2) The executive members are to be employed by the Commission on such terms and conditions, including those as to remuneration, as the non-executive members of the Commission may determine.
- (3) The Commission must—
- (a) pay to or in respect of the executive members of the Commission such pensions, allowances or gratuities (including pensions, allowances or gratuities paid by way of compensation in respect of loss of office) as the non-executive members of the Commission may determine, and
- (b) provide and maintain for them such pension schemes (whether contributory or not) as the non-executive members of the Commission may determine.
##### 12
- (1) The Commission may—
- (a) appoint other employees, and
- (b) make such other arrangements for the staffing of the Commission as it considers appropriate.
- (2) In appointing an employee, the Commission must have regard to the principle of selection on merit on the basis of fair and open competition.
- (3) Employees appointed by the Commission are to be appointed on such terms and conditions, including those as to remuneration, as the Commission may determine.
- (4) The Commission may—
- (a) pay to or in respect of those employees such pensions, allowances or gratuities (including pensions, allowances or gratuities paid by way of compensation in respect of loss of employment) as the Commission may determine, and
- (b) provide and maintain for them such pension schemes (whether contributory or not) as the Commission may determine.
##### 13
- (1) The Commission may establish committees.
- (2) A committee of the Commission may consist of or include persons who are neither members nor employees of the Commission.
- (3) But a committee of the Commission to which functions are delegated under paragraph 14(1)(c) must include at least one person who is either a member or an employee of the Commission.
- (4) Where a person who is neither a member nor an employee of the Commission is a member of a committee of the Commission, the Commission may pay to that person such remuneration and expenses as it may determine.
##### 14
- (1) The Commission may delegate any of its functions to—
- (a) a member of the Commission,
- (b) an employee of the Commission, or
- (c) a committee of the Commission.
- (2) A function is delegated under sub-paragraph (1) to the extent and on the terms that the Commission determines.
- (3) A committee of the Commission may delegate any function delegated to it to a member of the committee.
- (4) A function is delegated under sub-paragraph (3) to the extent and on the terms that the committee determines.
- (5) The power of a committee of the Commission to delegate a function, and to determine the extent and terms of the delegation, is subject to the Commission’s power to direct what a committee established by it may and may not do.
- (6) The delegation of a function by the Commission or a committee of the Commission under this paragraph does not prevent the Commission or the committee from exercising that function.
##### 15
The Commission may require a committee of the Commission to give the Commission advice about matters relating to the discharge of the Commission’s functions.
##### 16
- (1) The Commission may make arrangements for regulating—
- (a) its own procedure, and
- (b) the procedure of a committee of the Commission.
- (2) The non-executive members of the Commission may by majority make arrangements for regulating the procedure for the carrying out of the separate functions which are conferred on them under this Schedule.
- (3) Arrangements under this paragraph may include arrangements as to quorum and the making of decisions by a majority.
- (4) The Commission must publish arrangements which it makes under this paragraph.
- (5) This paragraph is subject to paragraph 18.
##### 17
The Commission must make arrangements for the keeping of proper records of—
- (a) its proceedings,
- (b) the proceedings of a committee of the Commission,
- (c) the proceedings at a meeting of the non-executive members of the Commission,
- (d) anything done by a member or employee of the Commission under paragraph 14(1), and
- (e) anything done by a member of a committee of the Commission under paragraph 14(3).
##### 18
- (1) This paragraph applies if—
- (a) a member of the Commission has a direct or indirect interest in a matter falling to be considered at a meeting of the Commission,
- (b) a non-executive member of the Commission has a direct or indirect interest in a matter falling to be considered at a meeting of the non-executive members, or
- (c) a member of a committee of the Commission has a direct or indirect interest in a matter falling to be considered at a meeting of the committee.
- (2) The member with the interest must declare it.
- (3) The declaration must be recorded in the minutes of the meeting.
- (4) The member with the interest may not take part in a discussion or decision at the meeting relating to the matter, unless—
- (a) in the case of a meeting of the Commission, the other members of the Commission who are present have resolved unanimously that the interest is to be disregarded,
- (b) in the case of a meeting of the non-executive members, the other non-executive members who are present have resolved unanimously that the interest is to be disregarded, or
- (c) in the case of a meeting of a committee, the other members of the committee who are present have, in the manner authorised by the Commission, resolved that the interest is to be disregarded.
