LegalizeReform history
Data Protection Act 2018
32 versions
· 2018-05-23
2026-04-07
Data Protection Act 2018
2026-03-31
Data Protection Act 2018
2026-03-10
Data Protection Act 2018
2026-01-29
Data Protection Act 2018
Changes on 2026-01-29
@@ -14,7 +14,7 @@
- (4) Part 3 makes provision about the processing of personal data by competent authorities for law enforcement purposes ....
- (5) Part 4 makes provision about the processing of personal data by the intelligence services.
- (5) Part 4 makes provision about the processing of personal data by the intelligence services (and certain processing carried out by competent authorities jointly with the intelligence services).
- (6) Part 5 makes provision about the Information Commissioner.
@@ -34,7 +34,7 @@
- (c) conferring functions on the Commissioner, giving the holder of that office responsibility for monitoring and enforcing their provisions.
- (2) When carrying out functions under the UK GDPR and this Act, the Commissioner must have regard to the importance of securing an appropriate level of protection for personal data, taking account of the interests of data subjects, controllers and others and matters of general public interest.
- (2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### Terms relating to the processing of personal data
@@ -74,17 +74,19 @@
- (8) “*The Commissioner*” means the Information Commissioner (see section 114).
- (8A) “*The Commission*” means the Information Commission (see section 114A).
- (9) “*The data protection legislation*” means—
- (a) the UK GDPR,
- (b) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (c) this Act,
- (d) regulations made under this Act, and
- (e) regulations made under section 2(2) of the European Communities Act 1972 which relate to the EU GDPR or the Law Enforcement Directive.
- (c) this Act, and
- (d) regulations made under this Act or the UK GDPR, ...
- (e) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (10) “*The UK GDPR*” means [Regulation (EU) 2016/679](https://www.legislation.gov.uk/eur/2016/679) of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation), as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (and see section 205(4)).
@@ -526,7 +528,7 @@
##### 20
Section 5(1) (terms used in this Part to have the same meaning as in the UK GDPR) does not apply to references in this Part to a court and, accordingly, such references do not include a tribunal.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
### CHAPTER 3 — Exemptions for manual unstructured processing and for national security and defence purposes
@@ -746,6 +748,8 @@
- (f) Chapter VIII of the UK GDPR (remedies, liabilities and penalties) except for—
- (ai) Article 77 (right to lodge a complaint with the Commissioner);
- (i) Article 83 (general conditions for imposing administrative fines);
- (ii) Article 84 (penalties);
@@ -860,6 +864,8 @@
- (b) the processing by a competent authority otherwise than by automated means of personal data which forms part of a filing system or is intended to form part of a filing system.
- (1A) This Part does not apply to processing to which Part 4 applies by virtue of a designation notice (see section 82A).
- (2) Any reference in this Part to the processing of personal data is to processing to which this Part applies.
- (3) For the meaning of “competent authority”, see section 30.
@@ -928,8 +934,6 @@
- (1) This section defines certain other expressions used in this Part.
- (1A) “Consent” of the data subject to the processing of personal data means a freely given, specific, informed and unambiguous indication of the data subject’s wishes by which the data subject, by a statement or by a clear affirmative action, signifies agreement to the processing of the personal data (and see section 40A).
- (2) “*Employee*”, in relation to any person, includes an individual who holds a position (whether paid or unpaid) under the direction and control of that person.
- (3) “*Personal data breach*” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.
@@ -940,6 +944,8 @@
- (6) “*Restriction of processing*” means the marking of stored personal data with the aim of limiting its processing for the future.
- (6A) “*Sensitive processing*” has the meaning given in section 35(8).
- (7) “*Third country*” means a country or territory outside the United Kingdom.
- (8) Sections 3 and 205 include definitions of other expressions used in this Part.
@@ -966,9 +972,7 @@
- (2) In addition—
- (a) each of sections 35, 36, 38 and 39 makes provision to supplement the principle to which it relates,
- (aa) section 40A makes provision about processing carried out in reliance on the consent of the data subject, and
- (a) each of sections 35, 36, 38 and 39 makes provision to supplement the principle to which it relates, and
- (b) sections 41 and 42 make provision about the safeguards that apply in relation to certain types of processing.
@@ -1006,11 +1010,11 @@
- (a) by adding conditions;
- (b) by omitting conditions added by regulations under paragraph (a).
- (b) by varying or omitting conditions added by regulations under paragraph (a).
- (7) Regulations under subsection (6) are subject to the affirmative resolution procedure.
- (8) In this section, “*sensitive processing*” means—
- (8) In this Part, “*sensitive processing*” means—
- (a) the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership;
@@ -1154,9 +1158,9 @@
- (1) This Chapter—
- (a) imposes general duties on the controller to make information available (see section 44);
- (b) confers a right of access by the data subject (see section 45);
- (a) imposes general duties on the controller to make information available (see sections 44 and 45A);
- (b) confers a right of access by the data subject (see sections 45 and 45A);
- (c) confers rights on the data subject with respect to the rectification of personal data and the erasure of personal data or the restriction of its processing (see sections 46 to 48);
@@ -1172,7 +1176,7 @@
- (5) In this Chapter, “*the controller*”, in relation to a data subject, means the controller in relation to personal data relating to the data subject.
### Information: controller's general duties
### Data subject’s rights to information
#### Information: controller’s general duties
@@ -1216,11 +1220,11 @@
- (c) protect public security;
- (d) protect national security;
- (d) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (e) protect the rights and freedoms of others.
- (5) Where the provision of information to a data subject under subsection (2) is restricted, wholly or partly, the controller must inform the data subject in writing without undue delay—
- (5) Where the provision of information to a data subject under subsection (2) is restricted under subsection (4), wholly or partly, the controller must inform the data subject in writing without undue delay—
- (a) that the provision of information has been restricted,
@@ -1236,11 +1240,11 @@
- (7) The controller must—
- (a) record the reasons for a decision to restrict (whether wholly or partly) the provision of information to a data subject under subsection (2), and
- (a) record the reasons for a decision to restrict (whether wholly or partly) the provision of information to a data subject under subsection (2) in reliance on subsection (4), and
- (b) if requested to do so by the Commissioner, make the record available to the Commissioner.
### Data subject's right of access
### ...
#### Right of access by the data subject
@@ -1288,11 +1292,11 @@
- (c) protect public security;
- (d) protect national security;
- (d) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (e) protect the rights and freedoms of others.
- (5) Where the rights of a data subject under subsection (1) are restricted, wholly or partly, the controller must inform the data subject in writing without undue delay—
- (5) Where the rights of a data subject under subsection (1) are restricted under subsection (4), wholly or partly, the controller must inform the data subject in writing without undue delay—
- (a) that the rights of the data subject have been restricted,
@@ -1308,7 +1312,7 @@
- (7) The controller must—
- (a) record the reasons for a decision to restrict (whether wholly or partly) the rights of a data subject under subsection (1), and
- (a) record the reasons for a decision to restrict (whether wholly or partly) the rights of a data subject under subsection (1) in reliance on subsection (4), and
- (b) if requested to do so by the Commissioner, make the record available to the Commissioner.
@@ -1374,11 +1378,11 @@
- (c) protect public security;
- (d) protect national security;
- (d) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (e) protect the rights and freedoms of others.
- (4) Where the rights of a data subject under subsection (1) are restricted, wholly or partly, the controller must inform the data subject in writing without undue delay—
- (4) Where the rights of a data subject under subsection (1)(b)(i) are restricted under subsection (3), wholly or partly, the controller must inform the data subject in writing without undue delay—
- (a) that the rights of the data subject have been restricted,
@@ -1392,7 +1396,7 @@
- (6) The controller must—
- (a) record the reasons for a decision to restrict (whether wholly or partly) the provision of information to a data subject under subsection (1)(b)(i), and
- (a) record the reasons for a decision to restrict (whether wholly or partly) the provision of information to a data subject under subsection (1)(b)(i) in reliance on subsection (3), and
- (b) if requested to do so by the Commissioner, make the record available to the Commissioner.
@@ -1474,7 +1478,9 @@
- (a) restricts under section 44(4) the information provided to the data subject under section 44(2) (duty of the controller to give the data subject additional information),
- (b) restricts under section 45(4) the data subject's rights under section 45(1) (right of access), or
- (b) restricts under section 45(4) the data subject's rights under section 45(1) (right of access),
- (ba) relies on the exemption from sections 44(2) and 45(1) in section 45A (legal professional privilege), or
- (c) refuses a request by the data subject for rectification under section 46 or for erasure or restriction of processing under section 47.
@@ -1482,6 +1488,8 @@
- (a) where subsection (1)(a) or (b) applies, request the Commissioner to check that the restriction imposed by the controller was lawful;
- (aa) where subsection (1)(ba) applies, request the Commissioner to check that the controller was entitled to rely on the exemption;
- (b) where subsection (1)(c) applies, request the Commissioner to check that the refusal of the data subject's request was lawful.
- (3) The Commissioner must take such steps as appear to the Commissioner to be appropriate to respond to a request under subsection (2) (which may include the exercise of any of the powers conferred by sections 142 and 146).
@@ -1490,11 +1498,13 @@
- (a) where subsection (1)(a) or (b) applies, whether the Commissioner is satisfied that the restriction imposed by the controller was lawful;
- (aa) where subsection (1)(ba) applies, whether the Commissioner is satisfied that the controller was entitled to rely on the exemption;
- (b) where subsection (1)(c) applies, whether the Commissioner is satisfied that the controller's refusal of the data subject's request was lawful.
- (5) The Commissioner must also inform the data subject of the data subject's right to apply to a court under section 167.
- (6) Where the Commissioner is not satisfied as mentioned in subsection (4)(a) or (b), the Commissioner may also inform the data subject of any further steps that the Commissioner is considering taking under Part 6 .
- (6) Where the Commissioner is not satisfied as mentioned in subsection (4)(a) , (aa) or (b), the Commissioner may also inform the data subject of any further steps that the Commissioner is considering taking under Part 6 .
#### Form of provision of information etc
@@ -1578,7 +1588,9 @@
- (c) sets out specific obligations of controllers and processors with respect to personal data breaches (see sections 67 and 68);
- (d) makes provision for the designation, position and tasks of data protection officers (see sections 69 to 71).
- (d) makes provision for the designation, position and tasks of data protection officers (see sections 69 to 71);
- (e) makes provision about codes of conduct (see section 71A).
- (2) This Chapter applies only in relation to the processing of personal data for a law enforcement purpose.
@@ -1604,6 +1616,8 @@
- (3) The technical and organisational measures implemented under subsection (1) must be reviewed and updated where necessary.
- (4) Adherence to a code of conduct approved under section 71A may be used by a controller as a means of demonstrating compliance with the requirements of this Part.
#### Data protection by design and default
##### 57
@@ -1686,6 +1700,8 @@
- (7) The terms included in the contract in accordance with subsection (6)(a) must provide that the processor may transfer personal data to a third country or international organisation only if instructed by the controller to make the particular transfer.
- (7A) Adherence to a code of conduct approved under section 71A may be used by a processor as a means of demonstrating sufficient guarantees as described in subsection (2).
- (8) If a processor determines, in breach of this Part, the purposes and means of processing, the processor is to be treated for the purposes of this Part as a controller in respect of that processing.
#### Processing under the authority of the controller or processor
@@ -1770,13 +1786,13 @@
- (2) The logs of consultation must make it possible to establish—
- (a) the ... date and time of, the consultation, and
- (a) the justification for, and date and time of, the consultation, and
- (b) so far as possible, the identity of the person who consulted the data.
- (3) The logs of disclosure must make it possible to establish—
- (a) the ... date and time of, the disclosure, and
- (a) the justification for, and date and time of, the disclosure, and
- (b) so far as possible—
@@ -1866,6 +1882,8 @@
- (d) ensure that stored personal data cannot be corrupted if a system used in connection with the processing malfunctions.
- (3) Adherence to a code of conduct approved under section 71A may be used by a controller or processor as a means of demonstrating compliance with subsection (1).
### Obligations relating to personal data breaches
#### Notification of a personal data breach to the Commissioner
@@ -1950,7 +1968,7 @@
- (c) protect public security;
- (d) protect national security;
- (d) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (e) protect the rights and freedoms of others.
@@ -2230,19 +2248,21 @@
##### 79
- (1) A Minister of the Crown may issue a certificate certifying, for the purposes of section 44(4), 45(4), 48(3) or 68(7), that a restriction is a necessary and proportionate measure to protect national security.
- (2) The certificate may—
- (a) relate to a specific restriction (described in the certificate) which a controller has imposed or is proposing to impose under section 44(4), 45(4), 48(3) or 68(7), or
- (b) identify any restriction to which it relates by means of a general description.
- (3) Subject to subsection (6), a certificate issued under subsection (1) is conclusive evidence that the specific restriction or (as the case may be) any restriction falling within the general description is, or at any time was, a necessary and proportionate measure to protect national security.
- (4) A certificate issued under subsection (1) may be expressed to have prospective effect.
- (5) Any person directly affected by the issuing of a certificate under subsection (1) may appeal to the Tribunal against the certificate.
- (1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (3A) Subject to subsection (5), a certificate signed by a Minister of the Crown certifying that exemption from all or any of the provisions listed in section 78A(2) is, or at any time was, required in relation to any personal data for the purposes of safeguarding national security is conclusive evidence of that fact.
- (4) A certificate issued under subsection (3A)—
- (a) may identify the personal data to which it applies by means of a general description, and
- (b) may be expressed to have prospective effect.
- (5) Any person directly affected by the issuing of a certificate under subsection (3A) may appeal to the Tribunal against the certificate.
- (6) If, on an appeal under subsection (5), the Tribunal finds that, applying the principles applied by a court on an application for judicial review, the Minister did not have reasonable grounds for issuing the certificate, the Tribunal may —
@@ -2250,35 +2270,31 @@
- (b) quash the certificate.
- (7) Where in any proceedings under or by virtue of this Act, it is claimed by a controller that a restriction falls within a general description in a certificate issued under subsection (1), any other party to the proceedings may appeal to the Tribunal on the ground that the restriction does not fall within that description.
- (8) But, subject to any determination under subsection (9), the restriction is to be conclusively presumed to fall within the general description.
- (7) Where in any proceedings under or by virtue of this Act, it is claimed by a controller that a certificate under subsection (3A) which identifies the personal data to which it applies by means of a general description applies to any personal data, any other party to the proceedings may appeal to the Tribunal on the ground that the certificate does not apply to the personal data in question.
- (8) But, subject to any determination under subsection (9), the certificate is to be conclusively presumed so to apply.
- (9) On an appeal under subsection (7), the Tribunal may determine that the certificate does not so apply.
- (10) A document purporting to be a certificate under subsection (1) is to be—
- (10) A document purporting to be a certificate under subsection (3A) is to be—
- (a) received in evidence, and
- (b) deemed to be such a certificate unless the contrary is proved.
- (11) A document which purports to be certified by or on behalf of a Minister of the Crown as a true copy of a certificate issued by that Minister under subsection (1) is—
- (11) A document which purports to be certified by or on behalf of a Minister of the Crown as a true copy of a certificate issued by that Minister under subsection (3A) is—
- (a) in any legal proceedings, evidence of that certificate, and
- (b) in any legal proceedings in Scotland, sufficient evidence of that certificate.
- (12) The power conferred by subsection (1) on a Minister of the Crown is exercisable only by—
- (12) The power conferred by subsection (3A) on a Minister of the Crown is exercisable only by—
- (a) a Minister who is a member of the Cabinet, or
- (b) the Attorney General or the Advocate General for Scotland.
- (13) No power conferred by any provision of Part 6 may be exercised in relation to the imposition of—
- (a) a specific restriction in a certificate under subsection (1), or
- (b) a restriction falling within a general description in such a certificate.
- (13) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
#### Special processing restrictions
@@ -2340,11 +2356,17 @@
##### 82
- (1) This Part applies to—
- (a) the processing by an intelligence service of personal data wholly or partly by automated means, and
- (b) the processing by an intelligence service otherwise than by automated means of personal data which forms part of a filing system or is intended to form part of a filing system.
- (A1) This Part—
- (a) applies to processing of personal data by an intelligence service, and
- (b) applies to processing of personal data by a qualifying competent authority where the processing is the subject of a designation notice that is for the time being in force (see sections 82A to 82E).
- (1) This Part applies only to—
- (a) processing of personal data wholly or partly by automated means, and
- (b) processing otherwise than by automated means of personal data which forms part of a filing system or is intended to form part of a filing system.
- (2) In this Part, “*intelligence service*” means—
@@ -2370,7 +2392,13 @@
##### 83
- (1) In this Part, “*controller*” means the intelligence service which, alone or jointly with others—
- (A1) For the purposes of this Part—
- (a) an intelligence service is the “*controller*” in relation to the processing of personal data if it satisfies subsection (1) alone or jointly with others, and
- (b) a qualifying competent authority is the “*controller*” in relation to the processing of personal data that is the subject of a designation notice that is for the time being in force if the authority satisfies subsection (1) jointly with others.
- (1) This subsection is satisfied by a person who—
- (a) determines the purposes and means of the processing of personal data, or
@@ -2382,7 +2410,7 @@
- (b) by means by which it is required by an enactment to be processed,
the intelligence service on which the obligation to process the data is imposed by the enactment (or, if different, one of the enactments) is the controller.
the person on whom the obligation to process the data is imposed by the enactment (or, if different, one of the enactments) is the controller.
- (3) In this Part, “*processor*” means any person who processes personal data on behalf of the controller (other than a person who is an employee of the controller).
@@ -2394,6 +2422,8 @@
- (2) “*Consent*”, in relation to the processing of personal data relating to an individual, means a freely given, specific, informed and unambiguous indication of the individual's wishes by which the individual, by a statement or by a clear affirmative action, signifies agreement to the processing of the personal data.
- (2A) “*Designation notice*” has the meaning given in section 82A.
- (3) “*Employee*”, in relation to any person, includes an individual who holds a position (whether paid or unpaid) under the direction and control of that person.
- (4) “*Personal data breach*” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.
@@ -2402,6 +2432,10 @@
- (6) “*Restriction of processing*” means the marking of stored personal data with the aim of limiting its processing for the future.
- (6A) “*Sensitive processing*” has the meaning given in section 86(7).
- (6B) “*Withdrawal notice*” has the meaning given in section 82C.
- (7) Sections 3 and 205 include definitions of other expressions used in this Part.
### CHAPTER 2 — Principles
@@ -2450,7 +2484,7 @@
- (a) by adding conditions;
- (b) by omitting conditions added by regulations under paragraph (a).
- (b) by varying or omitting conditions added by regulations under paragraph (a).
- (4) Regulations under subsection (3) are subject to the affirmative resolution procedure.
@@ -2462,7 +2496,7 @@
- (b) is required to supply it by an enactment or by an international obligation of the United Kingdom.
- (7) In this section, “*sensitive processing*” means—
- (7) In this Part, “*sensitive processing*” means—
- (a) the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership;
@@ -2664,7 +2698,7 @@
- (d) any express refusal of consent by the other individual.
- (10) Subject to subsection (6), a controller must comply with a request under subsection (1)—
- (10) Subject to subsections (3), (5) and (6), a controller must comply with a request under subsection (1)—
- (a) promptly, and
@@ -2900,7 +2934,7 @@
##### 104
- (1) Where two or more intelligence services jointly determine the purposes and means of processing personal data, they are joint controllers for the purposes of this Part.
- (1) Where two or more controllers jointly determine the purposes and means of processing personal data, they are joint controllers for the purposes of this Part.
- (2) Joint controllers must, in a transparent manner, determine their respective responsibilities for compliance with this Part by means of an arrangement between them, except to the extent that those responsibilities are determined under or by virtue of an enactment.
