Data (Use and Access) Act 2025

(18AA) (1) This section applies to section 18 material which is not a DNA sample where the law enforcement authority obtained or acquired the material as part of a request for assistance, or a notification of a threat, sent to the United Kingdom via INTERPOL’s systems. (2) The law enforcement authority may retain the material until the National Central Bureau informs the authority that the request or notification has been cancelled or withdrawn. (3) If the law enforcement authority is the National Central Bureau, it may retain the material until it becomes aware that the request or notification has been cancelled or withdrawn. (4) In this section— - “INTERPOL” means the organisation called the International Criminal Police Organization - INTERPOL; - “the National Central Bureau” means the body appointed for the time being in accordance with INTERPOL’s constitution to serve as the United Kingdom’s National Central Bureau. (5) The reference in subsection (1) to material obtained or acquired as part of a request or notification includes material obtained or acquired as part of a communication, sent to the United Kingdom via INTERPOL’s systems, correcting, updating or otherwise supplementing the request or notification. (18AB) (1) The Secretary of State may by regulations amend section 18AA to make such changes as the Secretary of State considers appropriate in consequence of— (a) changes to the name of the organisation which, when section 18AA was enacted, was called the International Criminal Police Organization - INTERPOL (“the organisation”), (b) changes to arrangements made by the organisation which involve fingerprints or DNA profiles being provided to members of the organisation (whether changes to existing arrangements or changes putting in place new arrangements), or (c) changes to the organisation’s arrangements for liaison between the organisation and its members or between its members. (2) Regulations under this section are subject to affirmative resolution procedure.

• (4) In section 18BA(5)(a) (retention of further fingerprints), after “18A” insert “, 18AA”.

• (5) Section 18AA of the Counter-Terrorism Act 2008 applies in relation to section 18 material obtained or acquired by a law enforcement authority before the commencement day (as well as material obtained or acquired on or after that day), except where the law enforcement authority was informed, or became aware, as described in subsection (2) or (3) of that section before the commencement day.

• (6) Subsection (7) of this section applies where—

• (a) at the beginning of the commencement day, a law enforcement authority has section 18 material,

• (b) at a time before the commencement day (a “pre-commencement time”), the law enforcement authority was required by section 18(4) of the Counter-Terrorism Act 2008 to destroy the material, but

• (c) at the pre-commencement time, the law enforcement authority could have retained the material under section 18AA of that Act (as inserted by this section) if it had been in force.

• (7) Where this subsection applies—

• (a) the law enforcement authority is to be treated as not having been required to destroy the material at the pre-commencement time, but

• (b) the material may not be used in evidence against the person to whom the material relates—

• (i) in criminal proceedings in England and Wales, Northern Ireland or Scotland in relation to an offence where those proceedings, or other criminal proceedings in relation to the person and the offence, were instituted before the commencement day, or

• (ii) in criminal proceedings in any other country or territory.

• (8) In this section—

• “the commencement day”, “law enforcement authority” and “section 18 material” have the meaning given in section 126(14);

• “instituted”, in relation to proceedings, has the meaning given in section 126(15).

Trust services

The eIDAS Regulation

129

In sections 130 to 134, “the eIDAS Regulation” means Regulation (EU) No. 910/2014 of the European Parliament and the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market.

Recognition of EU conformity assessment bodies

130

In Chapter 3 of the eIDAS Regulation (trust services), after Article 24A insert—

(Article 24B) For the purposes of Articles 20(1), 21 and 24(1)(d), a body is to be treated as if it were a conformity assessment body in relation to a description of trust services provider (and trust service) if it is a conformity assessment body in relation to that description of provider (and service) for the purposes of the equivalent EU law.

Removal of recognition of EU standards etc

131

• (1) The Secretary of State may by regulations—

• (a) amend Article 24A of the eIDAS Regulation (recognition of EU standards etc for qualified trust services) so as to remove circumstances in which something is to be treated as qualified under that Regulation for the purposes of a provision or measure specified in paragraph 1 of that Article;

• (b) revoke that Article;

• (c) revoke Article 24B of the eIDAS Regulation (recognition of EU conformity assessment bodies);

• (d) revoke Article 51 of the eIDAS Regulation (transitional measures for electronic signatures);

• (e) amend a provision listed in subsection (3) so as to remove a reference to a trust service provider established in the EU;

• (f) amend a provision listed in subsection (4) so as to remove a reference to European standards or provisions of equivalent EU law.