- (5) In giving authorisation for the purposes of sub-paragraph (4)(c), the Commission must secure that a resolution for those purposes does not allow a member to take part in a discussion or decision at a meeting of a committee to which functions are delegated under paragraph 14(1)(c) unless the number of other members of the committee in favour of the resolution—
- (a) is not less than two thirds of those who are both present and entitled to vote on the resolution, and
- (b) is not less than its quorum.
- (6) For the purposes of this paragraph, a notification given at or sent to a meeting of the Commission that a person—
- (a) is a member of a company or firm, and
- (b) is to be regarded as interested in any matter involving that company or firm,
is to be regarded as compliance with sub-paragraph (2) in relation to any such matter for the purposes of that meeting and subsequent meetings of the Commission, of the non-executive members or of a committee.
- (7) For the purposes of this paragraph, a notification given at or sent to a meeting of the non-executive members of the Commission or of a committee of the Commission that—
- (a) a person is a member of a company or firm, and
- (b) is to be regarded as interested in any matter involving that company or firm,
is to be regarded as compliance with sub-paragraph (2) in relation to any such matter for the purposes of that meeting and subsequent meetings of the non-executive members or (as the case may be) of the committee.
- (8) A notification described in sub-paragraph (6) or (7) remains in force until it is withdrawn.
- (9) A person required to make a declaration for the purposes of this paragraph in relation to any meeting—
- (a) is not required to attend the meeting, but
- (b) is to be taken to have complied with the requirements of this paragraph if the person takes reasonable steps to secure that notice of the person’s interest is read out, and taken into consideration, at the meeting in question.
##### 19
- (1) The validity of proceedings of the Commission, of the non-executive members of the Commission or of a committee of the Commission is not affected by—
- (a) a vacancy in the membership of the Commission or of the committee,
- (b) a defect in the appointment of a member of the Commission,
- (c) a failure of the Secretary of State to comply with the requirements of paragraph 4, or
- (d) a failure to comply with arrangements under paragraph 16 or with a requirement under paragraph 18.
- (2) Nothing in sub-paragraph (1)(d) validates proceedings of a meeting which is inquorate unless it is inquorate by reason only of a matter within sub-paragraph (1)(b) or (c).
##### 20
The Secretary of State may make payments to the Commission.
##### 21
- (1) All fees, charges, penalties and other sums received by the Commission in carrying out its functions are to be paid to the Secretary of State.
- (2) Sub-paragraph (1) does not apply where the Secretary of State otherwise directs.
- (3) Any sums received by the Secretary of State under this paragraph are to be paid into the Consolidated Fund.
##### 22
- (1) The Commission must keep proper accounts and proper records in relation to them.
- (2) The Commission must prepare a statement of accounts in respect of each financial year in the form specified by the Secretary of State.
- (3) The Commission must send a copy of each statement of accounts to the Secretary of State and the Comptroller and Auditor General before the end of August next following the financial year to which the statement relates.
- (4) The Comptroller and Auditor General must—
- (a) examine, certify and report on the statement of accounts, and
- (b) send a copy of the certified statement and the report to the Secretary of State.
- (5) The Secretary of State must lay before Parliament each document received under sub-paragraph (4)(b).
- (6) In this paragraph “*financial year*” means—
- (a) the period beginning with the date on which the Commission is established and ending with the 31 March following that date, and
- (b) each successive period of 12 months.
##### 23
- (1) The application of the Commission’s seal must be authenticated by the signature of—
- (a) the chair of the Commission, or
- (b) another person authorised for that purpose by the Commission.
- (2) A document purporting to be duly executed under the Commission’s seal or signed on its behalf—
- (a) is to be received in evidence, and
- (b) is to be taken to be executed or signed in that way, unless the contrary is shown.
- (3) This paragraph does not extend to Scotland.
##### 24
The Commission may do anything it thinks appropriate for the purposes of, or in connection with, its functions.
##### 25
- (1) The first chief executive of the Commission is to be appointed by the chair of the Commission.
- (2) Before making the appointment the chair must consult the Secretary of State.
- (3) The appointment must be for a term of not more than 2 years.
- (4) The chair may extend the term of the appointment but not so the term as extended is more than 2 years.