@@ -3006,11 +3040,11 @@
- (2) The provisions are—
- (a) Chapter 2 (the data protection principles), except section 86(1)(a) and (2) and Schedules 9 and 10;
- (b) Chapter 3 (rights of data subjects);
- (c) in Chapter 4 , section 108 (communication of a personal data breach to the Commissioner);
- (a) Chapter 2 of this Part (the data protection principles), except section 86(1)(a) and (2) and Schedules 9 and 10;
- (b) Chapter 3 of this Part (rights of data subjects);
- (c) in Chapter 4 of this Part, section 108 (communication of a personal data breach to the Commissioner);
- (d) in Part 5—
@@ -3378,7 +3412,7 @@
- (5) In this section—
- “*good practice in the processing of personal data for the purposes of journalism*” means such practice in the processing of personal data for those purposes as appears to the Commissioner to be desirable having regard to—the interests of data subjects and others, including compliance with the requirements of the data protection legislation, andthe special importance of the public interest in the freedom of expression and information;
- “*good practice in the processing of personal data for the purposes of journalism*” means such practice in the processing of personal data for those purposes as appears to the Commissioner to be desirable having regard to—the interests of data subjects and others ..., andthe special importance of the public interest in the freedom of expression and information; and includes compliance with the requirements of the data protection legislation;
- “*trade association*” includes a body representing controllers or processors.
@@ -3386,19 +3420,15 @@
##### 125
- (1) When a code is prepared under section 121, 122, 123 or 124 , 124 or 124A—
- (1) When a code is prepared under section 121, 122, 123 , 124 or 124A—
- (a) the Commissioner must submit the final version to the Secretary of State, and
- (b) the Secretary of State must lay the code before Parliament.
- (2) In relation to the first code under section 123—
- (a) the Commissioner must prepare the code as soon as reasonably practicable and must submit it to the Secretary of State before the end of the period of 18 months beginning when this Act is passed, and
- (b) the Secretary of State must lay it before Parliament as soon as reasonably practicable.
- (3) If, within the 40-day period, either House of Parliament resolves not to approve a code prepared under section 121, 122, 123 or 124 , 124 or 124A, the Commissioner must not issue the code.
- (2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (3) If, within the 40-day period, either House of Parliament resolves not to approve a code prepared under section 121, 122, 123 , 124 or 124A, the Commissioner must not issue the code.
- (4) If no such resolution is made within that period—
@@ -3406,8 +3436,6 @@
- (b) the code comes into force at the end of the period of 21 days beginning with the day on which it is issued.
- (5) If, as a result of subsection (3), there is no code in force under section 121, 122, 123 or 124, the Commissioner must prepare another version of the code.
- (5) If the Commissioner is prevented by subsection (3) from issuing a code that is not a replacement code, the Commissioner must prepare another version of the code.
- (6) Nothing in subsection (3) prevents another version of the code being laid before Parliament.
@@ -3418,9 +3446,9 @@
- (b) if the code is laid before the Houses of Parliament on different days, the period of 40 days beginning with the later of those days.
- (8) In calculating the 40-day period, no account is to be taken of any period during which Parliament is dissolved or prorogued or during which both Houses of Parliament are adjourned for more than 4 days.
- (9) This section, other than subsections (2) and (5), applies in relation to amendments prepared under section 121, 122, 123 or 124 , 124 or 124A as it applies in relation to codes prepared under those sections.
- (8) In calculating the 40-day period, no account is to be taken of any whole days that fall within a period during which Parliament is dissolved or prorogued or during which both Houses of Parliament are adjourned for more than 4 days.
- (9) This section, other than subsection (5), applies in relation to amendments prepared under section 121, 122, 123 , 124 or 124A as it applies in relation to codes prepared under those sections.
#### Publication and review of codes issued under section 125(4)
@@ -3436,7 +3464,7 @@
- (3) The Commissioner must keep under review each code issued under section 125(4) for the time being in force.
- (4) Where the Commissioner becomes aware that the terms of such a code could result in a breach of an international obligation of the United Kingdom, the Commissioner must exercise the power under section 121(2), 122(2), 123(2) or 124(2) , 124(2) or 124A(3) with a view to remedying the situation.
- (4) Where the Commissioner becomes aware that the terms of such a code could result in a breach of an international obligation of the United Kingdom, the Commissioner must exercise the power under section 121(2), 122(2), 123(2) , 124(2) or 124A(3) with a view to remedying the situation.
#### Effect of codes issued under section 125(4)
@@ -3468,33 +3496,7 @@
##### 128
- (1) The Secretary of State may by regulations require the Commissioner—
- (a) to prepare appropriate codes of practice giving guidance as to good practice in the processing of personal data, and
- (b) to make them available to such persons as the Commissioner considers appropriate.
- (2) Before preparing such codes, the Commissioner must consult such of the following as the Commissioner considers appropriate—
- (a) trade associations;
- (b) data subjects;
- (c) persons who appear to the Commissioner to represent the interests of data subjects.
- (3) Regulations under this section—
- (a) must describe the personal data or processing to which the code of practice is to relate, and
- (b) may describe the persons or classes of person to whom it is to relate.
- (4) Regulations under this section are subject to the negative resolution procedure.
- (5) In this section—
- “*good practice in the processing of personal data*” means such practice in the processing of personal data as appears to the Commissioner to be desirable having regard to the interests of data subjects and others, including compliance with the requirements of the data protection legislation;
- “*trade association*” includes a body representing controllers or processors.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
### Consensual audits
@@ -3506,7 +3508,7 @@
- (2) The Commissioner must inform the controller or processor of the results of such an assessment.
- (3) In this section, “*good practice in the processing of personal data*” has the same meaning as in section 128 124A.
- (3) In this section, “*good practice in the processing of personal data*” has the same meaning as in section 124A.
### Records of national security certificates
@@ -3776,7 +3778,25 @@
- (c) publish it.
- (2) The report must include the annual report required under Article 59 of the UK GDPR.
- (1A) In connection with the Commissioner’s functions under the data protection legislation, the report must contain (among other things)—
- (a) a review of what the Commissioner has done during the reporting period to comply with the duties under—
- (i) sections 120A and 120B,
- (ii) section 108 of the Deregulation Act 2015, and
- (iii) section 21 of the Legislative and Regulatory Reform Act 2006,
including a review of the operation of the strategy prepared and published under section 120C;
- (b) a review of what the Commissioner has done during the reporting period to comply with the duty under section 120D.
- (1B) In subsection (1A), “*the reporting period*” means the period to which the report relates.
- (2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (2A) The report under this section may include the annual report under section 161A.
- (3) The Commissioner may produce other reports relating to the carrying out of the Commissioner's functions and arrange for them to be laid before Parliament.
@@ -3790,7 +3810,39 @@
##### 141
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (1) This section applies in relation to a notice authorised or required by this Act to be given to a person by the Commissioner.
- (2) The notice may be given to an individual—
- (a) by delivering it to the individual,
- (b) by sending it to the individual by post addressed to the individual at his or her usual or last-known place of residence or business, or
- (c) by leaving it for the individual at that place.
- (3) The notice may be given to a body corporate or unincorporate—
- (a) by sending it by post to the proper officer of the body at its principal office, or
- (b) by addressing it to the proper officer of the body and leaving it at that office.
- (4) The notice may be given to a partnership in Scotland—
- (a) by sending it by post to the principal office of the partnership, or
- (b) by addressing it to that partnership and leaving it at that office.
- (5) The notice may be given to the person by other means, including by electronic means, with the person's consent.
- (6) In this section—
- “*principal office*”, in relation to a registered company, means its registered office;
- “*proper officer*”, in relation to any body, means the secretary or other executive officer charged with the conduct of its general affairs;
- “*registered company*” means a company registered under the enactments relating to companies for the time being in force in the United Kingdom.
- (7) This section is without prejudice to any other lawful method of giving a notice.
## PART 6 — Enforcement
@@ -3802,9 +3854,9 @@
- (1) The Commissioner may, by written notice (an “information notice”)—
- (a) require a controller or processor to provide the Commissioner with information or documents that the Commissioner reasonably requires for the purposes of carrying out the Commissioner's functions under the data protection legislation, or
- (b) require any person to provide the Commissioner with information or documents that the Commissioner reasonably requires for the purposes of—
- (a) require a controller or processor to provide the Commissioner with information that the Commissioner reasonably requires for the purposes of carrying out the Commissioner's functions under the data protection legislation, or
- (b) require any person to provide the Commissioner with information that the Commissioner reasonably requires for the purposes of—
- (i) investigating a suspected failure of a type described in section 149(2) or a suspected offence under this Act, or
@@ -3814,17 +3866,17 @@
- (a) whether it is given under subsection (1)(a), (b)(i) or (b)(ii), and
- (b) why the Commissioner requires the information or documents.
- (b) why the Commissioner requires the information.
- (3) An information notice—
- (a) may specify or describe particular information or documents or a category of information or documents;
- (b) may specify the form in which the information or documents must be provided;
- (c) may specify the time at which, or the period within which, the information or documents must be provided;
- (d) may specify the place where the information or documents must be provided;
- (a) may specify or describe particular information or a category of information;
- (b) may specify the form in which the information must be provided;
- (c) may specify the time at which, or the period within which, the information must be provided;
- (d) may specify the place where the information must be provided;
(but see the restrictions in subsections (5) to (7)).
@@ -3834,17 +3886,17 @@
- (b) the rights under sections 162 and 164 (appeals etc).
- (5) An information notice may not require a person to provide information or documents before the end of the period within which an appeal can be brought against the notice.
- (6) If an appeal is brought against an information notice, the information or documents need not be provided pending the determination or withdrawal of the appeal.
- (5) An information notice may not require a person to provide information before the end of the period within which an appeal can be brought against the notice.
- (6) If an appeal is brought against an information notice, the information need not be provided pending the determination or withdrawal of the appeal.
- (7) If an information notice—
- (a) states that, in the Commissioner's opinion, the information or documents are required urgently, and
- (a) states that, in the Commissioner's opinion, the information is required urgently, and
- (b) gives the Commissioner's reasons for reaching that opinion,
subsections (5) and (6) do not apply but the notice must not require the information or documents to be provided before the end of the period of 24 hours beginning when the notice is given.
subsections (5) and (6) do not apply but the notice must not require the information to be provided before the end of the period of 24 hours beginning when the notice is given.
- (8) The Commissioner may cancel an information notice by written notice to the person to whom it was given.
@@ -3864,17 +3916,17 @@
- (i) has reasonable grounds for suspecting that such a determination could be made, and
- (ii) the information or documents are required for the purposes of making such a determination.
- (2) An information notice does not require a person to give the Commissioner information or documents to the extent that requiring the person to do so would involve an infringement of the privileges of either House of Parliament.
- (3) An information notice does not require a person to give the Commissioner information or documents to the extent that requiring the person to do so would result in the disclosure of a communication which is made—
- (ii) the information is required for the purposes of making such a determination.
- (2) An information notice does not require a person to give the Commissioner information to the extent that requiring the person to do so would involve an infringement of the privileges of either House of Parliament.
- (3) An information notice does not require a person to give the Commissioner information in respect of a communication which is made—
- (a) between a professional legal adviser and the adviser's client, and
- (b) in connection with the giving of legal advice to the client with respect to obligations, liabilities or rights under the data protection legislation.
- (4) An information notice does not require a person to give the Commissioner information or documents to the extent that requiring the person to do so would result in the disclosure of a communication which is made—
- (4) An information notice does not require a person to give the Commissioner information in respect of a communication which is made—
- (a) between a professional legal adviser and the adviser's client or between such an adviser or client and another person,
@@ -3884,7 +3936,7 @@
- (5) In subsections (3) and (4), references to the client of a professional legal adviser include references to a person acting on behalf of the client.
- (6) An information notice does not require a person to provide the Commissioner with information or documents if doing so would, by revealing evidence of the commission of an offence expose the person to proceedings for that offence.
- (6) An information notice does not require a person to provide the Commissioner with information if doing so would, by revealing evidence of the commission of an offence expose the person to proceedings for that offence.
- (7) The reference to an offence in subsection (6) does not include an offence under—
@@ -3922,17 +3974,17 @@
- (2) The court may make an order requiring the person to provide to the Commissioner some or all of the following—
- (a) information referred to in the information or documents notice;
- (b) other information or documents which the court is satisfied the Commissioner requires, having regard to the statement included in the notice in accordance with section 142(2)(b).
- (a) information referred to in the information notice;
- (b) other information which the court is satisfied the Commissioner requires, having regard to the statement included in the notice in accordance with section 142(2)(b).
- (3) The order—
- (a) may specify the form in which the information or documents must be provided,
- (b) must specify the time at which, or the period within which, the information or documents must be provided, and
- (c) may specify the place where the information or documents must be provided.
- (a) may specify the form in which the information must be provided,
- (b) must specify the time at which, or the period within which, the information must be provided, and
- (c) may specify the place where the information must be provided.
### Assessment notices
@@ -4060,7 +4112,7 @@
- (1) This section applies where a person—
- (a) has been given an information or a document notice requiring the person to provide the Commissioner with information, or
- (a) has been given an information notice requiring the person to provide the Commissioner with information, or
- (b) has been given an assessment notice requiring the person to direct the Commissioner to a document, equipment or other material or to assist the Commissioner to view information.
@@ -4428,7 +4480,7 @@
- (3) Regulations under this section are subject to the affirmative resolution procedure.
### Guidance
### Guidance and report
#### Guidance about regulatory action
@@ -4448,7 +4500,7 @@
- (3) In relation to information notices, the guidance must include—
- (a) provision specifying factors to be considered in determining the time at which, or the period within which, information or documents are to be required to be provided;
- (a) provision specifying factors to be considered in determining the time at which, or the period within which, information is to be required to be provided;
- (b) provision about the circumstances in which the Commissioner would consider it appropriate to give an information notice to a person in reliance on section 142(7) (urgent cases);
@@ -4546,7 +4598,7 @@
- (b) if the guidance is laid before the Houses of Parliament on different days, the period of 40 days beginning with the later of those days.
- (6) In calculating the 40-day period, no account is to be taken of any period during which Parliament is dissolved or prorogued or during which both Houses of Parliament are adjourned for more than 4 days.
- (6) In calculating the 40-day period, no account is to be taken of any whole days that fall within a period during which Parliament is dissolved or prorogued or during which both Houses of Parliament are adjourned for more than 4 days.
### Appeals etc
@@ -5158,7 +5210,7 @@
- (c) the Executive Office in Northern Ireland.
### Jurisdiction of courts
### Jurisdiction and court procedure
#### Jurisdiction
@@ -5212,7 +5264,7 @@
- “*penalty variation notice*” has the meaning given in Schedule 16;
- “*representative*”, in relation to a controller or processor, means a person designated by the controller or processor under Article 27 of the UK GDPR to represent the controller or processor with regard to the controller's or processor's obligations under the UK GDPR.
- ...
## PART 7 — Supplementary and final provision
@@ -5388,7 +5440,7 @@
##### 186
- (1) An enactment or rule of law prohibiting or restricting the disclosure of information, or authorising the withholding of information, does not remove or restrict the obligations and rights provided for in the provisions listed in subsection (2), except as provided by or under the provisions listed in subsection (3).
- (1) An enactment or rule of law prohibiting or restricting the disclosure of information, or authorising the withholding of information, does not remove or restrict the obligations and rights provided for in the provisions listed in subsection (2) ....
- (2) The provisions providing obligations and rights are—
@@ -5398,13 +5450,25 @@
- (c) Chapter 3 of Part 4 of this Act (intelligence services processing: rights of the data subject).
- (3) The provisions providing exceptions are—
- (2A) Subsection (1) does not apply—
- (a) to an enactment contained in, or made under, a provision listed in subsection (2),
- (b) to an enactment contained in, or made under, a provision listed in subsection (3),
- (c) to the extent that an enactment makes express provision to the contrary referring to this section or to a provision listed in subsection (2), or
- (d) to the extent that subsection (1) is disapplied by section 186A(3).
- (3) The provisions referred to in subsection (2A)(b) are—
- (a) in Chapter 2 of Part 2 of this Act, sections 15 and 16 and Schedules 2, 3 and 4,
- (b) in Chapter 3 of Part 2 of this Act, sections ... 24, 25 and 26,
- (c) in Part 3 of this Act, sections 44(4), 45(4) and 48(3), and
- (c) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
- (ca) in Part 3 of this Act, section 78A, and
- (d) in Part 4 of this Act, Chapter 6 .
@@ -5624,7 +5688,7 @@
- (b) if the document is laid before the Houses of Parliament on different days, the period of 40 days beginning with the later of those days.
- (6) In calculating the 40-day period, no account is to be taken of any period during which Parliament is dissolved or prorogued or during which both Houses of Parliament are adjourned for more than 4 days.
- (6) In calculating the 40-day period, no account is to be taken of any whole days that fall within a period during which Parliament is dissolved or prorogued or during which both Houses of Parliament are adjourned for more than 4 days.
- (7) This section applies in relation to amendments prepared under section 191 as it applies in relation to a document prepared under that section.
@@ -5848,7 +5912,7 @@
- (a) a person does something, or fails to do something, in relation to proceedings before the First-tier Tribunal—
- (i) on an appeal under section 27, 79, 111 or 162, or
- (i) on an appeal under section 27, 79, 82E, 111 or 162, or
- (ii) for an order under section 166, and
@@ -5874,7 +5938,7 @@
- (1) Tribunal Procedure Rules may make provision for regulating—
- (a) the exercise of the rights of appeal conferred by section 27, 79, 111 or 162, and
- (a) the exercise of the rights of appeal conferred by section 27, 79, 82E, 111 or 162, and
- (b) the exercise of the rights of data subjects under section 166, including their exercise by a representative body.
@@ -6029,6 +6093,8 @@
- (k) Schedule 5;
- (l) paragraph 11(5) of Schedule 12;
- (la) paragraph 22(6) of Schedule 12A;
- (m) Schedule 15;
@@ -10491,11 +10557,11 @@
- (2) If the information notice—
- (a) states that, in the Commissioner's opinion, the information or documents are required for the purposes of the relevant review, and
- (a) states that, in the Commissioner's opinion, the information is required for the purposes of the relevant review, and
- (b) gives the Commissioner's reasons for reaching that opinion,
subsections (5) and (6) of section 142 do not apply but the notice must not require the information or documents to be provided before the end of the period of 24 hours beginning when the notice is given.
subsections (5) and (6) of section 142 do not apply but the notice must not require the information to be provided before the end of the period of 24 hours beginning when the notice is given.