• (2) The power under subsection (1)(a) includes power to amend or remove an assumption in Article 24A(2) of the eIDAS Regulation.

• (3) The provisions mentioned in subsection (1)(e) are—

• (a) Article 13(1) of the eIDAS Regulation;

• (b) Articles 2(1)(a) and 4(1)(a) of the Implementing Decision.

• (4) The provisions mentioned in subsection (1)(f) are—

• (a) Article 24(2)(b) of the eIDAS Regulation;

• (b) Articles 2(2)(c)(7) and 4(2)(c)(7) of the Implementing Decision.

• (5) Regulations under this section may—

• (a) include transitional provision or savings, and

• (b) make different provision for different purposes, including for the purposes of different provisions of the eIDAS Regulation.

• (6) Regulations under this section are subject to the negative resolution procedure.

• (7) In this section, “the Implementing Decision” means Commission Implementing Decision (EU) 2015/1506 laying down specifications relating to formats of advanced electronic signatures and advanced seals to be recognised by public sector bodies pursuant to Articles 27(5) and 37(5) of the eIDAS Regulation.

Recognition of overseas trust products

132

• (1) The eIDAS Regulation is amended as follows.

• (2) In Chapter 3 (trust services), after Article 45 insert—

(Article 45A) (1) The Secretary of State may by regulations provide that, for the purposes of Articles 25(2), 35(2), 41(2) and 43(2), an overseas trust product of a specified description is to be treated as qualified. (2) In this Article— - “overseas”, in relation to a trust product, means provided by a person established in a country or territory outside the United Kingdom; - “specified” means specified by regulations under this Article; - “trust product” means an electronic signature, an electronic seal, an electronic time stamp or an electronic registered delivery service. (3) The Secretary of State may not make regulations under this Article specifying a description of overseas trust product unless satisfied that the reliability of such a product is at least equivalent to the reliability of a comparable trust product that is qualified. (4) When making regulations under this Article in relation to a description of overseas trust product, the Secretary of State must have regard to (among other things) the law in the other country or territory relevant to that description of product and related trust services. (Article 45B) (1) The Secretary of State may by regulations provide that an overseas electronic signature of a specified description is to be treated— (a) for the purposes of Article 27(1), as an advanced electronic signature that complies with the Implementing Decision; (b) for the purposes of Article 27(2), as an advanced electronic signature based on a qualified certificate for electronic signature, or a qualified signature, that complies with the Implementing Decision. (2) The Secretary of State may by regulations provide that an overseas electronic seal of a specified description is to be treated— (a) for the purposes of Article 37(1), as an advanced electronic seal that complies with the Implementing Decision; (b) for the purposes of Article 37(2), as an advanced electronic seal based on a qualified certificate for electronic seal, or a qualified seal, that complies with the Implementing Decision. (3) In this Article— - “the Implementing Decision” means Commission Implementing Decision (EU) 2015/1506 laying down specifications relating to formats of advanced electronic signatures and advanced seals to be recognised by public sector bodies; - “overseas”, in relation to an electronic signature or electronic seal, means provided by a person established in a country or territory outside the United Kingdom; - “specified” means specified by regulations made under this Article. (4) The Secretary of State may not make regulations under point (a) or (b) of paragraph 1 or point (a) or (b) of paragraph 2 specifying a description of overseas electronic signature or overseas electronic seal unless satisfied that the reliability of such a signature or seal is at least equivalent to the reliability of a signature or seal described in that point. (5) When making regulations under this Article in relation to a description of overseas electronic signature or overseas electronic seal, the Secretary of State must have regard to (among other things) the law in the other country or territory relevant to that description of signature or seal and related trust services. (Article 45C) (1) Before making regulations under Article 45A or 45B, the Secretary of State must consult the supervisory body. (2) Regulations under Article 45A or 45B— (a) may describe something by (among other things) describing something that meets a condition specified in the regulations or is provided by a person who meets such a condition, and (b) may include a condition referring to (among other things) the law of the other country or territory or a standard or other document, including the law, standard or other document as amended from time to time. (3) Regulations under Article 45A or 45B may— (a) make different provision for different purposes, including for the purposes of different provisions of this Regulation, and (b) include transitional or transitory provision or savings. (4) Regulations under Article 45A or 45B are to be made by statutory instrument. (5) A statutory instrument containing regulations under Article 45A or 45B is subject to annulment in pursuance of either House of Parliament.