- (5) For the term of appointment, the person appointed under sub-paragraph (1) is “the interim chief executive”.
- (6) Until the expiry of the term of appointment, the powers conferred on the non-executive members by paragraph 11(2) and (3) are exercisable in respect of the interim chief executive by the chair (instead of by the non-executive members).
- (7) In sub-paragraphs (5) and (6), the references to the term of appointment are to the term of appointment described in sub-paragraph (3), including any extension of the term under sub-paragraph (4).
##### 26
In this Schedule—
- (a) references to pensions, allowances or gratuities include references to any similar benefits provided on death or retirement, and
- (b) references to the payment of pensions, allowances or gratuities to or in respect of a person include references to the making of payments towards the provision of pensions, allowances or gratuities to be paid to or in respect of a person.
#### The applied GPDR
#### GDPR: right to an effective remedy against the Commissioner
##### 40A
- (1) This section is about processing of personal data that is carried out in reliance on the consent of the data subject.
- (2) The controller must be able to demonstrate that the data subject consented to the processing.
- (3) If the data subject’s consent is given in writing as part of a document which also concerns other matters, the request for consent must be made—
- (a) in a manner which clearly distinguishes the request from the other matters,
- (b) in an intelligible and easily accessible form, and
- (c) in clear and plain language.
- (4) Any part of a document described in subsection (3) which constitutes an infringement of this Part is not binding.
- (5) The data subject may withdraw the consent at any time (but the withdrawal of consent does not affect the lawfulness of processing in reliance on the consent before its withdrawal).
- (6) Processing may only be carried out in reliance on consent if—
- (a) before the consent is given, the controller or processor informs the data subject of the right to withdraw it, and
- (b) it is as easy for the data subject to withdraw the consent as to give it.
- (7) When assessing whether consent is freely given, account must be taken of, among other things, whether the provision of a service is conditional on consent to the processing of personal data that is not necessary for the provision of that service.
##### 141A
- (1) This section applies in relation to a notice authorised or required by this Act to be given to a person by the Commissioner.
- (2) The notice may be given to the person by—
- (a) delivering it by hand to a relevant individual,
- (b) leaving it at the person’s proper address,
- (c) sending it by post to the person at that address, or
- (d) sending it by email to the person’s email address.
- (3) A “*relevant individual*” means—
- (a) in the case of a notice to an individual, that individual;
- (b) in the case of a notice to a body corporate (other than a partnership), an officer of that body;
- (c) in the case of a notice to a partnership, a partner in the partnership or a person who has the control or management of the partnership business;
- (d) in the case of a notice to an unincorporated body (other than a partnership), a member of its governing body.
- (4) For the purposes of subsection (2)(b) and (c), and section 7 of the Interpretation Act 1978 (services of documents by post) in its application to those provisions, a person’s proper address is—
- (a) in a case where the person has specified an address as one at which the person, or someone acting on the person’s behalf, will accept service of notices or other documents, that address;
- (b) in any other case, the address determined in accordance with subsection (5).
- (5) The address is—
- (a) in a case where the person is a body corporate with a registered office in the United Kingdom, that office;
- (b) in a case where paragraph (a) does not apply and the person is a body corporate, partnership or unincorporated body with a principal office in the United Kingdom, that office;
- (c) in any other case, an address in the United Kingdom at which the Commissioner believes, on reasonable grounds, that the notice will come to the attention of the person.
- (6) A person’s email address is—
- (a) an email address published for the time being by that person as an address for contacting that person, or
- (b) if there is no such published address, an email address by means of which the Commissioner believes, on reasonable grounds, that the notice will come to the attention of that person.
- (7) A notice sent by email is treated as given 48 hours after it was sent, unless the contrary is proved.
- (8) In this section, “*officer*”, in relation to a body corporate, means a director, manager, secretary or other similar officer of the body.
- (9) This section does not limit other lawful means of giving a notice.
##### 45A
- (1) Sections 44(2) and 45(1) do not require the controller to give the data subject—
- (a) information in respect of which a claim to legal professional privilege or, in Scotland, confidentiality of communications could be maintained in legal proceedings, or
- (b) information in respect of which a duty of confidentiality is owed by a professional legal adviser to a client of the adviser.