#### Assessment notices
@@ -17258,8 +17324,6 @@
[^c23269021]: S. 113 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23269091]: S. 128 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23269101]: S. 137 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
[^c23269111]: S. 138 in force at Royal Assent for specified purposes, see [s. 212(2)(f)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/2/f)
@@ -17302,18 +17366,18 @@
[^key-00432701eea2cde637ac5d287f4837c8]: [Sch. 19 para. 333](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/333) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-008659743a491eb703127dd80e785478]: Words in [s. 124(5)](https://www.legislation.gov.uk/ukpga/2018/12/section/124/5) omitted (20.8.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 18(a)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/18/a); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(y)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/y)
[^key-00c31acc0526af8b197626c45f603186]: S. 103 in force at 16.9.2019 by [S.I. 2019/1188](https://www.legislation.gov.uk/uksi/2019/1188), [reg. 2(c)](https://www.legislation.gov.uk/uksi/2019/1188/regulation/2/c)
[^key-00c758a7ac86c77eefdd5f1b71cbb8bf]: [S. 141A](https://www.legislation.gov.uk/ukpga/2018/12/section/141A) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 96(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/96/3), [142(3)(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/c)
[^key-0151e6e5fb83621e5135c6a115a3b8a7]: Words in [s. 145(2)(b)](https://www.legislation.gov.uk/ukpga/2018/12/section/145/2/b) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(4)(a)(ii)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/4/a/ii), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-019c61443b227cfc431617e576673df8]: [Sch. 19 para. 368](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/368) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-01e0b7c056d90098dda06c025884a600]: Sch. 1 para. 40 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-020bbab2a3937097fe87c235aa9d2876]: Words in Sch. 2 Pt. 6 heading omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(22)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/22) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-02257d73d63a015dfbb50ba43425dda5]: [S. 180A](https://www.legislation.gov.uk/ukpga/2018/12/section/180A) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 104(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/104/3), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(j)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/j)
[^key-0228d23a866d3b67264125f2ef6b7ee5]: Words in s. 26(2)(c) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 34(3)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/34/3/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-0261d887a09ac80ed5671762eabc2d89]: Words in s. 17(7) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 22(5)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/22/5/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -17322,10 +17386,10 @@
[^key-028cd06e6f950f4558cd72890b7ed743]: [Sch. 19 para. 257](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/257) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-02a6528f0ef1de1eccead8b29c583d45]: [S. 66(3)](https://www.legislation.gov.uk/ukpga/2018/12/section/66/3) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 84(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/84/5), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(d)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/d)
[^key-02c9392ccbfe5d518f4e56dba15b087b]: [Sch. 19 para. 139](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/139) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-02eed618ae57b0b75a35be24947c98f7]: Words in [s. 142(2)(b)](https://www.legislation.gov.uk/ukpga/2018/12/section/142/2/b) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(2)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/2/b), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-03a41268b1f986aee847dad7f0702a19]: Words in Sch. 2 para. 26(9)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(21)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/21/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-03be80b9d01d85e387feb8f4beaf6d2f]: [Sch. 19 para. 32](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/32) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -17342,7 +17406,7 @@
[^key-04a116e5e2b279f99e07bb7fc9c120bd]: [Sch. 19 para. 69](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/69) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-04cca2bcdf064e1c878b25ce5564c73c]: Words in [s. 142(1)(a)](https://www.legislation.gov.uk/ukpga/2018/12/section/142/1/a) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(2)(a)(i)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/2/a/i), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-04b978162a0ac7cecff53b38d4c65267]: [S. 33(6A)](https://www.legislation.gov.uk/ukpga/2018/12/section/33/6A) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 74(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/74/3), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(c)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/c)
[^key-04deb533ed57e15add641215ed3efabf]: Sch. 20 para. 46 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -17352,6 +17416,8 @@
[^key-05db1f618adcd0f850b18cfe67f3c291]: Words in Sch. 2 para. 4(2) substituted (8.3.2024) by [The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024 (S.I. 2024/342)](https://www.legislation.gov.uk/uksi/2024/342), [regs. 1(2)](https://www.legislation.gov.uk/uksi/2024/342/regulation/1/2), [2(5)](https://www.legislation.gov.uk/uksi/2024/342/regulation/2/5)
[^key-067b411a6f252d978f5363bb7f8fd473]: Words in [s. 161(6)](https://www.legislation.gov.uk/ukpga/2018/12/section/161/6) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 21](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/21); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(y)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/y)
[^key-068079f0d354b65a415f2cdd6d742510]: Word in s. 165(5)(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 66(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/66/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-06e85acf6fae37d9f442573e440e4c13]: Words in s. 24(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 32(2)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/32/2/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -17368,14 +17434,10 @@
[^key-078834edf1fff161c9e6fa81ce234817]: Words in s. 183(2)(d) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 78(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/78/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-07dd60af0f18471b7222d90e518ad588]: Words in [s. 143(1)(b)(ii)](https://www.legislation.gov.uk/ukpga/2018/12/section/143/1/b/ii) substituted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(3)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/3/a), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-07dee8d69012da87b02291e4c8e3d699]: Sch. 2 para. 11 table modified (28.1.2021 for specified purposes, 30.7.2022 in so far as not already in force) by [The Financial Services and Markets Act 2000 (Regulated Activities) (Amendment) Order 2021 (S.I. 2021/90)](https://www.legislation.gov.uk/uksi/2021/90), [arts. 1(2)](https://www.legislation.gov.uk/uksi/2021/90/article/1/2)[(3)](https://www.legislation.gov.uk/uksi/2021/90/article/1/3), [15(2)](https://www.legislation.gov.uk/uksi/2021/90/article/15/2)
[^key-07e5424a1ee2d09e154dd4e8255595ea]: Words in s. 73(3)(c) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 40(3)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/40/3/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-084b887a076ea35667f44af638a1383c]: Words in s. 3(9)(e) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 4(3)(c)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/4/3/c) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-0876256c5ad3d60e361b782c4058e808]: [Sch. 19 para. 224](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/224) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-08a66ca2af7b4b1ea6d3d87306a370f7]: Words in Sch. 2 para. 1(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(5)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/5/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -17384,6 +17446,8 @@
[^key-08f0dc8ee77a2e679c674a1653b65e89]: [Sch. 19 para. 44](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/44) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-08f4a6329ad10a2e9314dee57073b8be]: Words in s. 206 Table inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 74(9)](https://www.legislation.gov.uk/ukpga/2025/18/section/74/9), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(c)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/c)
[^key-0980e055af9390b4571e201b8f8aafaa]: Words in s. 1(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 2(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/2/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-09ad4c27f1d1f5107104ceb3233831b0]: [Sch. 19 para. 104](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/104) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -17410,7 +17474,7 @@
[^key-0c64f94808e62ce8c06e20ffbc5b1116]: [Sch. 16 para. 4](https://www.legislation.gov.uk/ukpga/2018/12/schedule/16/paragraph/4) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-0c921886eda65d928d0d76962456ecfe]: S. 124A inserted (19.6.2025 for specified purposes) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 92(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/92/2), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h)
[^key-0c921886eda65d928d0d76962456ecfe]: [S. 124A](https://www.legislation.gov.uk/ukpga/2018/12/section/124A) inserted (19.6.2025 for specified purposes, 20.8.2025 in so far as not already in force) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 92(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/92/2), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(f)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/f)
[^key-0c925c155f884ff322d1f06c0cf09a74]: [Sch. 19 para. 239](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/239) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -17452,6 +17516,8 @@
[^key-111f1a1c71e0256436529fc90b060e72]: [Sch. 7 para. 26](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/26) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-1129e4d0e1a9eae74e5f5e286620ccd1]: Words in s. 186(3) substituted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 106(4)(d)(i)](https://www.legislation.gov.uk/ukpga/2025/18/section/106/4/d/i), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(k)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/k)
[^key-1148dc6616b45f92ec3191558e2d7f41]: [Sch. 19 para. 353](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/353) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-1184aae7611f8dceba09b9e679d2f54c]: Sch. 1 para. 34 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
@@ -17476,6 +17542,8 @@
[^key-1366acd7f95a9c1e06161794880e0719]: Sch. 20 para. 35 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-13cffa7e513a8d19da475b708717a6c5]: [S. 161A](https://www.legislation.gov.uk/ukpga/2018/12/section/161A) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 102(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/102/4), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(i)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/i)
[^key-145f005fd8042c51b0664ff136e39957]: [Sch. 7 para. 18](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/18) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-14aa686d4a0f1f82327479d58921ab37]: [Sch. 19 para. 331](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/331) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -17526,6 +17594,10 @@
[^key-1a7fa63e5530837c3583f0e5c7220882]: Words in s. 5(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 6(2)(c)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/6/2/c) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-1aa44aabdb698a96bbb40d99be769ffe]: Words in [s. 181](https://www.legislation.gov.uk/ukpga/2018/12/section/181) omitted (20.8.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 24](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/24); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(y)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/y)
[^key-1ae0cb7d1e50923dabeee3e28331a92e]: S. 206: power to amend conferred (19.6.2025 for specified purposes, 20.8.2025 in so far as not already in force) by Regulation (EU) 679/2016, Art. 11A(3) (as inserted by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 74(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/74/1), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(c)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/c))
[^key-1aeb023a0722a101af167f5207dc0988]: [Sch. 20 para. 1](https://www.legislation.gov.uk/ukpga/2018/12/schedule/20/paragraph/1) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-1affb68b010b011243d40d4337506c52]: Word in s. 205(5) substituted (1.1.2024) by [The Retained EU Law (Revocation and Reform) Act 2023 (Consequential Amendment) Regulations 2023 (S.I. 2023/1424)](https://www.legislation.gov.uk/uksi/2023/1424), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2023/1424/regulation/1/2), [Sch. para. 87(b)](https://www.legislation.gov.uk/uksi/2023/1424/schedule/paragraph/87/b)
@@ -17544,8 +17616,6 @@
[^key-1c131e673e4b114091bed8a61ac7815e]: [Sch. 9 para. 3](https://www.legislation.gov.uk/ukpga/2018/12/schedule/9/paragraph/3) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-1c7da355aeeff85be527b5f792bfd29e]: Words in [Sch. 17 para. 2(2)](https://www.legislation.gov.uk/ukpga/2018/12/schedule/17/paragraph/2/2) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(7)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/7/b), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-1cc22440a757c75d6a761e14e8508d42]: Sch. 20 para. 18(8) inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 101(4)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/101/4/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)) (as amended by [S.I. 2020/1586](https://www.legislation.gov.uk/uksi/2020/1586), [regs. 1(2)](https://www.legislation.gov.uk/uksi/2020/1586/regulation/1/2), [5(3)](https://www.legislation.gov.uk/uksi/2020/1586/regulation/5/3)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-1ccd56afc99d98d997ea26936d814e5e]: [Sch. 7 para. 35](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/35) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
@@ -17554,7 +17624,7 @@
[^key-1d18615dcf9a20c1820111b3a81f31c2]: [Sch. 19 para. 302](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/302) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-1d193e02860f55c99db471219ec3f06e]: [Sch. 7 para. 47](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/47) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-1d193e02860f55c99db471219ec3f06e]: Sch. 7 para. 47 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-1d55fa5fc856a1be58b2f58fd5d98059]: S. 165(6) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 66(4)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/66/4) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -17690,8 +17760,6 @@
[^key-2a00008589acb6f36983567b9fc6e820]: [Sch. 19 para. 120](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/120) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-2a10ec67b795dad031d7e434ef582e79]: Words in s. 2(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 3](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-2a3a6de533c8c12b0494351998aa1271]: Sch. 20 para. 24 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-2acdeca126a2ebe1ce6a4586947c1173]: [Sch. 19 para. 306](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/306) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -17710,8 +17778,6 @@
[^key-2c7e00ac1f688e12ca2bcc445e3ef4a8]: [Sch. 19 para. 192](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/192) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-2ca4732bc3269bd15c7a1977be4e7b34]: Words in s. 20 substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 26(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/26/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-2d48534b027b25a30a2b80c2a510dd6b]: [Sch. 19 para. 243](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/243) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-2d89ded5d2f38b02918f66bf72aa9a67]: [Sch. 19 para. 34](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/34) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -17724,6 +17790,8 @@
[^key-2e19ecb9205e26fabcbb68559b8159f5]: Words in s. 24(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 32(2)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/32/2/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-2ee236ebdbefaa20152eb5e389c3f15f]: [S. 139A](https://www.legislation.gov.uk/ukpga/2018/12/section/139A) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 95](https://www.legislation.gov.uk/ukpga/2025/18/section/95), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(h)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/h)
[^key-2f0e9d2ad7758b3d8eeaabe264498df0]: [Sch. 15 para. 11](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/11) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-2f2b6b8a9c341182dd7aa56637785a0a]: Words in Sch. 2 para. 1(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(5)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/5/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -17740,6 +17808,8 @@
[^key-30f8f37f3351a58e02d6f5b4850e8f6a]: [Sch. 19 para. 299](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/299) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-30fb2804b001c6b0ad13a62b29019b1d]: [S. 128](https://www.legislation.gov.uk/ukpga/2018/12/section/128) omitted (20.8.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 92(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/92/5), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(f)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/f)
[^key-3119209adeaef6a1df5147b527a4b2b7]: Words in s. 77(8) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 44](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/44) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-31302a37f9c6f4ae81079d8a479c0dc1]: [Sch. 19 para. 169](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/169) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -17752,6 +17822,10 @@
[^key-3180f2fd1280321b20ee6e24d5d513cc]: Sch. 1 para. 9 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-318cdee146a506edd9aa20e0bb24b3f9]: Word in [s. 86(7)](https://www.legislation.gov.uk/ukpga/2018/12/section/86/7) substituted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 74(7)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/74/7/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(c)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/c)
[^key-31bb776982600aed74cbcf435538a957]: Words in s. 125(8) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 19(3)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/19/3); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(y)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/y)
[^key-31dcfda5dcd4e66221acf33abd97bf04]: Sch. 20 para. 23 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-324729d85d46bf435833df74eab03372]: Words in s. 26(2)(e) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 34(3)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/34/3/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -17776,6 +17850,8 @@
[^key-33edea286b09352abf016a9e1f3354e0]: [S. 120(2A)](https://www.legislation.gov.uk/ukpga/2018/12/section/120/2A) inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 52(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/52/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-343856c646dbefbbbdfd8912476af912]: [S. 139(2A)](https://www.legislation.gov.uk/ukpga/2018/12/section/139/2A) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 102(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/102/2), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(i)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/i)
[^key-34cd2e6cbe01eabb3d06225a7efe69b9]: Words in s. 205(2) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 85(5)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/85/5/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-34d8058ca9b991f37fca48403aab4b4a]: Words in s. 25(2)(a) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 33(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/33/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -17820,6 +17896,8 @@
[^key-37cead3703128bdbe14f9449c15cb01c]: Words in [s. 115(2)](https://www.legislation.gov.uk/ukpga/2018/12/section/115/2) inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 47(4)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/47/4/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-37f00e3fbcf6a1325a7bdb8cee3541b8]: Words in [s. 3(9)(d)](https://www.legislation.gov.uk/ukpga/2018/12/section/3/9/d) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 107(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/107/2), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(l)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/l)
[^key-3813ee8247c9e3239d38238f596aab7f]: Words in [s. 120(6)](https://www.legislation.gov.uk/ukpga/2018/12/section/120/6) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 52(4)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/52/4) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-38b76457e1736087523fe425b9baf70a]: [Sch. 19 para. 371](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/371) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -17862,6 +17940,8 @@
[^key-3b189075aee602d5dd61a066dc8f918f]: [Sch. 19 para. 43](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/43) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-3b334490a5b70cdd54dc63818afde14d]: [S. 2(2)](https://www.legislation.gov.uk/ukpga/2018/12/section/2/2) omitted (20.8.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 91(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/91/2), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(e)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/e)
[^key-3c0bda84559a635149b77d2604f5e78b]: [Sch. 19 para. 308](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/308) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-3c2c46a40b01364a2f55ced34f0da62b]: Sch. 2 para. 17 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
@@ -17874,6 +17954,8 @@
[^key-3c9f258002e16325ad02c0bb9c1494d2]: S. 48(8) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 38](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/38) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-3cb3866fa4cb74bba6a6aa92e8ffe358]: Words in [s. 124(5)](https://www.legislation.gov.uk/ukpga/2018/12/section/124/5) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 18(b)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/18/b); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(y)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/y)
[^key-3cd4b21c486fb333c4f69a8f7f6ab0fa]: Sch. 1 para. 27 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-3d084b212bc615dd082bd37fe99059b7]: Words in s. 19(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 25](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/25) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -17884,6 +17966,8 @@
[^key-3d4bdf3729cdaf65278d4e8242b8c0e8]: [Sch. 19 para. 76](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/76) omitted (29.3.2019) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(3)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/3), [Sch. 4 para. 3](https://www.legislation.gov.uk/uksi/2019/419/schedule/4/paragraph/3)
[^key-3d53c868b8cc9dd299c7ae1b85106a23]: [S. 71A](https://www.legislation.gov.uk/ukpga/2018/12/section/71A) and cross-heading inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 84(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/84/6), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(d)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/d)
[^key-3e188053ee3dc28fc28c56ca4e8c9040]: Words in s. 185(4)(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 79](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/79) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-3e3a8fdd4b1ab84d341304a4ffa3ea74]: [Sch. 7 para. 15A](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/15A) inserted (1.5.2022 for specified purposes, 5.12.2022 in so far as not already in force) by [Armed Forces Act 2021 (c. 35)](https://www.legislation.gov.uk/ukpga/2021/35), [s. 24(1)](https://www.legislation.gov.uk/ukpga/2021/35/section/24/1), [Sch. 5 para. 49](https://www.legislation.gov.uk/ukpga/2021/35/schedule/5/paragraph/49); [S.I. 2022/471](https://www.legislation.gov.uk/uksi/2022/471), [reg. 2(e)](https://www.legislation.gov.uk/uksi/2022/471/regulation/2/e); [S.I. 2022/1095](https://www.legislation.gov.uk/uksi/2022/1095), [reg. 4](https://www.legislation.gov.uk/uksi/2022/1095/regulation/4)
@@ -17896,7 +17980,7 @@
[^key-3eb4d6aaf025a6d26ecf486d178f137f]: Words in [s. 115(2)(b)](https://www.legislation.gov.uk/ukpga/2018/12/section/115/2/b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 47(4)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/47/4/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-3eefcad59e5059bb1f25e0745e831a85]: Word in s. 129(3) substituted (19.6.2025 for specified purposes) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 92(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/92/6), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h)
[^key-3eefcad59e5059bb1f25e0745e831a85]: Word in [s. 129(3)](https://www.legislation.gov.uk/ukpga/2018/12/section/129/3) substituted (19.6.2025 for specified purposes, 20.8.2025 in so far as not already in force) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 92(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/92/6), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(f)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/f)
[^key-3ef88b0e811cc1444359e5e0cb768e95]: Words in s. 28(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 36(3)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/36/3/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -17972,8 +18056,6 @@
[^key-479c0bc37322fff5ab05a964ed5802b3]: [Sch. 19 para. 162](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/162) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-47b298b6510458494f665aeeee02e734]: S. 82(4) inserted (19.6.2025 for specified purposes) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 89(2)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/89/2/d), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h)
[^key-47be8568fc2fb24fc749f0903b5c4987]: Words in s. 7(4) substituted (25.1.2023) by [Advanced Research and Invention Agency Act 2022 (c. 4)](https://www.legislation.gov.uk/ukpga/2022/4), [s. 13(1)](https://www.legislation.gov.uk/ukpga/2022/4/section/13/1), [Sch. 3 para. 14(b)](https://www.legislation.gov.uk/ukpga/2022/4/schedule/3/paragraph/14/b); [S.I. 2023/58](https://www.legislation.gov.uk/uksi/2023/58), [reg. 2](https://www.legislation.gov.uk/uksi/2023/58/regulation/2)
[^key-48556573bb2ddc6e999946cea4c7d1d1]: Words in [Sch. 2](https://www.legislation.gov.uk/ukpga/2018/12/schedule/2) heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -17994,10 +18076,10 @@
[^key-4ac91bf85ec11b5b09d2cffc0834e330]: [Sch. 11 para. 3](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/3) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-4acce7a36a65b3dfa88122e1ac018720]: Words in s. 206 Table inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 117(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/117/5), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(r)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/r)
[^key-4ade17abe3f68bf256bff4f2dbb59e3d]: Sch. 20 para. 53 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4b642711f954150ccf908648bde13d63]: Words in [s. 148(1)(a)](https://www.legislation.gov.uk/ukpga/2018/12/section/148/1/a) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/5), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-4b9e6d497580985481a70ac53ffb3760]: [Sch. 19 para. 71](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/71) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4bf0023fc0abe3a6fe28e97ae0db6c8a]: [Sch. 19 para. 96](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/96) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -18006,7 +18088,7 @@