• (3) In Article 3(21) (definition of “product”), at the end insert “(except in the expression “trust product”)”.

Co-operation between supervisory authority and overseas authorities

133

• (1) Article 18 of the eIDAS Regulation (co-operation with EU authorities) is amended as follows.

• (2) In the heading, for “EU” substitute “overseas”.

• (3) In paragraph 1, for “public authority in the EU” substitute “designated overseas authority”.

• (4) In paragraph 2, for “other than in accordance with the data protection legislation” substitute “if the processing would contravene the data protection legislation (but in determining whether processing would do so, take into account the power conferred by that paragraph)”.

• (5) After paragraph 2 insert—

(3) In this Article— - “designated” means designated by regulations made by the Secretary of State that are in force; - “overseas authority” means a person, or description of person, with functions relating to the regulation or supervision of trust services outside the United Kingdom. (4) Before making regulations under this Article, the Secretary of State must consult the supervisory body. (5) Regulations under this Article may include transitional or transitory provision or savings. (6) Regulations under this Article are to be made by statutory instrument. (7) A statutory instrument containing regulations under this Article is subject to annulment in pursuance of either House of Parliament.

Time periods: the eIDAS Regulation and the EITSET Regulations

134

• (1) In Chapter 1 of the eIDAS Regulation (general provisions), after Article 3 insert—

(Article 3A) References in this Regulation to a period expressed in hours, days, months or years are to be interpreted in accordance with Article 3 of Regulation (EEC, Euratom) No. 1182/71 of the Council of 3 June 1971 determining the rules applicable to periods, dates and time limits.

• (2) The Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 (S.I. 2016/696) are amended as follows.

• (3) In regulation 2 (interpretation), at the end insert—

(3) References in these regulations to a period expressed in days or years are to be interpreted in accordance with Article 3 of Regulation (EEC, Euratom) No. 1182/71 of the Council of 3 June 1971 determining the rules applicable to periods, dates and time limits.

• (4) In Schedule 1 (monetary penalties)—

• (a) in paragraph 4(f), for the words from “a period” to the end substitute “the period of 21 days beginning when the notice of intent is served”,

• (b) in paragraph 5, for the words from “a period” to the end substitute “the period of 21 days beginning when the notice of intent is received”, and

• (c) in paragraph 6, for the words from “a period” to the end substitute “the period of 21 days beginning when the notice of intent is served”.

Copyright works and artificial intelligence systems

Economic impact assessment

135

• (1) The Secretary of State must, before the end of the period of 9 months beginning with the day on which this Act is passed—

• (a) prepare and publish an assessment of the economic impact in the United Kingdom of each of the four policy options described in section B.4 of the Copyright and AI Consultation Paper, read with relevant parts of section C of that Paper (policy options about copyright law and the training of artificial intelligence models using copyright works), and

• (b) lay a document containing the assessment before Parliament.

• (2) The document may include an assessment of the economic impact in the United Kingdom of policy options which are alternatives to the options described in subsection (1)(a).

• (3) An assessment included in the document must, among other things, include assessment of the economic impact of each option on—

• (a) copyright owners, and

• (b) persons who develop or use AI systems,

including the impact on copyright owners, developers and users who are individuals, micro businesses, small businesses or medium-sized businesses.

• (4) In this section—

• “AI system” means a machine-based system that, from the input it receives, can infer how to—generate predictions, digital content, recommendations, decisions or other similar outputs, orinfluence a physical or virtual environment,with a view to achieving an explicit or implicit objective;

• “the Copyright and AI Consultation Paper” means the command paper “Copyright and AI: Consultation”, numbered CP1205, published on 17 December 2024;

• “copyright owner” has the same meaning as in Part 1 of the Copyright, Designs and Patents Act 1988;

• “develop” an AI system means carry on an activity involved in producing the system, such as (for example) designing, programming, training or testing the system (and related terms are to be interpreted accordingly);

• “digital content” means data which is produced and supplied in digital form;

• “medium-sized business” means a business with at least 50 but fewer than 250 staff;

• “micro business” means a business with fewer than 10 staff;

• “small business” means a business with at least 10 but fewer than 50 staff;

• “use” an AI system means instruct an AI system to generate outputs or to influence an environment (and related terms are to be interpreted accordingly).