- (2) A controller relying on the exemption in subsection (1) must inform the data subject in writing without undue delay of—
- (a) the decision to rely on the exemption,
- (b) the reason for the decision,
- (c) the data subject’s right to make a request to the Commissioner under section 51,
- (d) the data subject’s right to lodge a complaint with the Commissioner under section 165, and
- (e) the data subject’s right to apply to a court under section 167.
- (3) Subsection (2)(a) and (b) do not apply to the extent that complying with them would—
- (a) undermine a claim described in subsection (1)(a), or
- (b) conflict with a duty described in subsection (1)(b).
- (4) The controller must—
- (a) record the reason for a decision to rely on the exemption in subsection (1), and
- (b) if requested to do so by the Commissioner, make the record available to the Commissioner.
- (5) The reference in subsection (1) to sections 44(2) and 45(1) includes sections 35 to 40 so far as their provisions correspond to the rights and obligations provided for in sections 44(2) and 45(1).
### Codes of conduct
##### 71A
- (1) The Commissioner must encourage expert public bodies to produce codes of conduct intended to contribute to compliance with this Part.
- (2) Under subsection (1), the Commissioner must, among other things, encourage the production of codes which take account of the specific features of the various processing sectors.
- (3) For the purposes of this section—
- (a) “*public body*” means a body or other person whose functions are, or include, functions of a public nature, and
- (b) a public body is “expert” if, in the Commissioner’s opinion, the body has the knowledge and experience needed to produce a code of conduct described in subsection (1).
- (4) A code of conduct described in subsection (1) may, for example, make provision with regard to—
- (a) lawful and fair processing;
- (b) the collection of personal data;
- (c) the information provided to the public and to data subjects;
- (d) the exercise of the rights of data subjects;
- (e) the measures and procedures referred to in sections 56, 57 and 62;
- (f) the notification of personal data breaches to the Commissioner and the communication of personal data breaches to data subjects;
- (g) the transfer of personal data to third countries or international organisations;
- (h) out-of-court proceedings and other dispute resolution procedures for resolving disputes between controllers and data subjects with regard to processing.
- (5) The Commissioner must encourage expert public bodies to submit codes of conduct described in subsection (1) to the Commissioner in draft.
- (6) Where an expert public body does so, the Commissioner must—
- (a) provide the body with an opinion on whether the code correctly reflects the requirements of this Part,
- (b) decide whether to approve the code, and
- (c) if the code is approved, register and publish the code.
- (7) Subsections (5) and (6) apply in relation to amendments of a code of conduct that is for the time being approved under this section as they apply in relation to a code.
##### 78A
- (1) A provision mentioned in subsection (2) does not apply to personal data processed for law enforcement purposes if exemption from the provision is required for the purposes of safeguarding national security.
- (2) The provisions are—
- (a) Chapter 2 of this Part (principles), except for the provisions listed in subsection (3);
- (b) Chapter 3 of this Part (rights of the data subject);
- (c) in Chapter 4 of this Part—
- (i) section 67 (notification of personal data breach to the Commissioner);
- (ii) section 68 (communication of personal data breach to the data subject);
- (d) Chapter 5 of this Part (transfers of personal data to third countries etc), except for the provisions listed in subsection (4);
- (e) in Part 5—
- (i) section 119 (inspection in accordance with international obligations);
- (ii) in Schedule 13 (other general functions of the Commissioner), paragraphs 1(1)(a) and (g) and 2;
- (f) in Part 6—
- (i) sections 142 to 154 and Schedule 15 (Commissioner’s notices and powers of entry and inspection);
- (ii) sections 170 to 173 (offences relating to personal data);
- (g) in Part 7, section 187 (representation of data subjects).
- (3) The provisions of Chapter 2 of this Part (principles) which are excepted from the list in subsection (2) are—
- (a) section 35(1) (the first data protection principle) so far as it requires processing of personal data to be lawful;
- (b) section 35(2) to (5) (lawfulness of processing and restrictions on sensitive processing);
- (c) section 42 (safeguards: sensitive processing);
- (d) Schedule 8 (conditions for sensitive processing).