[^key-4c80cd42315c6365ff023e85a763c2e5]: Words in s. 18 heading inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 24(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/24/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-4cb750ea4557f2baffcc01c9e44b677f]: [Sch. 7 para. 50](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/50) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-4cb750ea4557f2baffcc01c9e44b677f]: Sch. 7 para. 50 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-4cdb09090293d26d78397375ceeeef64]: Word in s. 205(1) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 85(2)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/85/2/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -18028,8 +18110,6 @@
[^key-4e06da20a4ee2b31f0f19b9c470f9b8d]: Words in Sch. 1 para. 2(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 91(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/91/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-4e6c9c54c594cef5e10f575175d7fcbd]: Words in [s. 62(3)(a)](https://www.legislation.gov.uk/ukpga/2018/12/section/62/3/a) omitted (19.8.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 82(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/82/b), [142(3)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/b)
[^key-4ebd65ab97e317d6c230a09c8743e730]: [Sch. 19 para. 226](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/226) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4ed31dd55586adedeb9b02282604b867]: [Sch. 19 para. 93](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/93) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -18040,6 +18120,8 @@
[^key-4fdda46f1a69130f122c5704602c094d]: [Sch. 19 para. 379](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/379) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-4fe4b7529553a13b08d627389944bf71]: Words in s. 125(9) substituted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 19(4)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/19/4); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(y)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/y)
[^key-504da48b89f74e638a6616a94f7d03e2]: Words in [Sch. 19 para. 431(3)](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/431/3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 100(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/100/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-50685db8378599c3d063ffd01618c754]: Words in s. 155(2)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 63](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/63) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -18054,6 +18136,8 @@
[^key-522cc2ffd4fbefd6bc331626b37d8649]: Words in s. 159(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 65](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/65) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-523e415bc234f62c893d91846c4c7579]: [S. 3(9)(e)](https://www.legislation.gov.uk/ukpga/2018/12/section/3/9/e) and word omitted (20.8.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 14(b)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/14/b); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(y)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/y)
[^key-524d29be7a87de3454a3657a29965b20]: Words in Sch. 2 para. 27(3)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(23)(c)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/23/c) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-5277e76770029ad12ef38864a40b6300]: Sch. 20 para. 31 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -18068,8 +18152,6 @@
[^key-53926fd489411a896de84bf3547618a6]: S. 16(2)(c) and word inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 20(3)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/20/3/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-53d1de31240f0295cb3039470bdb3395]: Words in [s. 139(2)](https://www.legislation.gov.uk/ukpga/2018/12/section/139/2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 58](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/58) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-5408ef8b4fef9b4413225ee38a7c8a5d]: Words in s. 165(7) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 66(5)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/66/5) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-541c32cbb194df275a3b189f928f6db1]: [Sch. 19 para. 21](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/21) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -18134,7 +18216,7 @@
[^key-59b565f9ed686b63dd17fb78a246be4b]: [S. 148](https://www.legislation.gov.uk/ukpga/2018/12/section/148) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-59c00d0f4b9012edb2a6a3564ca2644d]: S. 9A and cross-heading inserted (19.6.2025 for specified purposes) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 72(7)](https://www.legislation.gov.uk/ukpga/2025/18/section/72/7), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h)
[^key-59c00d0f4b9012edb2a6a3564ca2644d]: [S. 9A and cross-heading](https://www.legislation.gov.uk/ukpga/2018/12/chapter/2/crossheading/relevant-international-law) inserted (19.6.2025 for specified purposes, 20.8.2025 for specified purposes) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 72(7)](https://www.legislation.gov.uk/ukpga/2025/18/section/72/7), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(b)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/b)
[^key-59da614434458460aa757b305cd350e7]: Sch. 1 para. 30 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
@@ -18144,20 +18226,14 @@
[^key-5a464370d8822b40169ec522a8d773a6]: Words in s. 13(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 16](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/16) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-5a6036fabcdc44d7c894770800035004]: Words in [s. 142(6)](https://www.legislation.gov.uk/ukpga/2018/12/section/142/6) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(2)(e)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/2/e), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-5a993e31296f76eedd2958f4cd0fda2d]: Sch. 20 para. 41 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5aa83acfda81d5aca3a7d879d20c8168]: Words in s. 206 Table omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 86(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/86/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-5ae2292fa42aa74f4748479a28697330]: [Sch. 7 para. 40](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/40) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-5b04cba0ff9c2386ec587ee807185e0e]: Words in s. 20 substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 26(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/26/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-5b3acd4e0294355b8e9efe356efa7aa4]: [Sch. 19 para. 272](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/272) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5b858014ae13f9f37bb30ecd8f277dba]: Words in [s. 160(3)(a)](https://www.legislation.gov.uk/ukpga/2018/12/section/160/3/a) substituted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/6), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-5bc0406a73661aa1415e2904b278ad74]: Words in s. 10(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 13(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/13/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-5c6ae5dec8a8b08bfa71e298026863d0]: S. 67(8) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 39](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/39) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -18170,8 +18246,6 @@
[^key-5caab894dc42fb6245859f88114c6ccf]: [Sch. 19 para. 60](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/60) in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5cb1dff5661525c0e4a57dfb72b1cf97]: Words in [s. 143(6)](https://www.legislation.gov.uk/ukpga/2018/12/section/143/6) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(3)(e)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/3/e), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-5cc8c98ed927a29271aa9009a37c3a98]: Words in Sch. 3 para. 7(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(10)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/10) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-5cca3ac8ac29e135e7479d669dca2466]: S. 21(5)(c) and word inserted (25.1.2023) by [Advanced Research and Invention Agency Act 2022 (c. 4)](https://www.legislation.gov.uk/ukpga/2022/4), [s. 13(1)](https://www.legislation.gov.uk/ukpga/2022/4/section/13/1), [Sch. 3 para. 15(2)(b)](https://www.legislation.gov.uk/ukpga/2022/4/schedule/3/paragraph/15/2/b); [S.I. 2023/58](https://www.legislation.gov.uk/uksi/2023/58), [reg. 2](https://www.legislation.gov.uk/uksi/2023/58/regulation/2)
@@ -18184,8 +18258,6 @@
[^key-5db10dd62a7df7a33ae32851a6f9dec0]: Words in Sch. 5 para. 6(4) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 95(c)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/95/c) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-5dc1af1f4e918371ecee11088fc21a02]: S. 206: power to amend conferred (19.6.2025 for specified purposes) by Regulation (EU) 679/2016, Art. 11A(3) (as inserted by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 74(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/74/1), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h))
[^key-5e45ce56358543510889bcd1e8168c6a]: [Sch. 19 para. 67](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/67) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-5ebc40ae0ba03aa3d9abb7a5c47c27a0]: Words in Sch. 4 heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 94(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/94/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -18226,12 +18298,12 @@
[^key-6119956a88aea2b8d3d486d7acad1a04]: Words in s. 26(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 34(2)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/34/2/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-613cb473c0df362a19eb8619512d010f]: [S. 84(6A)](https://www.legislation.gov.uk/ukpga/2018/12/section/84/6A) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 74(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/74/6), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(c)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/c)
[^key-619fd5f08f26b2ca35135ceac03355dc]: [Sch. 19 para. 197](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/197) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-61adeb92f11f45e0ec84df45e73f76e0]: [Sch. 19 para. 126](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/126) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-622f567d3f7f53ef9ee3fbcfe0629b1c]: Words in [s. 145(2)(a)](https://www.legislation.gov.uk/ukpga/2018/12/section/145/2/a) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(4)(a)(i)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/4/a/i), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-624b7f167b9be0eda00270c5e40aba6b]: Words in s. 15(4) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 19(10)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/19/10/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-624e37c2f534f473861144715410cd20]: Words in s. 33(7) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 37](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/37) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -18252,6 +18324,8 @@
[^key-63477ad6b0f04b0dec5c0e7403800ffa]: [Sch. 19 para. 108](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/108) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-634f3407a04ae2b50df4bc577770f7b4]: S. 205: power to amend conferred (19.6.2025 for specified purposes, 20.8.2025 in so far as not already in force) by Regulation (EU) 679/2016, Art. 11A(3) (as inserted by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 74(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/74/1), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(c)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/c))
[^key-63549367591b91b245c18fd99b767a4c]: [Sch. 7 para. 9](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/9) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-6419b8d564dad36243ede4ccbdddf886]: [Sch. 19 para. 301](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/301) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -18346,7 +18420,7 @@
[^key-6b73746ba6f7dc8aef1c83cf22349b69]: [Sch. 7 para. 31](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/31) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-6b973a6a6c7ca62745d334f519a01218]: [Sch. 7 para. 55](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/55) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-6b973a6a6c7ca62745d334f519a01218]: Sch. 7 para. 55 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-6ba7f5fc21c3deb0d65124e3508f832f]: Act applied (18.3.2022) by [The Cumbria (Structural Changes) Order 2022 (S.I. 2022/331)](https://www.legislation.gov.uk/uksi/2022/331), [arts. 1(1)](https://www.legislation.gov.uk/uksi/2022/331/article/1/1), [18(2)(e)](https://www.legislation.gov.uk/uksi/2022/331/article/18/2/e)
@@ -18388,6 +18462,8 @@
[^key-700cdd34340327bf52d7691ef5189d8f]: [Sch. 19 para. 22](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/22) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-701d5cfc0f481357e74022e7c52c18c0]: S. 186 heading substituted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 106(4)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/106/4/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(k)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/k)
[^key-703e2e342cfcb4603846990fa8e2b775]: [Sch. 15 para. 7](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/7) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-707883b75ea25f6b0172d7b5ee3087c2]: [Sch. 19 para. 414](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/414) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -18408,6 +18484,8 @@
[^key-7285958890d3383878df626a9c90418f]: [Sch. 19 para. 291](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/291) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-72ba0767b30e3e4aaa628d751ad94496]: [S. 114A](https://www.legislation.gov.uk/ukpga/2018/12/section/114A) and cross-heading inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 117(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/117/2), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(r)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/r)
[^key-72cb372c18446331d54d7581b2844122]: [Sch. 19 para. 283](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/283) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-72d1e7bc8a1a8cdb24823c5c186808fa]: [Sch. 19 para. 364](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/364) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -18418,6 +18496,8 @@
[^key-730bc1c474fbdbd93f519027acff36fe]: [S. 146](https://www.legislation.gov.uk/ukpga/2018/12/section/146) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-737325028727ba2041f2f0de7660090b]: S. 205(2)(la) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 117(4)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/117/4/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(r)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/r)
[^key-73831303993667d8f859b9488103ac73]: Words in s. 151(8)(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 62](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/62) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-7391cf8e2ee42e601b02ca8e23000688]: Words in s. 168 heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 69(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/69/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -18478,10 +18558,10 @@
[^key-7aac6a775a9db704483930b3b42f67b9]: Words in Sch. 2 para. 26(9)(c) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(21)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/21/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-7abc0fd05fa7ad3cbe8449b31011c957]: Words in [s. 143(2)](https://www.legislation.gov.uk/ukpga/2018/12/section/143/2) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(3)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/3/b), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-7acebc72466e110599be1c7c05f2d8a7]: Words in s. 5(7) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 6(6)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/6/6/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-7b259fddaf883dcc4820053ea22fcd9b]: Word in [s. 3(9)(c)](https://www.legislation.gov.uk/ukpga/2018/12/section/3/9/c) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 14(a)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/14/a); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(y)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/y)
[^key-7b7a7abcbe377f85ee79df3619288d0c]: [Sch. 12 para. 3](https://www.legislation.gov.uk/ukpga/2018/12/schedule/12/paragraph/3) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-7bccbbbdba88ddb2e2eba7451840f2a4]: [Sch. 19 para. 386](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/386) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -18538,10 +18618,10 @@
[^key-7fd06888fb048ef993ef93ef456b6b5a]: [Sch. 19 para. 186](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/186) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-806566818913034ab4045ef294f2448c]: Words in [s. 142(3)(b)](https://www.legislation.gov.uk/ukpga/2018/12/section/142/3/b) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(2)(c)(ii)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/2/c/ii), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-8073dd715b8ba844756ab6ffb34393c2]: Words in s. 207(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 87(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/87/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-809083dbfb858646f59b715b5eb1406c]: [S. 20](https://www.legislation.gov.uk/ukpga/2018/12/section/20) omitted (20.8.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 15](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/15); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(y)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/y)
[^key-80aece53fcb0b6da0c128b207cec4326]: [Sch. 19 para. 51](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/51) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-81281ac0c84a46bf1301b64aa0388e21]: [S. 9](https://www.legislation.gov.uk/ukpga/2018/12/section/9) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 12](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/12) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -18586,10 +18666,10 @@
[^key-847feaddc6148bc37c46c1a3e5b8905c]: Words in s. 17(1)(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 22(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/22/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-848884f60920ce824d9015773f496208]: Words in [s. 145(3)(c)](https://www.legislation.gov.uk/ukpga/2018/12/section/145/3/c) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(4)(b)(iii)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/4/b/iii), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-84eda6b71dbe3fa5e5686e74405328d3]: Words in [s. 129(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/129/1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 54](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/54) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-853556fb17545841a06d58d5f0af9994]: [S. 139(1A)](https://www.legislation.gov.uk/ukpga/2018/12/section/139/1A)[(1B)](https://www.legislation.gov.uk/ukpga/2018/12/section/139/1B) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 91(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/91/4), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1) (with [s. 91(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/91/5)); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(e)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/e)
[^key-8536ab473caeb847327e2f5e6d40132d]: Sch. 20 para. 49 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-85568ff5ac8fb1d7859fa5d6150a01c8]: [Sch. 19 para. 327](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/327) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -18642,7 +18722,7 @@
[^key-8bd408574505811db2c82cae1b36a826]: [Sch. 19 para. 198](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/198) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-8bdf2f9115303fb799f509ce612d36e1]: [Sch. 7 para. 48](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/48) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-8bdf2f9115303fb799f509ce612d36e1]: Sch. 7 para. 48 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-8be42a9b4ca72b465ef3e53b07fce39f]: [Sch. 19 para. 343](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/343) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -18682,8 +18762,6 @@
[^key-8fbe292ba1de6fbf2a9d7d97a4bad919]: [Sch. 7 para. 29](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/29) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-8fbe77f2f80f9eac71718adbbe021cbb]: Words in [s. 142(3)(c)](https://www.legislation.gov.uk/ukpga/2018/12/section/142/3/c) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(2)(c)(iii)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/2/c/iii), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-8fee20a32a0c94dd1be0c59c92f7d22d]: [Sch. 19 para. 28](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/28) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-905f3924a8759d0b5e86546e2ec79c8f]: Words in Sch. 18 para. 5(b) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 99(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/99/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -18698,6 +18776,8 @@
[^key-9135d5f0ba7a938b8e0908d3b822308e]: Sch. 20 para. 22 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9190e828ff0d3346d5cf7c2bd7d0f1c2]: [S. 3(8A)](https://www.legislation.gov.uk/ukpga/2018/12/section/3/8A) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 117(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/117/3), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(r)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/r)
[^key-9191ac97c4be79c02fb2a00b6516f9c4]: [Sch. 19 para. 356](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/356) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-91c2b0d1083a5749e792bb8cc09b84fd]: Words in Sch. 3 para. 12 cross-heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(13)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/13) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -18716,7 +18796,7 @@
[^key-9327a9e51950d697f6ab1419608e7b34]: [Sch. 19 para. 351](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/351) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-93d483f8c1d9155ed4a8cdff56addef5]: Words in [s. 143(3)](https://www.legislation.gov.uk/ukpga/2018/12/section/143/3) substituted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(3)(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/3/c), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-932fb2eb6cef1d6174f128001bbe0202]: [S. 140 cross-heading](https://www.legislation.gov.uk/ukpga/2018/12/part/5/crossheading/reports-etc) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 95](https://www.legislation.gov.uk/ukpga/2025/18/section/95), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(h)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/h)
[^key-9415718b0fd9928accda1024defbb8f1]: [Sch. 19 para. 246](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/246) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -18728,8 +18808,6 @@
[^key-94dd0e117ae91630c416e9e8439ee602]: Words in Sch. 1 para. 1(3) substituted (15.12.2021) by [The UK Statistics (Amendment etc.) (EU Exit) Regulations 2021 (S.I. 2021/1300)](https://www.legislation.gov.uk/uksi/2021/1300), [regs. 1](https://www.legislation.gov.uk/uksi/2021/1300/regulation/1), [2](https://www.legislation.gov.uk/uksi/2021/1300/regulation/2)
[^key-9504f4a8ac0dcfd6ec9b9e414b62fd67]: Words in s. 206 Table substituted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 69(5)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/69/5/b), [142(3)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/a)
[^key-953b9df49e10ea57d7c67ec16df9d1c0]: Act excluded (30.9.2020) by [The Channel Tunnel (Arrangements with the Kingdom of the Netherlands) Order 2020 (S.I. 2020/916)](https://www.legislation.gov.uk/uksi/2020/916), [arts. 1(2)(b)](https://www.legislation.gov.uk/uksi/2020/916/article/1/2/b)[4(4)](https://www.legislation.gov.uk/uksi/2020/916/article/4/4)
[^key-9554afd386ff1a76b263966b60fc1907]: [Sch. 19 para. 132](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/132) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -18742,8 +18820,6 @@
[^key-9667d028d4f7acb47a263b481d8f79bc]: Words in s. 206 Table omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 86(4)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/86/4) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-969f1b94a1056c7d6bbafc5cccdd02f1]: S. 5: power to amend conferred (19.6.2025 for specified purposes) by Regulation (EU) 679/2016, Art. 11A(3) (as inserted by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 74(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/74/1), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h))
[^key-969f5ea1c155862f9d516708188b069a]: Words in Sch. 3 para. 21 cross-heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(20)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/20) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-96ae04ac2f2af44f8b1423f15c733f45]: S. 26(2)(fa) inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 34(3)(d)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/34/3/d) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -18774,8 +18850,6 @@
[^key-98fa005db175e358483a9c7e427babf0]: [Sch. 19 para. 29](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/29) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-99ab7faa88ca562f58efadf0dd63b7d5]: [S. 34(2)(aa)](https://www.legislation.gov.uk/ukpga/2018/12/section/34/2/aa) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 69(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/69/3), [142(3)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/a)
[^key-9a01dffe8e031e6fd2dba2087a13223d]: Words in Sch. 18 para. 5(a) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 99(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/99/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-9a443c5bd0f1d495d7eb959fe3c7dfdd]: Sch. 1 para. 38 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
@@ -18788,8 +18862,6 @@
[^key-9a8be2cf53d7c39ed62f2d07d32d1c20]: Words in s. 1(4) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 2(4)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/2/4) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-9a8f19c35bf0a7a834eef9f953183f3e]: Words in [s. 143(4)](https://www.legislation.gov.uk/ukpga/2018/12/section/143/4) substituted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/3/d), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-9a96e2a08106565ada79467503826cb4]: [Sch. 19 para. 7](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/7) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9a9736041c34fdc367335955850c35ae]: Words in s. 159(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 65](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/65) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -18812,6 +18884,8 @@
[^key-9b9087b9158da4ffd811465a30b1f973]: [Sch. 19 para. 146](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/146) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-9ba92cb088fb455028dbeb88fcb5edb6]: Words in [s. 119A(11)](https://www.legislation.gov.uk/ukpga/2018/12/section/119A/11) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 17](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/17); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(y)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/y)