Report on the use of copyright works in the development of AI systems

136

• (1) The Secretary of State must, before the end of the period of 9 months beginning with the day on which this Act is passed—

• (a) prepare and publish a report on the use of copyright works in the development of AI systems, and

• (b) lay the report before Parliament.

• (2) The report must consider—

• (a) the four policy options described in section B.4 of the Copyright and AI Consultation Paper, read with relevant parts of section C of that Paper (policy options about copyright law and the training of artificial intelligence models using copyright works), and

• (b) such alternative options as the Secretary of State considers appropriate.

• (3) The report must consider, and make proposals in relation to, each of the following—

• (a) technical measures and standards (for example, measures and standards concerned with metadata) that may be used to control—

• (i) the use of copyright works to develop AI systems, and

• (ii) the accessing of copyright works for that purpose (for example, by web crawlers);

• (b) the effect of copyright on access to, and use of, data by developers of AI systems (for example, on text and data mining), including the effect on developers who are individuals, micro businesses, small businesses or medium-sized businesses;

• (c) the disclosure of information by developers of AI systems about—

• (i) their use of copyright works to develop AI systems, and

• (ii) how they access copyright works for that purpose (for example, by means of web crawlers);

• (d) the granting of licences to developers of AI systems to do acts restricted by copyright, including the granting of licences by and to individuals, micro businesses, small businesses and medium-sized businesses;

• (e) ways of enforcing requirements and restrictions relating to—

• (i) the use of copyright works to develop AI systems, and

• (ii) the accessing of copyright works for that purpose (for example, by web crawlers),

including enforcement by a regulator.

• (4) The consideration and proposals under each of paragraphs (a) to (e) of subsection (3) must include consideration of, and proposals relating to, AI systems developed outside the United Kingdom.

• (5) In preparing the report, the Secretary of State must consider the likely effect of proposals, in the United Kingdom, on—

• (a) copyright owners, and

• (b) persons who develop or use AI systems,

including the likely effect on copyright owners, developers and users who are individuals, micro businesses, small businesses or medium-sized businesses.

• (6) In preparing the report, the Secretary of State must have regard to, among other things, the Consultation Paper responses.

• (7) The Secretary of State may comply with this section by preparing and publishing two or more reports which, taken together, satisfy the requirements in this section.

• (8) In this section—

• “Consultation Paper responses” means responses to the Copyright and AI Consultation Paper received by the Secretary of State on or before 25 February 2025;

• “copyright” means the property right which subsists in accordance with Part 1 of the Copyright, Designs and Patents Act 1988;

• “copyright work” has the same meaning as in Part 1 of the Copyright, Designs and Patents Act 1988;

• “web crawler” means a computer program that obtains data from websites in accordance with instructions and that can autonomously determine which websites to visit.

• (9) Terms used in this section and in section 135 have the same meaning in this section as they have in that section.

Progress statement

137

• (1) The Secretary of State must, before the end of the period of 6 months beginning with the day on which this Act is passed, lay before Parliament a statement setting out what progress has been made towards the publication of—

• (a) the economic impact assessment required by section 135, and

• (b) the report required by section 136.

• (2) The duty in subsection (1) does not apply where the economic impact assessment and the report have been published before the end of the period described in that subsection.

Purported intimate images

Creating, or requesting the creation of, purported intimate image of adult

138

• (1) The Sexual Offences Act 2003 is amended in accordance with subsections (2) and (3).