- (4) The provisions of Chapter 5 of this Part (transfers of personal data to third countries etc) which are excepted from the list in subsection (2) are—
- (a) the following provisions of section 73—
- (i) subsection (1)(a) (conditions for transfer), so far as it relates to the condition in subsection (2) of that section, and subsection (2) (transfer must be necessary for a law enforcement purpose);
- (ii) subsections (1)(b), (5) and (6) (conditions for transfer of personal data originally made available by a member State);
- (b) section 78 (subsequent transfers).
##### 82A
- (1) For the purposes of this Part, the Secretary of State may give a notice designating processing of personal data by a qualifying competent authority (a “designation notice”) where—
- (a) an application for designation of the processing is made in accordance with this section, and
- (b) the Secretary of State considers that designation of the processing is required for the purposes of safeguarding national security.
- (2) The Secretary of State may only designate processing by a qualifying competent authority that is carried out by the authority as a joint controller with at least one intelligence service.
- (3) The Secretary of State may not designate processing by a qualifying competent authority that consists of the transfer of personal data to—
- (a) a country or territory outside the United Kingdom, or
- (b) an international organisation.
- (4) A designation notice must—
- (a) specify or describe the processing and qualifying competent authority that are designated, and
@@ -22359,3 +22615,139 @@
##### 57
The Border Security Commander.
##### 146A
- (1) This section applies where an assessment notice requires a controller or processor to make arrangements for an approved person to prepare a report.
- (2) The controller or processor must, within such period as is specified in the assessment notice, nominate to the Commissioner a person to prepare the report.
- (3) If the Commissioner is satisfied that the nominated person is a suitable person to prepare the report, the Commissioner must by written notice to the controller or processor approve the nominated person to prepare the report.
- (4) If the Commissioner is not satisfied that the nominated person is a suitable person to prepare the report, the Commissioner must by written notice to the controller or processor—
- (a) inform the controller or processor that the Commissioner has decided not to approve the nominated person to prepare the report,
- (b) inform the controller or processor of the reasons for that decision, and
- (c) approve a person who the Commissioner is satisfied is a suitable person to prepare the report to do so.
- (5) If the controller or processor does not nominate a person within the period specified in the assessment notice, the Commissioner must by written notice to the controller or processor approve a person who the Commissioner is satisfied is a suitable person to prepare the report to do so.
- (6) It is the duty of the controller or processor to give the person approved to prepare the report all such assistance as the person may reasonably require to prepare the report.
### Interview notices
##### 148A
- (1) This section applies where the Commissioner suspects that a controller or processor—
- (a) has failed or is failing as described in section 149(2), or
- (b) has committed or is committing an offence under this Act.
- (2) For the purpose of investigating the suspected failure or offence, the Commissioner may, by written notice (an “interview notice”), require an individual within subsection (3) to—
- (a) attend at a place specified in the notice, and
- (b) answer questions with respect to any matter relevant to the investigation.
- (3) An individual is within this subsection if the individual—
- (a) is the controller or processor,
- (b) is or was at any time employed by, or otherwise working for, the controller or processor, or
- (c) is or was at any time concerned in the management or control of the controller or processor.
- (4) An interview notice must specify the time at which the individual must attend at the specified place and answer questions (but see the restrictions in subsections (6) and (7)).
- (5) An interview notice must—
- (a) indicate the nature of the suspected failure or offence that is the subject of the investigation,
- (b) provide information about the consequences of failure to comply with the notice, and
- (c) provide information about the rights under sections 162 and 164 (appeals etc).
- (6) An interview notice may not require an individual to attend at the specified place and answer questions before the end of the period within which an appeal can be brought against the notice.
- (7) If an appeal is brought against an interview notice, the individual to whom the notice is given need not attend at the specified place and answer questions pending the determination or withdrawal of the appeal.
- (8) If an interview notice—
- (a) states that, in the Commissioner’s opinion, it is necessary for the individual to attend at the specified place and answer questions urgently, and
- (b) gives the Commissioner’s reasons for reaching that opinion,
subsections (6) and (7) do not apply but the notice must not require the individual to attend at the specified place and answer questions before the end of the period of 24 hours beginning when the notice is given.
- (9) The Commissioner may cancel or vary an interview notice by written notice to the individual to whom it was given.
##### 148B
- (1) An interview notice does not require an individual to answer questions to the extent that requiring the person to do so would involve an infringement of the privileges of either House of Parliament.