[^key-9bc333ae2f3f8bcbd3a38bc3a810fb5a]: [Sch. 15 para. 3](https://www.legislation.gov.uk/ukpga/2018/12/schedule/15/paragraph/3) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-9c101e97812e71a335520eb1c47a6ec6]: Sch. 2 para. 23 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
@@ -18862,19 +18936,13 @@
[^key-a1c35c4d9fb9c6b8432b9c99b83faa06]: S. 104 in force at 16.9.2019 by [S.I. 2019/1188](https://www.legislation.gov.uk/uksi/2019/1188), [reg. 2(d)](https://www.legislation.gov.uk/uksi/2019/1188/regulation/2/d)
[^key-a209783a627c40caac27342bcc5a561d]: [S. 33(1A)](https://www.legislation.gov.uk/ukpga/2018/12/section/33/1A) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 69(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/69/2), [142(3)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/a)
[^key-a2536056f71e77d12ec0552af9cdb0ae]: [Sch. 19 para. 14](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/14) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a2c39c1b8f50d64d3eab992537ab337c]: Words in s. 5(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 6(4)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/6/4) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-a2dc7867f7754a11a35a6a348b1c9035]: [Sch. 7 para. 56](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/56) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-a3763554b09060538700226200e56386]: S. 205: power to amend conferred (19.6.2025 for specified purposes) by Regulation (EU) 679/2016, Art. 11A(3) (as inserted by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 74(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/74/1), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h))
[^key-a3a1a5f2e7f8e2b0b3f53919b3ac198d]: [S. 40A](https://www.legislation.gov.uk/ukpga/2018/12/section/40A) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 69(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/69/4), [142(3)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/a)
[^key-a3c0ce05bf3da8355e376954eddca53f]: [Sch. 7 para. 52](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/52) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-a2dc7867f7754a11a35a6a348b1c9035]: Sch. 7 para. 56 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-a3c0ce05bf3da8355e376954eddca53f]: Sch. 7 para. 52 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-a3ce48c816fb2bf06559889b7357e5f6]: [Sch. 19 para. 330](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/330) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -18884,10 +18952,14 @@
[^key-a44536bac9a597320eab0a82eead9a1b]: Sch. 2 para. 9 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-a45d5a7b4c8252c5c648eaeb70d56554]: [Ss. 124B](https://www.legislation.gov.uk/ukpga/2018/12/section/124B), [124C](https://www.legislation.gov.uk/ukpga/2018/12/section/124C) inserted (19.6.2025 for specified purposes, 20.8.2025 in so far as not already in force) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 93](https://www.legislation.gov.uk/ukpga/2025/18/section/93), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(g)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/g)
[^key-a4aa35db6bea2e2d38df00cf0ecfb4af]: [Sch. 19 para. 282](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/282) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a4b40f818ce15c1720d09e302bf3f262]: [Sch. 19 para. 263](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/263) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a4c5e68e10976ef4fd24a41417295228]: Words in s. 186(1) omitted (20.8.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 106(4)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/106/4/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(k)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/k)
[^key-a59f8dde3068bf877b888306045bdfab]: [Sch. 19 para. 424](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/424) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a5d5816e42d277460429b755f59aaec5]: Sch. 20 para. 16 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -18908,6 +18980,8 @@
[^key-a63390fc5b556409349772fb7f0ec1d4]: [Sch. 19 para. 145](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/145) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a63f73287f410fd54431d0a02dc24128]: Words in [s. 94(10)](https://www.legislation.gov.uk/ukpga/2018/12/section/94/10) substituted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 16](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/16); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(y)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/y)
[^key-a6604195d497ecc3ddea17c2bd854a34]: [Sch. 11 para. 5](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/5) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-a685afd8e1ad0bb3dd291dc18372de28]: [Sch. 19 para. 400](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/400) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -18926,8 +19000,6 @@
[^key-a72ed094e92b1e77b75e2da52e1bc7c9]: Word in Sch. 20 para. 14(2) substituted (5.5.2023) by [The Data Protection Act 2018 (Transitional Provision) Regulations 2023 (S.I. 2023/414)](https://www.legislation.gov.uk/uksi/2023/414), [regs. 1(1)](https://www.legislation.gov.uk/uksi/2023/414/regulation/1/1), [2(2)](https://www.legislation.gov.uk/uksi/2023/414/regulation/2/2)
[^key-a739cdcdc195e4fb2edfded1346676b6]: Words in s. 206 Table substituted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 69(5)(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/69/5/c), [142(3)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/a)
[^key-a8f58512cb57f396c3a6b2d0a2120804]: [Sch. 19 para. 179](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/179) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-a92af31a14937e990ce7e02e2e9d9f29]: Words in s. 10(5) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 13(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/13/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -18968,12 +19040,14 @@
[^key-ae7474f0c3ecc17e0da102de1e22069d]: [Sch. 19 para. 337](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/337) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-aee4aa208301e598dbb8564e8e9b226b]: S. 5: power to amend conferred (19.6.2025 for specified purposes, 20.8.2025 in so far as not already in force) by Regulation (EU) 679/2016, Art. 11A(3) (as inserted by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 74(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/74/1), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(c)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/c))
[^key-aefe328365b9310832632a3f7bf664db]: [S. 180 cross-heading](https://www.legislation.gov.uk/ukpga/2018/12/part/6/crossheading/jurisdiction-of-courts) substituted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 104(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/104/2), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(j)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/j)
[^key-af00bc19e71787fbc67e62544709eb1b]: [Sch. 12 para. 9](https://www.legislation.gov.uk/ukpga/2018/12/schedule/12/paragraph/9) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-af0b63f67e273e6e110ffcb6b31502f4]: [Sch. 19 para. 148](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/148) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-af57db229127ba08efca2914d468d760]: Words in [s. 206](https://www.legislation.gov.uk/ukpga/2018/12/section/206) Table inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 69(5)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/69/5/a), [142(3)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/a)
[^key-af704cdbd7c856f0edbefe85c657cb92]: [Sch. 19 para. 24](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/24) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b00c0f26a2d6a3755a47ccea8a91b596]: [Sch. 19 para. 339](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/339) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -19052,16 +19126,18 @@
[^key-b69d717e1e9c428be52a8405917b6a47]: [Sch. 11 para. 14](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/14) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-b6bbed2a6cf684bdb26ac707b67928e4]: S. 186(2A) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 106(4)(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/106/4/c), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(k)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/k)
[^key-b6ee800cbbca868e5b81fc389982dfb8]: [Sch. 19 para. 225](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/225) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b6fec47aa194969dfe8a3a6fea4187d8]: [Sch. 19 para. 64](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/64) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b74eac71c37329b024002780a5fef5e4]: Words in [s. 145(3)(b)](https://www.legislation.gov.uk/ukpga/2018/12/section/145/3/b) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(4)(b)(ii)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/4/b/ii), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-b7ec9fe5f8e02209dbf599741d3c734a]: Words in s. 187(1)(a) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 81(3)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/81/3/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-b809b11818db07b6251c81d14a36f7e5]: Sch. 1 para. 31 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-b82114f65ed3bebd5667c90d730bb0a7]: Words in s. 206 Table omitted (20.8.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 27](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/27); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(y)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/y)
[^key-b85964a87061e13a255bedfd6fa9b9c3]: [Sch. 19 para. 278](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/278) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-b8ac6fb172d66af4a5e7441a6e2e92e5]: Words in s. 204(1)(g) omitted (2.12.2019 at 00:01) by virtue of [Data Protection Act 2018 (c. 12)](https://www.legislation.gov.uk/ukpga/2018/12), [s. 212(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/212/1), [Sch. 19 para. 227(2)(a)](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/227/2/a) (with [ss. 117](https://www.legislation.gov.uk/ukpga/2018/12/section/117), [209](https://www.legislation.gov.uk/ukpga/2018/12/section/209), [210](https://www.legislation.gov.uk/ukpga/2018/12/section/210)); [S.I. 2019/1434](https://www.legislation.gov.uk/uksi/2019/1434), [reg. 2(b)](https://www.legislation.gov.uk/uksi/2019/1434/regulation/2/b)
@@ -19086,7 +19162,7 @@
[^key-bbc49c524804fb2ab905465728240522]: Words in s. 170(7) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 71](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/71) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-bc2a530dd3f0d4818c8cbe412b184952]: S. 42A inserted (19.6.2025 for specified purposes) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 74(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/74/5), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h)
[^key-bc2a530dd3f0d4818c8cbe412b184952]: [S. 42A](https://www.legislation.gov.uk/ukpga/2018/12/section/42A) inserted (19.6.2025 for specified purposes, 20.8.2025 in so far as not already in force) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 74(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/74/5), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(c)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/c)
[^key-bc3021df4d077fdfe7d839e771ba45e1]: Words in s. 126(4) substituted (19.6.2025 for specified purposes, 20.8.2025 in so far as not already in force) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 92(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/92/4), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(f)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/f)
@@ -19112,6 +19188,8 @@
[^key-be312be66278b219bf36807ebc298dca]: S. 21(1)-(4) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 29(3)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/29/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-bedf5d2451f593d3f59d1740c5bd6e9c]: [S. 139(2)](https://www.legislation.gov.uk/ukpga/2018/12/section/139/2) omitted (20.8.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 20](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/20); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(y)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/y)
[^key-bef50065785b938e25237c6aa68a6597]: [Sch. 19 para. 285](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/285) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-bf1901e085f9376f525dcebcaece26ab]: [Sch. 12 para. 6](https://www.legislation.gov.uk/ukpga/2018/12/schedule/12/paragraph/6) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
@@ -19128,7 +19206,7 @@
[^key-bf995fccad30924b62ebc61e36091eea]: [Sch. 19 para. 52](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/52) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-bfa38f6ea2f2d1ae4ff2e67570068933]: [Sch. 7 para. 54](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/54) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-bfa38f6ea2f2d1ae4ff2e67570068933]: Sch. 7 para. 54 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-bfe88656543ff8d5238b037df8a8af1b]: [Sch. 19 para. 433](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/433) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -19150,14 +19228,14 @@
[^key-c200f0f3b78d0996b7d83fdabfb5e5be]: Ss. 17A-17C inserted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 23](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/23) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-c23720bc5fe8d01d4cdc6ce3eb96a7a0]: Word in [s. 35(8)](https://www.legislation.gov.uk/ukpga/2018/12/section/35/8) substituted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 74(4)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/74/4/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(c)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/c)
[^key-c24fe2bf46c2f469339fd6168916f31d]: Words in s. 125(9) substituted (19.6.2025 for specified purposes, 20.8.2025 in so far as not already in force) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 92(3)(e)](https://www.legislation.gov.uk/ukpga/2025/18/section/92/3/e), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(f)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/f)
[^key-c2993c748626851ac752a159c968c2f3]: [Sch. 19 para. 68](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/68) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c2ac2fbd7eae86c3237b0fea08970942]: [Sch. 19 para. 147](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/147) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-c2e61291573249529347dd623ad3293e]: Words in [s. 62(2)(a)](https://www.legislation.gov.uk/ukpga/2018/12/section/62/2/a) omitted (19.8.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 82(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/82/a), [142(3)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/b)
[^key-c2ef1f00c16c6ae79e671982664ebcb6]: Sch. 1 para. 7 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-c356bafc244fdc4ace9be54cbc58a2b8]: [Sch. 19 para. 220](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/220) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -19210,7 +19288,7 @@
[^key-c8e2994c25fb458736a5c26eaf716e23]: S. 162 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-c914990c72253d6c460805018090a05a]: [Sch. 7 para. 53](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/53) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-c914990c72253d6c460805018090a05a]: Sch. 7 para. 53 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-c928d8c9711cfedfaf94e5e46642337c]: [Sch. 19 para. 292](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/292) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -19244,7 +19322,7 @@
[^key-cba88e2b39b826968769027cc29370be]: Words in [s. 135(4)](https://www.legislation.gov.uk/ukpga/2018/12/section/135/4) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 56](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/56) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-cbd94f2658bc57fc8fc318640494c0a5]: Words in [s. 142(1)(b)](https://www.legislation.gov.uk/ukpga/2018/12/section/142/1/b) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(2)(a)(ii)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/2/a/ii), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-cbafc2b11db1365fec90797f8b94de74]: Words in [s. 35(6)(b)](https://www.legislation.gov.uk/ukpga/2018/12/section/35/6/b) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 74(4)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/74/4/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(c)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/c)
[^key-cc268dff7489493500857e0da3d30cf8]: [Sch. 19 para. 281](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/281) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -19274,6 +19352,8 @@
[^key-ce8f58e41e39345fa68025d5f759b383]: [Sch. 7 para. 20](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/20) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-cef4c775a0b9e54df85f16deac5eafea]: [Sch. A1](https://www.legislation.gov.uk/ukpga/2018/12/schedule/A1) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 72(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/72/8), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(b)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/b)
[^key-cf185b11f6eb430ea7b837e8c88bd7b6]: Words in s. 80(4) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 46(4)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/46/4) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-cf7b12fa6e29df3664f564217fb41aec]: [Sch. 19 para. 320](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/320) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -19284,8 +19364,6 @@
[^key-cfd37790b8a4ffc332af6e54afe597a3]: Words in s. 187(1) substituted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 81(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/81/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-d00ce2fcbaade283e75e389abfb338a5]: Words in [s. 142(7)(a)](https://www.legislation.gov.uk/ukpga/2018/12/section/142/7/a) substituted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(2)(f)(i)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/2/f/i), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-d00de55d7e460f218dbfdfc1cc28e86a]: [Sch. 19 para. 84](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/84) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-d035aebb324ef6e0087dfa27a2360edd]: [Sch. 19 para. 394](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/394) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -19304,15 +19382,11 @@
[^key-d1c4a5b8f04832edf2cb03e6ea265e7c]: Sch. 1 para. 17 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-d1e521f76cff5bf58b8f1dc7a0d91bc7]: Words in [s. 142(3)(d)](https://www.legislation.gov.uk/ukpga/2018/12/section/142/3/d) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(2)(c)(iv)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/2/c/iv), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-d20f31dc69bcc1af64583a26735ded5d]: Words in [s. 142(7)](https://www.legislation.gov.uk/ukpga/2018/12/section/142/7) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(2)(f)(ii)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/2/f/ii), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-d215058b7b57e3a9731a7ad5e4301724]: Words in s. 11(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 14](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/14) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-d21cee9d28e7ef117ac498fbed58738e]: [Sch. 14 para. 10](https://www.legislation.gov.uk/ukpga/2018/12/schedule/14/paragraph/10) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^key-d246561fbd24e4e3fc88730fdaad884d]: [Sch. 7 para. 51](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/51) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-d246561fbd24e4e3fc88730fdaad884d]: Sch. 7 para. 51 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-d28d939c5b88e9d83db1ae875c3e2f99]: [Sch. 19 para. 35](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/35) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -19376,8 +19450,6 @@
[^key-d975bf9312ec73c1e21013621d4551b6]: Sch. 2 para. 14 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^key-d984e406ba6c8bd6120e59d9431cf357]: Words in [s. 145(3)(a)](https://www.legislation.gov.uk/ukpga/2018/12/section/145/3/a) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(4)(b)(i)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/4/b/i), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-d9d4a5328d371f45edc310525d5e56ca]: S. 195 in force at 23.7.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 3(l)](https://www.legislation.gov.uk/uksi/2018/625/regulation/3/l)
[^key-d9e75b820dadd4eac2b1032ec6c6a4da]: [Sch. 19 para. 258](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/258) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -19396,20 +19468,16 @@
[^key-dab72f344c2223ac494a5ec5e4725a5a]: [Sch. 19 para. 153](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/153) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-daf9e0252da094394cda1b40a87dfe22]: [Sch. 7 para. 49](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/49) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-daf9e0252da094394cda1b40a87dfe22]: Sch. 7 para. 49 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-dbdad71b9ade64a8f7fdfc45c071f848]: Words in Sch. 3 para. 17(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(15)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/15) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-dbf19877200981f2490768f60ea3c413]: Words in [s. 142(3)(a)](https://www.legislation.gov.uk/ukpga/2018/12/section/142/3/a) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(2)(c)(i)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/2/c/i), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-dc321b64fd0fcd1ec60ef61441b8fafc]: [Sch. 8 para. 6](https://www.legislation.gov.uk/ukpga/2018/12/schedule/8/paragraph/6) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-dc40b789ba49496fa957bb0b48f33a2b]: [Sch. 19 para. 77](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/77) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-dc44819fb13fa8e6ea18a61ad3fab776]: [Sch. 19 para. 276](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/276) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-dcdb72650fa4d8b42926e24c738770ee]: S. 82(2A) inserted (19.6.2025 for specified purposes) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 89(2)(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/89/2/c), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h)
[^key-dce28071963c6ace834d117354904185]: [Sch. 7 para. 14](https://www.legislation.gov.uk/ukpga/2018/12/schedule/7/paragraph/14) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-dd0f181b5dd17d7042dc7e38ce07044c]: S. 111 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
@@ -19444,6 +19512,8 @@
[^key-df76da218b4fc287b7df92688b5b906a]: [Sch. 19 para. 115](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/115) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-df9dd5178ce955ad86a004f4f5faf4f3]: Words in [s. 86(3)(b)](https://www.legislation.gov.uk/ukpga/2018/12/section/86/3/b) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 74(7)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/74/7/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(c)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/c)
[^key-dfd4e8a4ee7d2bdd2b63992d585ea975]: [Sch. 19 para. 234](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/234) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-dffa9388dd0ef050a0bc9980aa1f03ca]: Sch. 1 para. 3 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
@@ -19452,6 +19522,8 @@
[^key-e0842c692626b5e774c6753f0719945c]: Words in Sch. 2 para. 16(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 92(14)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/92/14) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-e0bccd6b1e4e022c2e677ed1bdb9d8d1]: S. 183A and cross-heading inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 106(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/106/2), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(k)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/k)
[^key-e0d2f2b8d26ec60067558dd0962095b3]: Words in s. 187(2) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 81(5)(a)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/81/5/a) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-e19adfb1f3c5862f38fc50a0d9f8f97e]: [Sch. 19 para. 160](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/160) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -19484,8 +19556,6 @@
[^key-e2dd47d0a543b3e922e9c971f2a8baa4]: Words in s. 24(5) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 32(5)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/32/5/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-e338aaf5150d0a7060979adcdbf6939c]: Words in [s. 142(5)](https://www.legislation.gov.uk/ukpga/2018/12/section/142/5) inserted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(2)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/2/d), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-e36726ddad796892b59de71bc71fac9c]: [Sch. 11 para. 4](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/4) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-e36f3d79dc2160326592a45b956bcee2]: Words in s. 80(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 46(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/46/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -19500,6 +19570,8 @@
[^key-e4afbc3f11ae48f0f055c87060290428]: [Sch. 19 para. 385](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/385) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e4bd601efb2a0a88b3b1622f2115e194]: Words in s. 192(6) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 26](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/26); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(y)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/y)
[^key-e4d19bddc6c0328454f09fd547393db8]: [Sch. 19 para. 268](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/268) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e51209f96eafbb1ab258e63be1650a81]: [Sch. 19 para. 136](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/136) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -19518,6 +19590,8 @@
[^key-e72064e13dd75d5efe7864fb56a44ab9]: [Sch. 19 para. 298](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/298) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e73ac3d5a9d77806ecf02f4d54d01d6d]: Words in [s. 160 cross-heading](https://www.legislation.gov.uk/ukpga/2018/12/part/6/crossheading/guidance) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 102(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/102/3), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(i)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/i)
[^key-e75907eba429315009a11c3d22ff06fd]: [Sch. 19 para. 202](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/202) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e7856245e743d7a5de4a1d03a5a413ed]: Words in s. 2(1) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 3](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/3) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -19538,6 +19612,8 @@
[^key-e89782710f07812828650321cc604aa4]: [Sch. 19 para. 358](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/358) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-e8b323b611736c350bc88b75920a0a2e]: [Ss. 120A-120D](https://www.legislation.gov.uk/ukpga/2018/12/section/120A) and cross-heading inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 91(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/91/3), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1) (with [s. 91(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/91/5)); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(e)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/e)
[^key-e94472e4cd77ee51f88b9af2fd0297a6]: [Sch. 14 Pt. 1](https://www.legislation.gov.uk/ukpga/2018/12/schedule/14/part/1) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 98](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/98) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-e966768c7106fe0dc55d7c693755813e]: Sch. 20 para. 4 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -19576,12 +19652,10 @@