• (2) After section 66D insert—

(66E) (1) A person (A) commits an offence if— (a) A intentionally creates a purported intimate image of another person (B), (b) B does not consent to the creation of the purported intimate image, and (c) A does not reasonably believe that B consents. (2) “Purported intimate image” of a person means an image which— (a) appears to be, or to include, a photograph or film of the person (but is not, or is not only, a photograph or film of the person), (b) appears to be of an adult, and (c) appears to show the person in an intimate state. (3) Subsections (5) to (9) of section 66D (person in an intimate state) apply for the purposes of this section as if references in those subsections to a photograph or film were references to an image. (4) References in this section to creating a purported intimate image of a person do not include doing so by modifying a photograph or film of the person where what is created by the modification is an image which— (a) appears to show the person, but (b) does not appear to show— (i) something within section 66D(5)(a) to (e) (read with subsections (6) and (7) of that section) which is not shown in the photograph or film, or (ii) a person who is not shown in the photograph or film. (5) It is a defence for a person charged with an offence under this section to prove that the person had a reasonable excuse for creating the purported intimate image. (6) A person who commits an offence under this section is liable on summary conviction to imprisonment for a term not exceeding the maximum term for summary offences or a fine (or both). (7) The Secretary of State must— (a) review the operation of subsection (5), (b) publish the outcome of the review in a report before the end of the period of two years beginning with the day on which this section comes into force, and (c) lay the report before Parliament. (66F) (1) A person (A) commits an offence if— (a) A intentionally requests the creation of a purported intimate image of another person (B) (either in general or specific terms), (b) B does not consent to A requesting the creation of the purported intimate image, and (c) A does not reasonably believe that B consents. (2) A person (A) commits an offence if— (a) A intentionally requests that, if a purported intimate image of another person (B) is created, it includes or excludes something in particular (whether relating to B’s appearance, the intimate state in which B is shown or anything else), (b) B does not consent to A requesting the inclusion or exclusion of that thing, and (c) A does not reasonably believe that B consents. (3) References in this section to making a request (however expressed) include doing an act which could reasonably be taken to be a request (such as, for example, indicating agreement in response to an offer or complying with conditions of an offer). (4) References in this section to making a request (however expressed) are references to— (a) making a request directed to a particular person or persons, or (b) making a request so that it is available to one or more persons (or people generally), without directing it to a particular person or persons. (5) References in this section to consent to a person requesting something are— (a) in a case described in subsection (4)(a), references to consent to a request being made that is directed to the particular person or persons, and (b) in a case described in subsection (4)(b), references to consent to a request being made so that it is available to the person or persons (or people generally), as appropriate. (6) An offence under this section is committed— (a) regardless of whether the purported intimate image is created, (b) regardless of whether the purported intimate image, or the particular thing to be included in or excluded from such an image, is also requested by another person, and (c) regardless of where in the world the person or persons mentioned in subsection (4)(a)and (b) is or are located. (7) It is a defence for a person charged with an offence under this section to prove that the person had a reasonable excuse for making the request. (8) A person who commits an offence under this section is liable on summary conviction to imprisonment for a term not exceeding the maximum term for summary offences or a fine (or both). (9) In this section, references to a purported intimate image, to creating such an image and to a person shown in an intimate state have the same meaning as in section 66E. (10) The Secretary of State must— (a) review the operation of subsection (7), (b) publish the outcome of the review in a report before the end of the period of two years beginning with the day on which this section comes into force, and (c) lay the report before Parliament. (66G) (1) This section applies for the purposes of sections 66E and 66F. (2) “Consent” to an act includes general consent covering the particular act as well as specific consent to that particular act (and see also section 66F(5)). (3) Whether a belief is “reasonable” is to be determined having regard to all the circumstances, including any steps A has taken to ascertain whether B consents. (4) “Photograph” includes the negative as well as the positive version. (5) “Film” means a moving image. (6) A reference to an “image”, “photograph” or “film” includes data stored by any means which is capable of conversion into an image, photograph or film. (7) An image of a person appears to be an image of an adult if— (a) the impression conveyed by the image is that the person shown is aged 18 or over, or (b) the predominant impression conveyed by the image is that the person shown is aged 18 or over (even if some of the physical characteristics shown are those of a person under 18). (8) The “maximum term for summary offences” means— (a) if the offence is committed before the time when section 281(5) of the Criminal Justice Act 2003 comes into force, six months; (b) if the offence is committed after that time, 51 weeks. (66H) (1) Notwithstanding section 127(1) of the Magistrates’ Courts Act 1980, a magistrates’ court may try an information or written charge relating to an offence under section 66E or 66F if the information is laid or the charge is issued— (a) before the end of the period of 3 years beginning with the day on which the offence was committed, and (b) before the end of the period of 6 months beginning with the day on which evidence which the prosecutor thinks is sufficient to justify a prosecution comes to the prosecutor’s knowledge. (2) A certificate signed by or on behalf of a prosecutor stating the date on which evidence described in subsection (1)(b) came to the prosecutor’s knowledge is conclusive evidence of that fact.

• (3) In section 79(5) (meaning of references to image of a person), after “a person” insert “(except in sections 66E, 66F and 66G)”.