- (2) An interview notice does not require an individual to answer questions in respect of a communication which is made—
- (a) between a professional legal adviser and the adviser’s client, and
- (b) in connection with the giving of legal advice to the client with respect to obligations, liabilities or rights under the data protection legislation.
- (3) An interview notice does not require an individual to answer questions in respect of a communication which is made—
- (a) between a professional legal adviser and the adviser’s client or between such an adviser or client and another person,
- (b) in connection with or in contemplation of proceedings under or arising out of the data protection legislation, and
- (c) for the purposes of such proceedings.
- (4) In subsections (2) and (3), references to the client of a professional legal adviser include references to a person acting on behalf of the client.
- (5) An interview notice does not require an individual to answer questions if doing so would, by revealing evidence of the commission of an offence, expose the individual to proceedings for that offence.
- (6) The reference to an offence in subsection (5) does not include an offence under—
- (a) this Act;
- (b) section 5 of the Perjury Act 1911 (false statements made otherwise than on oath);
- (c) section 44(2) of the Criminal Law (Consolidation) (Scotland) Act 1995 (false statements made otherwise than on oath);
- (d) Article 10 of the Perjury (Northern Ireland) Order 1979 ([S.I. 1979/1714 (N.I. 19))](https://www.legislation.gov.uk/nisi/1979/1714) (false statutory declarations and other false unsworn statements).
- (7) A statement made by an individual in response to an interview notice may not be used in evidence against that individual on a prosecution for an offence under this Act (other than an offence under section 148C) unless in the proceedings—
- (a) in giving evidence the individual provides information inconsistent with the statement, and
- (b) evidence relating to the statement is adduced, or a question relating to it is asked, by that individual or on that individual’s behalf.
- (8) The Commissioner may not give an interview notice with respect to the processing of personal data for the special purposes.
- (9) The Commissioner may not give an interview notice to an individual for the purpose of investigating a suspected failure or offence if the controller or processor suspected of the failure or offence is a body specified in section 23(3) of the Freedom of Information Act 2000 (bodies dealing with security matters).
##### 148C
It is an offence for an individual, in response to an interview notice—
- (a) to make a statement which the individual knows to be false in a material respect, or
- (b) recklessly to make a statement which is false in a material respect.
### Interview notices
##### 3A
- (1) Sub-paragraph (2) applies where the Commissioner gives an interview notice to an individual during a relevant period.
- (2) If the interview notice—
- (a) states that, in the Commissioner’s opinion, it is necessary for the individual to comply with a requirement in the notice for the purposes of the relevant review, and
- (b) gives the Commissioner’s reasons for reaching that opinion,
subsections (6) and (7) of section 148A do not apply but the notice must not require the individual to comply with the requirement before the end of the period of 24 hours beginning when the notice is given.
- (3) During a relevant period, section 148B has effect as if for subsection (8) there were substituted—
> (8) The Commissioner may not give an individual an interview notice with respect to the processing of personal data for the special purposes unless a determination under section 174 with respect to the data or the processing has taken effect.
2026-01-29
Data Protection Act 2018
2025-08-19
Data Protection Act 2018
2025-06-19
Data Protection Act 2018
2025-04-01
Data Protection Act 2018
2024-12-13
Data Protection Act 2018
2024-03-08
Data Protection Act 2018
2024-01-01
Data Protection Act 2018
2023-12-31
Data Protection Act 2018
2023-12-26
Data Protection Act 2018
2023-05-05
Data Protection Act 2018
2023-02-01
Data Protection Act 2018
2022-11-30
Data Protection Act 2018
2022-07-30
Data Protection Act 2018
2022-03-18
Data Protection Act 2018
2022-01-31
Data Protection Act 2018
2021-12-17
Data Protection Act 2018
2021-12-15
Data Protection Act 2018
2021-01-28
Data Protection Act 2018
2020-12-31
Data Protection Act 2018
2020-09-30
Data Protection Act 2018
2020-02-14
Data Protection Act 2018
2019-12-02
Data Protection Act 2018
2019-09-16
Data Protection Act 2018
2019-07-21
Data Protection Act 2018
2019-05-23
Data Protection Act 2018
2019-03-29
Data Protection Act 2018
2018-07-23
Data Protection Act 2018
2018-05-25
Data Protection Act 2018
2018-05-23
Data Protection Act 2018
original version
Text at this date