[^key-ec0cba10767091647b040d74d1178660]: Words in s. 7(1) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 10(2)(b)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/10/2/b) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-ec3664b19393730fe8eb0e0f28405a08]: S. 91A inserted (19.6.2025 for specified purposes) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 74(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/74/8), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h)
[^key-ec3664b19393730fe8eb0e0f28405a08]: [S. 91A](https://www.legislation.gov.uk/ukpga/2018/12/section/91A) inserted (19.6.2025 for specified purposes, 20.8.2025 in so far as not already in force) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 74(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/74/8), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(c)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/c)
[^key-ec4c69b934ac57e2e43214a23dcbb96d]: [Sch. 11 para. 9](https://www.legislation.gov.uk/ukpga/2018/12/schedule/11/paragraph/9) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^key-ecd963be2d9ad18f7a9f6e41564e4d88]: [S. 141](https://www.legislation.gov.uk/ukpga/2018/12/section/141) omitted (19.8.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 96(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/96/2), [142(3)(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/c)
[^key-eced7daf0a93577817bcb97bd3948271]: S. 21 cross-heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 28](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/28) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-ed498558e2f05ed1eacf387d181f2ea5]: Words in Sch. 3 para. 20 cross-heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(18)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/18) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -19630,8 +19704,6 @@
[^key-f1ea12c4ad88d4f388ce1587dd4bb8fa]: [Sch. 19 para. 116](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/116) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-f20feb5a7d640516e02fd28df4b58c7a]: Words in [Sch. 17 para. 2(2)(a)](https://www.legislation.gov.uk/ukpga/2018/12/schedule/17/paragraph/2/2/a) substituted (19.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 97(7)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/97/7/a), [142(3)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/3/d)
[^key-f251ec0fb7d1f9d415237244a6167b7b]: [Sch. 19 para. 237](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/237) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
[^key-f26231d3616eb287b3ee33c4cae88815]: Words in Sch. 20 Pt. 3 heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 101(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/101/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -19668,14 +19740,16 @@
[^key-f553e60aef4a123f0721442edebd1dcf]: S. 172 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-f583eaf405e87a78ff32fe446bbd4660]: [S. 55(1)(e)](https://www.legislation.gov.uk/ukpga/2018/12/section/55/1/e) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 84(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/84/2), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(d)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/d)
[^key-f5f2be2d52fde50a90249c3696ee9e5c]: S. 207(6) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 87(7)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/87/7) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-f61b1c41d1ef400486d9a7c32e3ef26b]: [Sch. 16 para. 5](https://www.legislation.gov.uk/ukpga/2018/12/schedule/16/paragraph/5) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
[^key-f6981cb83d7c96ee86796f35063db417]: S. 186(3)(c) omitted (20.8.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 106(4)(d)(ii)](https://www.legislation.gov.uk/ukpga/2025/18/section/106/4/d/ii), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(k)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/k)
[^key-f78da6f023a80509141fa555013b5b91]: Act modified (23.5.2019) by [The Buckinghamshire (Structural Changes) Order 2019 (S.I. 2019/957)](https://www.legislation.gov.uk/uksi/2019/957), [arts. 1](https://www.legislation.gov.uk/uksi/2019/957/article/1), [15(2)](https://www.legislation.gov.uk/uksi/2019/957/article/15/2)
[^key-f7c63ce6cee731467dc869770e2c9f70]: Words in s. 181 substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 76](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/76) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-f838d49e21c426886f987f4284f2defe]: Words in Sch. 3 para. 12(3) substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(14)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/14) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-f89e2d4a625a493b7c0cd20626e0b437]: Words in Sch. 3 para. 19 cross-heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 93(16)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/93/16) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
@@ -19708,6 +19782,8 @@
[^key-fbb4408f502b5114f297c415f831874e]: Sch. 18 para. 4(2)(f) inserted (17.12.2021) by [The Age of Criminal Responsibility (Scotland) Act 2019 (Consequential Provisions and Modifications) Order 2021 (S.I. 2021/1458)](https://www.legislation.gov.uk/uksi/2021/1458), [arts. 1(1)](https://www.legislation.gov.uk/uksi/2021/1458/article/1/1), [8(a)](https://www.legislation.gov.uk/uksi/2021/1458/article/8/a)
[^key-fc33832f82a4075d15e37423f9a081a3]: S. 125(2) omitted (20.8.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [s. 142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1), [Sch. 11 para. 19(2)](https://www.legislation.gov.uk/ukpga/2025/18/schedule/11/paragraph/19/2); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(y)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/y)
[^key-fc59486e66036027803653a12bf23594]: S. 118 heading substituted (31.12.2020) by [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 50(2)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/50/2) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^key-fc6a8eec58cbdca916769f66c1fcf95d]: [Sch. 19 para. 209](https://www.legislation.gov.uk/ukpga/2018/12/schedule/19/paragraph/209) in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(g)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/g)
@@ -19756,10 +19832,12 @@
[^M_F_5eeae256-e644-4456-e6ea-16064ca931c7]: S. 94(2A) inserted (retrospective to 1.1.2024) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 78(4)(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/78/4), [142(2)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/b)
[^M_F_5f3ad659-20bb-4805-b6af-fdd8b36cfbc5]: Ss. 124B, 124C inserted (19.6.2025 for specified purposes) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 93](https://www.legislation.gov.uk/ukpga/2025/18/section/93), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h)
[^M_F_632f0eda-c0f5-4c2b-c0fd-854fd7b0c9b7]: S. 45(2A) inserted (retrospective to 1.1.2024) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 78(3)(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/78/3), [142(2)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/b)
[^M_F_67d8e6aa-9733-4c7b-881b-d3d7b3710a92]: [S. 56(4)](https://www.legislation.gov.uk/ukpga/2018/12/section/56/4) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 84(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/84/3), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(d)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/d)
[^M_F_95b495a9-bbd2-4a4d-d703-ea7c74d70465]: [S. 59(7A)](https://www.legislation.gov.uk/ukpga/2018/12/section/56/4) inserted (20.8.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 84(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/84/3), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/904](https://www.legislation.gov.uk/uksi/2025/904), [reg. 2(d)](https://www.legislation.gov.uk/uksi/2025/904/regulation/2/d)
[^M_F_d572f402-2b66-4807-ea89-c9fa6447e306]: Words in s. 207(7) omitted (31.12.2020) by virtue of [The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)](https://www.legislation.gov.uk/uksi/2019/419), [reg. 1(2)](https://www.legislation.gov.uk/uksi/2019/419/regulation/1/2), [Sch. 2 para. 87(8)](https://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/87/7) (with [reg. 5](https://www.legislation.gov.uk/uksi/2019/419/regulation/5)); [2020 c. 1](https://www.legislation.gov.uk/ukpga/2020/1), [Sch. 5 para. 1(1)](https://www.legislation.gov.uk/ukpga/2020/1/schedule/5/paragraph/1/1)
[^M_I_001184dc-ddbe-45f4-bebc-3ba7048d50bc]: S. 17 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
@@ -19778,6 +19856,8 @@
[^M_I_0540997b-4e51-47d5-e2c2-f361a535020a]: Sch. 5 para. 4 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_058f5ee4-0c32-422e-d9f3-b212d036db5e]: S. 141 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_06b96688-7c53-468d-c866-e9a1041b7743]: S. 78 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_081cd2df-3e5a-48e3-eb7d-b50353ce04d1]: Sch. 2 para. 11 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
@@ -19824,8 +19904,6 @@
[^M_I_2379c414-c179-41f5-8cd2-f26aad3a1969]: S. 59 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^M_I_239171aa-c678-4ff3-c101-a3b8431e487b]: S. 128 in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(e)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/e)
[^M_I_24a7b7bc-8af3-4f9c-ad98-eeaa94929a3b]: S. 100 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(d)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/d)
[^M_I_25166470-99f6-4e01-e8f1-2ad0e67c766a]: S. 165 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(f)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/f)
@@ -19834,8 +19912,6 @@
[^M_I_29681cd4-4b4a-447a-e2a1-57524db1d0fe]: S. 19 in force at 25.5.2018 in so far as not already in force by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_2c9d899d-cbb4-49de-dfc1-2d554efd5db1]: S. 20 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_2d9df10b-98d2-4b7a-d660-77cd9369a5d3]: Sch. 1 para. 1 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
[^M_I_2e29e5e1-8c41-46fc-a235-4e7cf9f16ca8]: Sch. 1 para. 39 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/b)
@@ -20212,6 +20288,132 @@
[^M_I_ffacd87e-5a20-492e-de3c-99476f317c17]: S. 80 in force at 25.5.2018 by [S.I. 2018/625](https://www.legislation.gov.uk/uksi/2018/625), [reg. 2(1)(c)](https://www.legislation.gov.uk/uksi/2018/625/regulation/2/1/c)
[^key-9dc954c44dc2f1d5fb977d7d90900abc]: Word in s. 44 heading omitted (5.9.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 79(4)](https://www.legislation.gov.uk/ukpga/2025/18/section/79/4), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/a) (with [reg. 3](https://www.legislation.gov.uk/uksi/2025/996/regulation/3))
[^key-d148ab93ff75155701358f9231d9b294]: S. 44 cross-heading substituted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 79(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/79/3), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/a) (with [reg. 3](https://www.legislation.gov.uk/uksi/2025/996/regulation/3))
[^key-197984193b1a0c63c5cf1d6bdb297f95]: S. 45 cross-heading omitted (5.9.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 79(5)](https://www.legislation.gov.uk/ukpga/2025/18/section/79/5), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/a) (with [reg. 3](https://www.legislation.gov.uk/uksi/2025/996/regulation/3))
[^key-a31bbbaf0702a16d218d015081e896e0]: S. 45A inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 79(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/79/6), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/a) (with [reg. 3](https://www.legislation.gov.uk/uksi/2025/996/regulation/3))
[^key-43bee759a5f6cbf8926b877ad7d6d594]: S. 78A inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(7)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/7), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-fa62a71a5dc3350beb4ec0c525bfbdb3]: S. 26(2)(f)(ai) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/2), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-cd796f7f465a287a7ad8f6cceb0ffdd1]: S. 68(7)(d) omitted (5.9.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/6), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-51a420e340d7561e52b67143aef34c49]: S. 186(3)(ca) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(10)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/10), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-79ecfa480be800660f1c1ae8309a399e]: Words in s. 43(1)(a) substituted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 79(2)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/79/2/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/a) (with [reg. 3](https://www.legislation.gov.uk/uksi/2025/996/regulation/3))
[^key-873a9a81f73c6a07542ec3514b86b3e0]: Words in s. 43(1)(b) substituted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 79(2)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/79/2/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/a) (with [reg. 3](https://www.legislation.gov.uk/uksi/2025/996/regulation/3))
[^key-ee5edfdcab0ee7308291688f5d50b0d9]: S. 44(4)(d) omitted (5.9.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(3)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/3/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-fdd11964dd5f70e3e98b54f18f45480b]: Words in s. 44(5) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(3)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/3/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-4e053c869dd0d1212f96f10b0bd1f15c]: Words in s. 44(7)(a) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(3)(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/3/c), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-0aec7eae8fcc0cb7a6400cb54bac6096]: S. 45(4)(d) omitted (5.9.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(4)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/4/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-c4f6f551c02ad0529dcfe52319f44e5b]: Words in s. 45(5) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(4)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/4/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-3eaa0823ead96c831913592484a5d070]: Words in s. 45(7)(a) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(4)(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/4/c), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-1851ffdfb55a1ae4837371dce443325b]: Words in s. 110(2)(a) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(9)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/9/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-4d9aa0606c413206cb1320a83695979d]: Words in s. 110(2)(b) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(9)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/9/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-94d96ee0fcb3bd0d69d2d1921830ed5c]: Words in s. 110(2)(c) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(9)(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/9/c), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-591ce9de9eda44e5f845b9c965e14c54]: S. 48(3)(d) omitted (5.9.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(5)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/5/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-e779a2cbb005a1cb60490514350355b6]: Word in s. 48(4) substituted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(5)(b)(i)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/5/b/i), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-d99c33910706cc9759a015d3c9510423]: Words in s. 48(4) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(5)(b)(ii)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/5/b/ii), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-de4ac3966480d314214c8b4e0b2726c1]: Words in s. 48(6)(a) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(5)(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/5/c), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-14dc1bd03f341f46d16e2b23a8854253]: S. 51(1)(ba) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 79(7)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/79/7/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/a) (with [reg. 3](https://www.legislation.gov.uk/uksi/2025/996/regulation/3))
[^key-8d58a5c874287d0bdc585648c49f5321]: S. 51(2)(aa) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 79(7)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/79/7/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/a) (with [reg. 3](https://www.legislation.gov.uk/uksi/2025/996/regulation/3))
[^key-83cd0e4be4bc9319fbb76e9a6ba71e9c]: S. 51(4)(aa) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 79(7)(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/79/7/c), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/a) (with [reg. 3](https://www.legislation.gov.uk/uksi/2025/996/regulation/3))
[^key-8497f1214ba7ccd2b9dc5d3d6fe6bba4]: Word in s. 51(6) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 79(7)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/79/7/d), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/a) (with [reg. 3](https://www.legislation.gov.uk/uksi/2025/996/regulation/3))
[^key-4849df2d1d93b321b98b1225cfbb8277]: S. 79(3A) inserted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(8)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/8/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-5633966e010ddf6145173a099d2c2156]: Words in s. 79(5) substituted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(8)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/8/d), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-4f3513a26367d91804bfa7f435078e46]: Words in s. 79(7) substituted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(8)(e)(i)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/8/e/i), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-4f560578ecfbff00c81b108cc574f95c]: Words in s. 79(7) substituted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(8)(e)(ii)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/8/e/ii), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-bed1bbe545b86b3f34cd73fe1006e0b1]: Words in s. 79(8) substituted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(8)(f)(i)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/8/f/i), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-23f61e511accf4c5242cc571d1f808b8]: Words in s. 79(8) substituted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(8)(f)(ii)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/8/f/ii), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-a168ba5289668a8cd5edfcb49d96d728]: Words in s. 79(10) substituted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(8)(g)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/8/g), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-68225e3df25a9f0f2570cf0783246f60]: Words in s. 79(11) substituted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(8)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/8/h), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-7f421b709d4b29a3c22625c805399f04]: Words in s. 79(12) substituted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(8)(i)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/8/i), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-82414ea480fe391b01b01fb4e26587de]: S. 79(13) omitted (5.9.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(8)(j)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/8/j), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-b621b1bce175765bffd77f862862781f]: S. 79(1)-(3) omitted (5.9.2025) by virtue of [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(8)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/8/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-71f3222fd4b877a586e08d163019b411]: Words in s. 79(4) substituted (5.9.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 88(8)(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/88/8/c), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(1)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/1/b) (with [reg. 4](https://www.legislation.gov.uk/uksi/2025/996/regulation/4))
[^key-dcdb72650fa4d8b42926e24c738770ee]: [S. 82(2A)](https://www.legislation.gov.uk/ukpga/2018/12/section/82/2A) inserted (19.6.2025 for specified purposes, 17.11.2025 in so far as not already in force) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 89(2)(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/89/2/c), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/a)
[^key-47b298b6510458494f665aeeee02e734]: [S. 82(4)](https://www.legislation.gov.uk/ukpga/2018/12/section/82/4) inserted (19.6.2025 for specified purposes, 17.11.2025 in so far as not already in force) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 89(2)(d)](https://www.legislation.gov.uk/ukpga/2025/18/section/89/2/d), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1)[(2)(h)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/2/h); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/a)
[^key-3be04071b6e982862efa5dedc98b91c5]: [Ss. 82A-82E](https://www.legislation.gov.uk/ukpga/2018/12/section/82A) inserted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 89(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/89/3), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/a)
[^key-494dd52ba56482beabc25e56147b27ce]: Words in [s. 1(5)](https://www.legislation.gov.uk/ukpga/2018/12/section/1/5) inserted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 90(2)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/2), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/b)
[^key-a563ca7f29827ed10138447c14ed491d]: [S. 29(1A)](https://www.legislation.gov.uk/ukpga/2018/12/section/29/1A) inserted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 90(3)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/3), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/b)
[^key-2f056c8fbea11fd72923190c3a60a7e8]: [S. 82(A1)](https://www.legislation.gov.uk/ukpga/2018/12/section/82/A1) inserted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 89(2)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/89/2/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/a)
[^key-d1152f324a931564f92cc8544265fbed]: Word in [s. 82(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/82/1) inserted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 89(2)(b)(i)](https://www.legislation.gov.uk/ukpga/2025/18/section/89/2/b/i), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/a)
[^key-ec6f56978250d6a8ac23a54c34201ea0]: Word in [s. 82(1)(a)](https://www.legislation.gov.uk/ukpga/2018/12/section/82/1/a) substituted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 89(2)(b)(ii)](https://www.legislation.gov.uk/ukpga/2025/18/section/89/2/b/ii), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/a)
[^key-bbf1a58d25121030163f2ecc32091b86]: Word in [s. 82(1)(b)](https://www.legislation.gov.uk/ukpga/2018/12/section/82/1/b) substituted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 89(2)(b)(iii)](https://www.legislation.gov.uk/ukpga/2025/18/section/89/2/b/iii), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(a)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/a)
[^key-08ad9f9df54aea437bd161c772023bf2]: [S. 83(A1)](https://www.legislation.gov.uk/ukpga/2018/12/section/83/A1) inserted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 90(4)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/4/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/b)
[^key-f43a6187e9bc6e537dc0ba0627f09cc0]: Words in [s. 83(2)](https://www.legislation.gov.uk/ukpga/2018/12/section/83/2) substituted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 90(4)(c)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/4/c), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/b)
[^key-5323f01b951ce1dc681a7e41c427fe5a]: Words in [s. 83(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/83/1) substituted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 90(4)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/4/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/b)
[^key-0a7db461f51968f8ba878ebd21f8457e]: [S. 84(2A)](https://www.legislation.gov.uk/ukpga/2018/12/section/84/2A) inserted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 90(5)(a)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/5/a), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/b)
[^key-38fa0eb45714967ac6481ea2074debe8]: [S. 84(6B)](https://www.legislation.gov.uk/ukpga/2018/12/section/84/6B) inserted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 90(5)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/5/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/b)
[^key-24005f7ff051c74ba6fbee3b3344f7d6]: Word in [s. 104(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/104/1) substituted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 90(6)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/6), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/b)
[^key-4d0adcfaa451f8df9766cc65dfba95e8]: Words in [s. 202(1)(a)(i)](https://www.legislation.gov.uk/ukpga/2018/12/section/202/1/a/i) inserted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 90(7)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/7), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/b)
[^key-482cfc0bdfdc1cd7467d24b06e056b53]: Word in [s. 203(1)](https://www.legislation.gov.uk/ukpga/2018/12/section/203/1) inserted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 90(8)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/8), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/b)
[^key-e712c58086f46cef490d2739c32196e8]: Words in [s. 206](https://www.legislation.gov.uk/ukpga/2018/12/section/206) Table substituted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 90(9)(a)(i)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/9/a/i), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/b)
[^key-a182758c8bbfb23b0f4de56a33affea8]: Words in [s. 206](https://www.legislation.gov.uk/ukpga/2018/12/section/206) Table substituted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 90(9)(a)(ii)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/9/a/ii), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/b)
[^key-cb7a6630c560b4d7f879a0ea0c77fbd1]: Words in [s. 206](https://www.legislation.gov.uk/ukpga/2018/12/section/206) Table inserted (17.11.2025) by [Data (Use and Access) Act 2025 (c. 18)](https://www.legislation.gov.uk/ukpga/2025/18), [ss. 90(9)(b)](https://www.legislation.gov.uk/ukpga/2025/18/section/90/9/b), [142(1)](https://www.legislation.gov.uk/ukpga/2025/18/section/142/1); [S.I. 2025/996](https://www.legislation.gov.uk/uksi/2025/996), [reg. 2(2)(b)](https://www.legislation.gov.uk/uksi/2025/996/regulation/2/2/b)
[^key-f00075df90a95ee9a8cd7964240bac16]: Sch. 7 para. 57 inserted (5.1.2026) by [Border Security, Asylum and Immigration Act 2025 (c. 31)](https://www.legislation.gov.uk/ukpga/2025/31), [ss. 11](https://www.legislation.gov.uk/ukpga/2025/31/section/11), [65(1)](https://www.legislation.gov.uk/ukpga/2025/31/section/65/1) (with [s. 10](https://www.legislation.gov.uk/ukpga/2025/31/section/10)); [S.I. 2025/1318](https://www.legislation.gov.uk/uksi/2025/1318), [reg. 2(a)](https://www.legislation.gov.uk/uksi/2025/1318/regulation/2/a)
[^key-63330d56a2e81707f9cd5b177a000af0]: Words in [s. 183A(4)](https://www.legislation.gov.uk/ukpga/2018/12/section/183A/4) substituted (29.1.2026) by [The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (S.I. 2026/82)](https://www.legislation.gov.uk/uksi/2026/82), [reg. 12(2)](https://www.legislation.gov.uk/uksi/2026/82/regulation/12/2)
[^key-79af9794db26153d08755ea59021b7f1]: Words in [s. 183B(5)(b)](https://www.legislation.gov.uk/ukpga/2018/12/section/183B/5/b) substituted (29.1.2026) by [The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (S.I. 2026/82)](https://www.legislation.gov.uk/uksi/2026/82), [reg. 12(3)](https://www.legislation.gov.uk/uksi/2026/82/regulation/12/3)
[^key-789b1fb0bff945a128559c3def13e851]: Words in [s. 186A(5)](https://www.legislation.gov.uk/ukpga/2018/12/section/186A/5) substituted (29.1.2026) by [The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (S.I. 2026/82)](https://www.legislation.gov.uk/uksi/2026/82), [reg. 12(4)](https://www.legislation.gov.uk/uksi/2026/82/regulation/12/4)
#### Limits on fees that may be charged by controllers
##### 17A
@@ -20406,7 +20608,7 @@
- (b) if the document is laid before the Houses of Parliament on different days, the period of 40 days beginning with the later of those days.
- (11) In calculating the 40-day period, no account is to be taken of any period during which Parliament is dissolved or prorogued or during which both Houses of Parliament are adjourned for more than 4 days.
- (11) In calculating the 40-day period, no account is to be taken of any whole days that fall within a period during which Parliament is dissolved or prorogued or during which both Houses of Parliament are adjourned for more than 4 days.
- (12) In this section, “*trade association*” includes a body representing controllers or processors.
@@ -20842,7 +21044,7 @@
- (a) “*the main data protection legislation*” and “*requirement*” have the same meaning as in section 183A, and
- (b) “*pre-commencement enactment*” means an enactment so far as passed or made before the day on which section 106(2) of the Data (Use and Access) Act 2025 comes into force.
- (b) “*pre-commencement enactment*” means an enactment so far as passed or made before 20th August 2025.
- (6) Section 183A(5) applies for the purposes of subsection (1)(a) of this section as it applies for the purposes of section 183A(1).
@@ -20860,9 +21062,9 @@
- (4) Nothing is to be implied about a relationship described in subsection (1) merely due to the fact that express provision stating that section 186(1) applies (or with similar effect) is made in connection with one such relationship but not another.
- (5) In this section, “*pre-commencement enactment*” means an enactment so far as passed or made before the day on which section 106(4) of the Data (Use and Access) Act 2025 comes into force, other than an enactment contained in, or made under, a provision listed in section 186(2) or (3).
#### Protection of personal data
- (5) In this section, “*pre-commencement enactment*” means an enactment so far as passed or made before 20th August 2025, other than an enactment contained in, or made under, a provision listed in section 186(2) or (3).
#### Overview
### Relevant international law
@@ -20886,9 +21088,9 @@
- (6) In this section, “*treaty*” and “*ratified*” have the same meaning as in Part 2 of the Constitutional Reform and Governance Act 2010 (see section 25 of that Act).
#### Limits on fees that may be charged by controllers
#### National security and defence exemption
#### Special categories of personal data etc: supplementary
#### Manual unstructured data used in longstanding historical research
##### 42A
@@ -20902,9 +21104,9 @@
- (d) make provision varying such a condition as it relates to added processing.
- (2) In subsection [(1)](#p08307)—
- “*added processing*” means a description of processing which is sensitive processing by virtue of provision made under subsection [(1)](#p08307)[(a)](#p08310);
- (2) In subsection (1)—
- “*added processing*” means a description of processing which is sensitive processing by virtue of provision made under subsection (1)(a);
- “*protected condition in Schedule 8*” means a condition in that Schedule other than one that was added to the Schedule by regulations under section 35(6).
@@ -20914,7 +21116,7 @@
##### 50A
- (1) For the purposes of sections [50B](#p09376) and [50C](#p09391)—
- (1) For the purposes of sections 50B and 50C—
- (a) a decision is based solely on automated processing if there is no meaningful human involvement in the taking of the decision, and
@@ -20936,17 +21138,17 @@
##### 50C
- (1) Subject to subsection [(3)](#p09432), where a significant decision taken by or on behalf of a controller in relation to a data subject is—
- (1) Subject to subsection (3), where a significant decision taken by or on behalf of a controller in relation to a data subject is—
- (a) based entirely or partly on personal data, and
- (b) based solely on automated processing,
the controller must ensure that safeguards for the data subject’s rights, freedoms and legitimate interests are in place which comply with subsection [(2)](#p09411) and any regulations under section 50D(4).
the controller must ensure that safeguards for the data subject’s rights, freedoms and legitimate interests are in place which comply with subsection (2) and any regulations under section 50D(4).
- (2) The safeguards must consist of or include measures which—
- (a) provide the data subject with information about decisions described in subsection [(1)](#p09393) taken in relation to the data subject;
- (a) provide the data subject with information about decisions described in subsection (1) taken in relation to the data subject;
- (b) enable the data subject to make representations about such decisions;
@@ -20956,7 +21158,7 @@
- (3) Subsections (1) and (2) do not apply in relation to a significant decision if—
- (a) exemption from those provisions is required for a reason listed in subsection [(4)](#p09451),
- (a) exemption from those provisions is required for a reason listed in subsection (4),
- (b) the controller reconsiders the decision as soon as reasonably practicable, and
@@ -20990,7 +21192,7 @@
- (b) provision imposing requirements which supplement what section 50C(2) requires the safeguards to consist of or include (including, for example, provision about how and when things described in section 50C(2) must be done or be capable of being done), and
- (c) provision about measures which are not to be taken to satisfy one or more of paragraphs (a) to [(d)](#p09427) of section 50C(2).
- (c) provision about measures which are not to be taken to satisfy one or more of paragraphs (a) to (d) of section 50C(2).
- (5) Regulations under this section are subject to the affirmative resolution procedure.
@@ -21002,7 +21204,7 @@
- (b) an international organisation.
- (2) The Secretary of State may only make regulations under this section approving transfers to a third country or international organisation if the Secretary of State considers that the data protection test is met in relation to the transfers (see [section 74AB](#p19276)).
- (2) The Secretary of State may only make regulations under this section approving transfers to a third country or international organisation if the Secretary of State considers that the data protection test is met in relation to the transfers (see section 74AB).
- (3) In making regulations under this section, the Secretary of State may have regard to any matter which the Secretary of State considers relevant, including the desirability of facilitating transfers of personal data to and from the United Kingdom.
@@ -21078,9 +21280,9 @@
- (d) make provision varying such a condition as it relates to added processing.
- (2) In subsection [(1)](#p08383)—
- “*added processing*” means a description of processing which is sensitive processing by virtue of provision made under subsection [(1)](#p08383)[(a)](#p08386);
- (2) In subsection (1)—
- “*added processing*” means a description of processing which is sensitive processing by virtue of provision made under subsection (1)(a);
- “*protected condition in Schedule 10*” means a condition in that Schedule other than one that was added to the Schedule by regulations under section 86(3).
@@ -21120,7 +21322,7 @@
##### 124B
- (1) This section applies where a code is prepared under section 121, 122, 123, 124 or [124A](#p11128), subject to subsection [(11)](#p11428).
- (1) This section applies where a code is prepared under section 121, 122, 123, 124 or 124A, subject to subsection (11).
- (2) The Commissioner must establish a panel of individuals to consider the code.
@@ -21150,7 +21352,7 @@
- (5) Where at any time it appears to the Commissioner that a member of the panel is not willing or able to serve as a member of the panel, the Commissioner may select another individual to be a member of the panel.
- (6) Where the Commissioner selects an individual to be a member of the panel under subsection [(5)](#p11361), the Commissioner must publish a statement that—
- (6) Where the Commissioner selects an individual to be a member of the panel under subsection (5), the Commissioner must publish a statement that—
- (a) identifies the member of the panel,
@@ -21178,11 +21380,11 @@
- (9) The Commissioner may pay remuneration and expenses to the members of the panel.
- (10) This section applies in relation to amendments prepared under section 121, 122, 123, 124 or [124A](#p11128) as it applies in relation to codes prepared under those sections, subject to subsection [(11)](#p11428).
- (10) This section applies in relation to amendments prepared under section 121, 122, 123, 124 or 124A as it applies in relation to codes prepared under those sections, subject to subsection (11).
- (11) The Secretary of State may by regulations provide that this section does not apply, or applies with modifications, in the case of—
- (a) a code prepared under section [124A](#p11128), or
- (a) a code prepared under section 124A, or
- (b) an amendment of such a code,
@@ -21192,13 +21394,13 @@
##### 124C
- (1) Where a code is prepared under section 121, 122, 123, 124 or [124A](#p11128), the Commissioner must carry out and publish an assessment of—
- (1) Where a code is prepared under section 121, 122, 123, 124 or 124A, the Commissioner must carry out and publish an assessment of—
- (a) who would be likely to be affected by the code, and
- (b) the effect the code would be likely to have on them.
- (2) This section applies in relation to amendments prepared under section 121, 122, 123, 124 or [124A](#p11128) as it applies in relation to codes prepared under those sections.
- (2) This section applies in relation to amendments prepared under section 121, 122, 123, 124 or 124A as it applies in relation to codes prepared under those sections.
##### 164A
@@ -21214,7 +21416,7 @@
- (b) inform the complainant of the outcome of the complaint.
- (5) The reference in [subsection (4)](#p12640)[(a)](#p12643) to taking appropriate steps to respond to the complaint includes—
- (5) The reference in subsection (4)(a) to taking appropriate steps to respond to the complaint includes—
- (a) making enquiries into the subject matter of the complaint, to the extent appropriate, and
@@ -21222,13 +21424,13 @@
##### 164B
- (1) The Secretary of State may by regulations require a controller to notify the Commissioner of the number of complaints made to the controller under [section 164A](#p12626) in periods specified or described in the regulations.
- (1) The Secretary of State may by regulations require a controller to notify the Commissioner of the number of complaints made to the controller under section 164A in periods specified or described in the regulations.
- (2) Regulations under this section may provide that a controller is required to make a notification to the Commissioner in respect of a period only in circumstances specified in the regulations.
- (3) Regulations under this section may include—
- (a) provision about a matter listed in [subsection (4)](#p12691), or
- (a) provision about a matter listed in subsection (4), or
- (b) provision conferring power on the Commissioner to determine those matters.
@@ -21244,7 +21446,7 @@
## Schedule 12A
#### Number of members
#### Status
##### 1
@@ -21270,7 +21472,7 @@
- (b) more than 14.
- (3) The Secretary of State may by regulations substitute a different number for the number for the time being specified in sub-paragraph [(2)](#p22309)[(b)](#p22316).
- (3) The Secretary of State may by regulations substitute a different number for the number for the time being specified in sub-paragraph (2)(b).
- (4) Regulations under this paragraph are subject to the negative resolution procedure.
@@ -21290,7 +21492,7 @@
- (3) The executive members are—
- (a) a chief executive appointed by the non-executive members or in accordance with paragraph [25](#p23058), and
- (a) a chief executive appointed by the non-executive members or in accordance with paragraph 25, and
- (b) such other members, if any, as the non-executive members may appoint.
@@ -21298,7 +21500,7 @@
- (5) The non-executive members must consult the Secretary of State before appointing the chief executive.
- (6) The non-executive members must consult the chief executive about whether there should be any executive members within sub-paragraph [(3)](#p22359)[(b)](#p22367) and, if so, how many there should be.
- (6) The non-executive members must consult the chief executive about whether there should be any executive members within sub-paragraph (3)(b) and, if so, how many there should be.
- (7) The Secretary of State may by direction set a maximum and a minimum number of executive members.
@@ -21306,7 +21508,7 @@
##### 4
The Secretary of State must exercise the powers conferred on the Secretary of State by paragraphs [2](#p22304) and [3](#p22334) so as to secure that the number of non-executive members of the Commission is, so far as practicable, at all times greater than the number of executive members.
The Secretary of State must exercise the powers conferred on the Secretary of State by paragraphs 2 and 3 so as to secure that the number of non-executive members of the Commission is, so far as practicable, at all times greater than the number of executive members.
##### 5
@@ -21328,7 +21530,7 @@
- (3) The Secretary of State may require a non-executive member to provide whatever information the Secretary of State considers necessary for the purpose of checking that the member does not have a conflict of interest.
- (4) A non-executive member who is required to provide information under sub-paragraph [(3)](#p22436) must provide it within such period as may be specified by the Secretary of State.
- (4) A non-executive member who is required to provide information under sub-paragraph (3) must provide it within such period as may be specified by the Secretary of State.
- (5) In this Schedule, “*conflict of interest*”, in relation to a person, means a financial or other interest which is likely to affect prejudicially the discharge by the person of the person’s functions as a member of the Commission.
@@ -21350,9 +21552,9 @@
- (a) the chair is guilty of serious misconduct,
- (b) the chair has a conflict of interest (see paragraph [6](#p22417)[(5)](#p22445)),
- (c) the chair has failed to comply with paragraph [6](#p22417)[(4)](#p22440), or
- (b) the chair has a conflict of interest (see paragraph 6(5)),
- (c) the chair has failed to comply with paragraph 6(4), or
- (d) the chair is unable, unfit or unwilling to carry out the chair’s functions.
@@ -21382,9 +21584,9 @@
- (a) the member is guilty of serious misconduct,
- (b) the member has a conflict of interest (see paragraph [6](#p22417)[(5)](#p22445)),
- (c) the member has failed to comply with paragraph [6](#p22417)[(4)](#p22440), or
- (b) the member has a conflict of interest (see paragraph 6(5)),
- (c) the member has failed to comply with paragraph 6(4), or
- (d) the member is unable, unfit or unwilling to carry out the member’s functions.
@@ -21444,7 +21646,7 @@
- (2) A committee of the Commission may consist of or include persons who are neither members nor employees of the Commission.
- (3) But a committee of the Commission to which functions are delegated under paragraph [14](#p22695)[(1)](#p22696)[(c)](#p22707) must include at least one person who is either a member or an employee of the Commission.
- (3) But a committee of the Commission to which functions are delegated under paragraph 14(1)(c) must include at least one person who is either a member or an employee of the Commission.
- (4) Where a person who is neither a member nor an employee of the Commission is a member of a committee of the Commission, the Commission may pay to that person such remuneration and expenses as it may determine.
@@ -21458,11 +21660,11 @@
- (c) a committee of the Commission.
- (2) A function is delegated under sub-paragraph [(1)](#p22696) to the extent and on the terms that the Commission determines.
- (2) A function is delegated under sub-paragraph (1) to the extent and on the terms that the Commission determines.
- (3) A committee of the Commission may delegate any function delegated to it to a member of the committee.
- (4) A function is delegated under sub-paragraph [(3)](#p22717) to the extent and on the terms that the committee determines.
- (4) A function is delegated under sub-paragraph (3) to the extent and on the terms that the committee determines.
- (5) The power of a committee of the Commission to delegate a function, and to determine the extent and terms of the delegation, is subject to the Commission’s power to direct what a committee established by it may and may not do.
@@ -21486,7 +21688,7 @@
- (4) The Commission must publish arrangements which it makes under this paragraph.
- (5) This paragraph is subject to paragraph [18](#p22806).
- (5) This paragraph is subject to paragraph 18.
##### 17
@@ -21498,9 +21700,9 @@
- (c) the proceedings at a meeting of the non-executive members of the Commission,
- (d) anything done by a member or employee of the Commission under paragraph [14](#p22695)[(1)](#p22696), and
- (e) anything done by a member of a committee of the Commission under paragraph [14](#p22695)[(3)](#p22717).
- (d) anything done by a member or employee of the Commission under paragraph 14(1), and
- (e) anything done by a member of a committee of the Commission under paragraph 14(3).
##### 18
@@ -21524,7 +21726,7 @@
- (c) in the case of a meeting of a committee, the other members of the committee who are present have, in the manner authorised by the Commission, resolved that the interest is to be disregarded.
- (5) In giving authorisation for the purposes of sub-paragraph [(4)](#p22831)[(c)](#p22842), the Commission must secure that a resolution for those purposes does not allow a member to take part in a discussion or decision at a meeting of a committee to which functions are delegated under paragraph [14](#p22695)[(1)](#p22696)[(c)](#p22707) unless the number of other members of the committee in favour of the resolution—
- (5) In giving authorisation for the purposes of sub-paragraph (4)(c), the Commission must secure that a resolution for those purposes does not allow a member to take part in a discussion or decision at a meeting of a committee to which functions are delegated under paragraph 14(1)(c) unless the number of other members of the committee in favour of the resolution—
- (a) is not less than two thirds of those who are both present and entitled to vote on the resolution, and
@@ -21536,7 +21738,7 @@
- (b) is to be regarded as interested in any matter involving that company or firm,
is to be regarded as compliance with sub-paragraph [(2)](#p22823) in relation to any such matter for the purposes of that meeting and subsequent meetings of the Commission, of the non-executive members or of a committee.
is to be regarded as compliance with sub-paragraph (2) in relation to any such matter for the purposes of that meeting and subsequent meetings of the Commission, of the non-executive members or of a committee.
- (7) For the purposes of this paragraph, a notification given at or sent to a meeting of the non-executive members of the Commission or of a committee of the Commission that—
@@ -21544,9 +21746,9 @@
- (b) is to be regarded as interested in any matter involving that company or firm,
is to be regarded as compliance with sub-paragraph [(2)](#p22823) in relation to any such matter for the purposes of that meeting and subsequent meetings of the non-executive members or (as the case may be) of the committee.
- (8) A notification described in sub-paragraph [(6)](#p22864) or [(7)](#p22879) remains in force until it is withdrawn.
is to be regarded as compliance with sub-paragraph (2) in relation to any such matter for the purposes of that meeting and subsequent meetings of the non-executive members or (as the case may be) of the committee.
- (8) A notification described in sub-paragraph (6) or (7) remains in force until it is withdrawn.
- (9) A person required to make a declaration for the purposes of this paragraph in relation to any meeting—
@@ -21562,11 +21764,11 @@
- (b) a defect in the appointment of a member of the Commission,
- (c) a failure of the Secretary of State to comply with the requirements of paragraph [4](#p22397), or
- (d) a failure to comply with arrangements under paragraph [16](#p22743) or with a requirement under paragraph [18](#p22806).
- (2) Nothing in sub-paragraph [(1)](#p22916)[(d)](#p22932) validates proceedings of a meeting which is inquorate unless it is inquorate by reason only of a matter within sub-paragraph [(1)](#p22916)[(b)](#p22923) or [(c)](#p22927).
- (c) a failure of the Secretary of State to comply with the requirements of paragraph 4, or
- (d) a failure to comply with arrangements under paragraph 16 or with a requirement under paragraph 18.
- (2) Nothing in sub-paragraph (1)(d) validates proceedings of a meeting which is inquorate unless it is inquorate by reason only of a matter within sub-paragraph (1)(b) or (c).
##### 20
@@ -21576,7 +21778,7 @@
- (1) All fees, charges, penalties and other sums received by the Commission in carrying out its functions are to be paid to the Secretary of State.
- (2) Sub-paragraph [(1)](#p22958) does not apply where the Secretary of State otherwise directs.
- (2) Sub-paragraph (1) does not apply where the Secretary of State otherwise directs.
- (3) Any sums received by the Secretary of State under this paragraph are to be paid into the Consolidated Fund.
@@ -21594,7 +21796,7 @@
- (b) send a copy of the certified statement and the report to the Secretary of State.
- (5) The Secretary of State must lay before Parliament each document received under sub-paragraph [(4)](#p22987)[(b)](#p22994).
- (5) The Secretary of State must lay before Parliament each document received under sub-paragraph (4)(b).
- (6) In this paragraph “*financial year*” means—
@@ -21632,11 +21834,11 @@
- (4) The chair may extend the term of the appointment but not so the term as extended is more than 2 years.
- (5) For the term of appointment, the person appointed under sub-paragraph [(1)](#p23059) is “the interim chief executive”.
- (6) Until the expiry of the term of appointment, the powers conferred on the non-executive members by paragraph [11](#p22612)[(2)](#p22617) and [(3)](#p22621) are exercisable in respect of the interim chief executive by the chair (instead of by the non-executive members).
- (7) In sub-paragraphs [(5)](#p23075) and [(6)](#p23080), the references to the term of appointment are to the term of appointment described in sub-paragraph [(3)](#p23067), including any extension of the term under sub-paragraph [(4)](#p23071).
- (5) For the term of appointment, the person appointed under sub-paragraph (1) is “the interim chief executive”.
- (6) Until the expiry of the term of appointment, the powers conferred on the non-executive members by paragraph 11(2) and (3) are exercisable in respect of the interim chief executive by the chair (instead of by the non-executive members).
- (7) In sub-paragraphs (5) and (6), the references to the term of appointment are to the term of appointment described in sub-paragraph (3), including any extension of the term under sub-paragraph (4).
##### 26
@@ -21646,7 +21848,7 @@
- (b) references to the payment of pensions, allowances or gratuities to or in respect of a person include references to the making of payments towards the provision of pensions, allowances or gratuities to be paid to or in respect of a person.
#### Merger of the directly applicable GDPR and the applied GDPR
#### The applied GPDR
#### GDPR: right to an effective remedy against the Commissioner
@@ -21725,3 +21927,435 @@
- (8) In this section, “*officer*”, in relation to a body corporate, means a director, manager, secretary or other similar officer of the body.
- (9) This section does not limit other lawful means of giving a notice.
##### 45A
- (1) Sections 44(2) and 45(1) do not require the controller to give the data subject—
- (a) information in respect of which a claim to legal professional privilege or, in Scotland, confidentiality of communications could be maintained in legal proceedings, or
- (b) information in respect of which a duty of confidentiality is owed by a professional legal adviser to a client of the adviser.
- (2) A controller relying on the exemption in subsection (1) must inform the data subject in writing without undue delay of—
- (a) the decision to rely on the exemption,
- (b) the reason for the decision,
- (c) the data subject’s right to make a request to the Commissioner under section 51,
- (d) the data subject’s right to lodge a complaint with the Commissioner under section 165, and
- (e) the data subject’s right to apply to a court under section 167.
- (3) Subsection (2)(a) and (b) do not apply to the extent that complying with them would—
- (a) undermine a claim described in subsection (1)(a), or
- (b) conflict with a duty described in subsection (1)(b).
- (4) The controller must—
- (a) record the reason for a decision to rely on the exemption in subsection (1), and
- (b) if requested to do so by the Commissioner, make the record available to the Commissioner.
- (5) The reference in subsection (1) to sections 44(2) and 45(1) includes sections 35 to 40 so far as their provisions correspond to the rights and obligations provided for in sections 44(2) and 45(1).
### Codes of conduct
##### 71A
- (1) The Commissioner must encourage expert public bodies to produce codes of conduct intended to contribute to compliance with this Part.
- (2) Under subsection (1), the Commissioner must, among other things, encourage the production of codes which take account of the specific features of the various processing sectors.
- (3) For the purposes of this section—
- (a) “*public body*” means a body or other person whose functions are, or include, functions of a public nature, and
- (b) a public body is “expert” if, in the Commissioner’s opinion, the body has the knowledge and experience needed to produce a code of conduct described in subsection (1).
- (4) A code of conduct described in subsection (1) may, for example, make provision with regard to—
- (a) lawful and fair processing;
- (b) the collection of personal data;
- (c) the information provided to the public and to data subjects;
- (d) the exercise of the rights of data subjects;
- (e) the measures and procedures referred to in sections 56, 57 and 62;
- (f) the notification of personal data breaches to the Commissioner and the communication of personal data breaches to data subjects;
- (g) the transfer of personal data to third countries or international organisations;
- (h) out-of-court proceedings and other dispute resolution procedures for resolving disputes between controllers and data subjects with regard to processing.
- (5) The Commissioner must encourage expert public bodies to submit codes of conduct described in subsection (1) to the Commissioner in draft.
- (6) Where an expert public body does so, the Commissioner must—
- (a) provide the body with an opinion on whether the code correctly reflects the requirements of this Part,
- (b) decide whether to approve the code, and
- (c) if the code is approved, register and publish the code.
- (7) Subsections (5) and (6) apply in relation to amendments of a code of conduct that is for the time being approved under this section as they apply in relation to a code.
##### 78A
- (1) A provision mentioned in subsection (2) does not apply to personal data processed for law enforcement purposes if exemption from the provision is required for the purposes of safeguarding national security.
- (2) The provisions are—
- (a) Chapter 2 of this Part (principles), except for the provisions listed in subsection (3);
- (b) Chapter 3 of this Part (rights of the data subject);
- (c) in Chapter 4 of this Part—
- (i) section 67 (notification of personal data breach to the Commissioner);
- (ii) section 68 (communication of personal data breach to the data subject);
- (d) Chapter 5 of this Part (transfers of personal data to third countries etc), except for the provisions listed in subsection (4);
- (e) in Part 5—
- (i) section 119 (inspection in accordance with international obligations);
- (ii) in Schedule 13 (other general functions of the Commissioner), paragraphs 1(1)(a) and (g) and 2;
- (f) in Part 6—
- (i) sections 142 to 154 and Schedule 15 (Commissioner’s notices and powers of entry and inspection);
- (ii) sections 170 to 173 (offences relating to personal data);
- (g) in Part 7, section 187 (representation of data subjects).
- (3) The provisions of Chapter 2 of this Part (principles) which are excepted from the list in subsection (2) are—
- (a) section 35(1) (the first data protection principle) so far as it requires processing of personal data to be lawful;
- (b) section 35(2) to (5) (lawfulness of processing and restrictions on sensitive processing);
- (c) section 42 (safeguards: sensitive processing);
- (d) Schedule 8 (conditions for sensitive processing).
- (4) The provisions of Chapter 5 of this Part (transfers of personal data to third countries etc) which are excepted from the list in subsection (2) are—
- (a) the following provisions of section 73—
- (i) subsection (1)(a) (conditions for transfer), so far as it relates to the condition in subsection (2) of that section, and subsection (2) (transfer must be necessary for a law enforcement purpose);
- (ii) subsections (1)(b), (5) and (6) (conditions for transfer of personal data originally made available by a member State);
- (b) section 78 (subsequent transfers).
##### 82A
- (1) For the purposes of this Part, the Secretary of State may give a notice designating processing of personal data by a qualifying competent authority (a “designation notice”) where—
- (a) an application for designation of the processing is made in accordance with this section, and
- (b) the Secretary of State considers that designation of the processing is required for the purposes of safeguarding national security.
- (2) The Secretary of State may only designate processing by a qualifying competent authority that is carried out by the authority as a joint controller with at least one intelligence service.
- (3) The Secretary of State may not designate processing by a qualifying competent authority that consists of the transfer of personal data to—
- (a) a country or territory outside the United Kingdom, or
- (b) an international organisation.
- (4) A designation notice must—
- (a) specify or describe the processing and qualifying competent authority that are designated, and
- (b) be given to the applicants for the designation (and see also section 82D).
- (5) An application for designation of processing of personal data by a qualifying competent authority must be made jointly by—
- (a) the qualifying competent authority, and
- (b) the intelligence service with which the processing is to be carried out.
- (6) An application may be made in respect of more than one qualifying competent authority and in respect of processing with more than one intelligence service.
- (7) The application must—
- (a) describe the processing, including the intended purposes and means of processing, and
- (b) explain why the applicants consider that designation is required for the purposes of safeguarding national security.
- (8) Before giving a designation notice, the Secretary of State must consult the Commissioner.
- (9) In this section, “*joint controller*”, in relation to processing of personal data, means a controller whose responsibilities for compliance with this Part in relation to the processing are determined in an arrangement under section 104.
##### 82B
- (1) A designation notice must state when it comes into force.
- (2) A designation notice ceases to be in force at the earliest of the following times—
- (a) at the end of the period of 5 years beginning when the notice comes into force;
- (b) (if relevant) at the end of a shorter period specified in the notice;
- (c) when the notice is withdrawn under section 82C.
- (3) The Secretary of State may give a further designation notice in respect of processing that is, or has been, the subject of a previous designation notice.
##### 82C
- (1) Subsections (2) to (4) apply where processing is the subject of a designation notice for the time being in force.
- (2) A person who applied for the designation of the processing must notify the Secretary of State without undue delay if the person considers that the designation is no longer required for the purposes of safeguarding national security.
- (3) A person who applied for the designation of the processing must, on a request from the Secretary of State, provide—
- (a) a description of the processing that is being, or is intended to be, carried out in reliance on the notice, and
- (b) an explanation of why the person considers that designation of the processing continues to be required for the purposes of safeguarding national security.
- (4) The Secretary of State must at least annually—
- (a) review each designation notice that is for the time being in force, and
- (b) consider whether designation of the processing which is the subject of the notice continues to be required for the purposes of safeguarding national security.
- (5) The Secretary of State—
- (a) may withdraw a designation notice by giving a further notice (a “withdrawal notice”) to the persons who applied for the designation, and
- (b) must give a withdrawal notice if the Secretary of State considers that designation of some or all of the processing to which the notice applies is no longer required for the purposes of safeguarding national security (whether as a result of a review required under subsection (4) or otherwise).
- (6) A withdrawal notice must—
- (a) withdraw the designation notice completely, and
- (b) state when it comes into force.
- (7) In determining when a withdrawal notice required under subsection (5)(b) comes into force, the Secretary of State must consider—
- (a) the desirability of the processing ceasing to be designated as soon as possible, and
- (b) where relevant, the time needed to effect an orderly transition to new arrangements for the processing of personal data.
##### 82D
- (1) Where the Secretary of State gives a designation notice—
- (a) the Secretary of State must send a copy of the notice to the Commissioner, and
- (b) the Commissioner must publish a record of the notice.
- (2) The record must contain—
- (a) the Secretary of State’s name,
- (b) the date on which the notice was given,
- (c) the date on which the notice ceases to have effect (if not previously withdrawn), and
- (d) subject to subsection (3), the rest of the text of the notice.
- (3) The Commissioner must not publish the text, or a part of the text, of the notice if—
- (a) the Secretary of State has determined that publishing the text or that part of the text—
- (i) would be against the interests of national security,
- (ii) would be contrary to the public interest, or
- (iii) might jeopardise the safety of any person, and
- (b) the Secretary of State has notified the Commissioner of that determination.
- (4) The Commissioner must keep the record of the notice available to the public while the notice is in force.
- (5) Where the Secretary of State gives a withdrawal notice, the Secretary of State must send a copy of the notice to the Commissioner.
##### 82E
- (1) A person directly affected by a designation notice may appeal to the Tribunal against the notice.
- (2) If, on an appeal under this section, the Tribunal finds that, applying the principles applied by a court on an application for judicial review, the Secretary of State did not have reasonable grounds for giving the notice, the Tribunal may—
- (a) allow the appeal, and
- (b) quash the notice.
### The Information Commission
##### 114A
- (1) A body corporate called the Information Commission is established.
- (2) Schedule 12A makes further provision about the Commission.
### Duties in carrying out functions
##### 120A
It is the principal objective of the Commissioner, in carrying out functions under the data protection legislation—
- (a) to secure an appropriate level of protection for personal data, having regard to the interests of data subjects, controllers and others and matters of general public interest, and
- (b) to promote public trust and confidence in the processing of personal data.
##### 120B
In carrying out functions under the data protection legislation, the Commissioner must have regard to such of the following as appear to the Commissioner to be relevant in the circumstances—
- (a) the desirability of promoting innovation;
- (b) the desirability of promoting competition;
- (c) the importance of the prevention, investigation, detection and prosecution of criminal offences;
- (d) the need to safeguard public security and national security;
- (e) the fact that children merit specific protection with regard to their personal data because they may be less aware of the risks and consequences associated with processing of personal data and of their rights in relation to such processing.
##### 120C
- (1) The Commissioner must prepare a strategy for carrying out the Commissioner’s functions under the data protection legislation in accordance with the Commissioner’s duties under—
- (a) sections 120A and 120B,
- (b) section 108 of the Deregulation Act 2015 (exercise of regulatory functions: economic growth), and
- (c) section 21 of the Legislative and Regulatory Reform Act 2006 (exercise of regulatory functions: principles).
- (2) The Commissioner must—
- (a) review the strategy from time to time, and
- (b) revise the strategy as appropriate.
- (3) The Commissioner must publish the strategy and any revised strategy.
##### 120D
- (1) The Commissioner must, at such times as the Commissioner considers appropriate, consult the persons mentioned in subsection (2) about how the manner in which the Commissioner exercises functions under the data protection legislation may affect economic growth, innovation and competition.
- (2) The persons are—
- (a) such persons exercising regulatory functions as the Commissioner considers appropriate;
- (b) such other persons as the Commissioner considers appropriate.
- (3) In this section, “*regulatory function*” has the meaning given by section 111 of the Deregulation Act 2015.
##### 139A
- (1) The Commissioner must prepare and publish an analysis of the Commissioner’s performance using key performance indicators.
- (2) The analysis must be prepared and published at least annually.
- (3) In this section, “*key performance indicators*” means factors by reference to which the Commissioner’s performance can be measured most effectively.
### Documents and notices
##### 161A
- (1) The Commissioner must produce and publish an annual report containing the information described in subsections (2) to (5).
- (2) The report must include the following information about UK GDPR investigations—
- (a) the number of investigations begun, continued or completed by the Commissioner during the reporting period,
- (b) the different types of act and omission that were the subject matter of the investigations,
- (c) the enforcement powers exercised by the Commissioner in the reporting period in connection with the investigations,
- (d) the duration of investigations that ended in the reporting period, and
- (e) the different types of outcome in investigations that ended in that period.
- (3) The report must include information about the enforcement powers exercised by the Commissioner in the reporting period in connection with—
- (a) processing of personal data by a competent authority for any of the law enforcement purposes, and
- (b) processing of personal data to which Part 4 applies.
- (4) The information included in the report in accordance with subsections (2) and (3) must include information about—
- (a) the number of penalty notices given in the reporting period that were given more than 6 months after the notice of intent was given under paragraph 2 of Schedule 16, and
- (b) the reasons why that happened.
- (5) The report must include a review of how the Commissioner had regard to the guidance published under section 160 when exercising the Commissioner’s enforcement powers as described in subsections (2)(c) and (3).
- (6) In this section—
- “*enforcement powers*” means the powers under—Article 58(1)(c) and (d) and (2)(a) and (b) of the UK GDPR,sections 142 to 159 of this Act,paragraph 2(a), (b) and (c) of Schedule 13 to this Act, andSchedules 15 and 16 to this Act;
- “*the law enforcement purposes*” has the meaning given in section 31 of this Act;
- “*the reporting period*” means the period to which the report relates;
- “*UK GDPR investigation*” means an investigation required under Article 57(1)(h) of the UK GDPR (investigations on the application of the UK GDPR).
##### 180A
- (1) This section applies where a court is required to determine whether a data subject is entitled to information by virtue of a right under—
- (a) Article 15 of the UK GDPR (right of access by the data subject);
- (b) Article 20 of the UK GDPR (right to data portability);
- (c) section 45 of this Act (law enforcement processing: right of access by the data subject);
- (d) section 94 of this Act (intelligence services processing: right of access by the data subject).
- (2) The court may require the controller to make available for inspection by the court so much of the information as is available to the controller.
- (3) But, unless and until the question in subsection (1) has been determined in the data subject’s favour, the court may not require the information to be disclosed to the data subject or the data subject’s representatives, whether by discovery (or, in Scotland, recovery) or otherwise.
- (4) Where the question in subsection (1) relates to a right under a provision listed in subsection (1)(a), (c) or (d), this section does not confer power on the court to require the controller to carry out a search for information that is more extensive than the reasonable and proportionate search required by that provision.
### Prohibitions and restrictions etc on processing
##### 183A
- (1) A relevant enactment or rule of law which imposes a duty, or confers a power, to process personal data does not override a requirement under the main data protection legislation relating to the processing of personal data.
- (2) Subsection (1) does not apply—
- (a) to a relevant enactment forming part of the main data protection legislation, or
- (b) to the extent that an enactment makes express provision to the contrary referring to this section or to the main data protection legislation (or a provision of that legislation).
- (3) Subsection (1) does not prevent a duty or power to process personal data from being taken into account for the purpose of determining whether it is possible to rely on an exception to a requirement under the main data protection legislation that is available where there is such a duty or power.
- (4) In this section—
- “*the main data protection legislation*” means the data protection legislation other than provision of or made under—Chapter 6 or 8 of the UK GDPR, orParts 5 to 7 of this Act;
- “*relevant enactment*” means an enactment so far as passed or made on or after 20th August 2025;
- “*requirement*” includes a prohibition or restriction.
- (5) The reference in subsection (1) to an enactment or rule of law which imposes a duty, or confers a power, to process personal data is a reference to an enactment or rule of law which, directly or indirectly, requires or authorises the processing of personal data, including (for example)—
- (a) by authorising one person to require another person to process personal data, or
- (b) by removing restrictions on processing personal data,
and the references in subsection (3) to a duty or power are to be read accordingly.
## Schedule A1
This condition is met where the processing is necessary for the purposes of responding to a request made in accordance with the Agreement between the Government of the United Kingdom of Great Britain and Northern Ireland and the Government of the United States of America on Access to Electronic Data for the Purpose of Countering Serious Crime, signed on 3 October 2019.
##### 57
The Border Security Commander.
2025-08-19
Data Protection Act 2018
2025-06-19
Data Protection Act 2018
2025-04-01
Data Protection Act 2018
2024-12-13
Data Protection Act 2018
2024-03-08
Data Protection Act 2018
2024-01-01
Data Protection Act 2018
2023-12-31
Data Protection Act 2018
2023-12-26
Data Protection Act 2018
2023-05-05
Data Protection Act 2018
2023-02-01
Data Protection Act 2018
2022-11-30
Data Protection Act 2018
2022-07-30
Data Protection Act 2018
2022-03-18
Data Protection Act 2018
2022-01-31
Data Protection Act 2018
2021-12-17
Data Protection Act 2018
2021-12-15
Data Protection Act 2018
2021-01-28
Data Protection Act 2018
2020-12-31
Data Protection Act 2018
2020-09-30
Data Protection Act 2018
2020-02-14
Data Protection Act 2018
2019-12-02
Data Protection Act 2018
2019-09-16
Data Protection Act 2018
2019-07-21
Data Protection Act 2018
2019-05-23
Data Protection Act 2018
2019-03-29
Data Protection Act 2018
2018-07-23
Data Protection Act 2018
2018-05-25
Data Protection Act 2018
2018-05-23
Data Protection Act 2018
original version
Text at this date