• (4) In the Armed Forces Act 2006, after section 177D insert—

(177DA) (1) This section applies where a person commits an offence under section 42 as respects which the corresponding offence under the law of England and Wales is an offence under section 66E of the Sexual Offences Act 2003 (creating purported intimate image of adult). (2) The purported intimate image to which the offence relates, and anything containing it, is to be regarded for the purposes of section 177C(3) (and section 94A(3)(b)(ii)) as used for the purposes of committing the offence (including where it is committed by aiding, abetting, counselling or procuring).

• (5) In Part 2 of Schedule 3 to the Serious Crime Act 2007 (offences to be disregarded in reckoning whether an act is capable of encouraging or assisting the commission of an offence: England and Wales), after paragraph 38 insert—

(38ZA) An offence under section 66F of the Sexual Offences Act 2003 (requesting the creation of purported intimate image of adult).

• (6) In the Sentencing Code, after section 154 insert—

(154A) (1) Subsection (2) applies where a person commits an offence under section 66E of the Sexual Offences Act 2003 (creating purported intimate image of adult). (2) The purported intimate image to which the offence relates, and anything containing it, is to be regarded for the purposes of section 153 (and section 157(3)(b)) as used for the purposes of committing the offence (including where it is committed by aiding, abetting, counselling or procuring). (3) Subsection (4) applies where a person commits an offence under section 66F of the Sexual Offences Act 2003 (requesting the creation of purported intimate image of adult). (4) A purported intimate image which is connected with the offence, and anything containing it, is to be regarded for the purposes of section 153 (and section 157(3)(b)) as used for the purposes of committing the offence (including where it is committed by aiding, abetting, counselling or procuring). (5) A purported intimate image is connected with an offence under section 66F of the Sexual Offences Act 2003 if — (a) it appears to be of a person who was the subject of the request to which the offence relates (whether or not it is what was requested), and (b) it was in the offender’s possession, or under the offender’s control, as a result of that request.

Part 8 — Final provisions

Power to make consequential amendments

139

• (1) The Secretary of State may by regulations make provision that is consequential on any provision made by this Act.

• (2) Regulations under this section—

• (a) may make different provision for different purposes;

• (b) may include transitional, transitory or saving provision;

• (c) may amend, repeal or revoke any provision made by an enactment.

• (3) The reference in subsection (2)(c) to provision made by an enactment is—

• (a) where the amendment, repeal or revocation is consequential on section 117, 118 or 119(1) or Schedule 14, a reference to provision made by an enactment whenever passed or made (including this Act), and

• (b) in any other case, a reference to provision made by an enactment passed or made before the end of the Session in which this Act is passed.

• (4) Regulations under this section made in consequence of section 183A of the Data Protection Act 2018 (inserted by section 106 of this Act) may amend, repeal or revoke provision which refers to the data protection legislation (as defined in section 3 of the Data Protection Act 2018) as they could if the provision referred instead to the main data protection legislation (as defined in section 183A of that Act).

• (5) Regulations under this section that amend, repeal or revoke primary legislation are subject to the affirmative resolution procedure.

• (6) Any other regulations under this section are subject to the negative resolution procedure.

• (7) In this section—

• “enactment” includes—an enactment comprised in subordinate legislation (as defined in section 21 of the Interpretation Act 1978),an enactment comprised in, or in an instrument made under, a Measure or Act of Senedd Cymru,an enactment comprised in, or in an instrument made under, an Act of the Scottish Parliament,an enactment comprised in, or in an instrument made under, Northern Ireland legislation, andassimilated direct legislation;

• “primary legislation” means—an Act of Parliament;an Act of the Scottish Parliament;a Measure or Act of Senedd Cymru;Northern Ireland legislation.

Regulations

140

• (1) Regulations under this Act are to be made by statutory instrument.

• (2) Where regulations under this Act are subject to “the affirmative resolution procedure” the regulations may not be made unless a draft of the statutory instrument containing them has been laid before Parliament and approved by a resolution of each House of Parliament.

• (3) Where regulations under this Act are subject to “the negative resolution procedure” the statutory instrument containing the regulations is subject to annulment in pursuance of a resolution of either House of Parliament.

• (4) Any provision that may be included in regulations under this Act made by the Secretary of State or the Treasury subject to the negative resolution procedure may be made by regulations subject to the affirmative resolution procedure.

Extent

141

• (1) This Act extends to England and Wales, Scotland and Northern Ireland, subject to subsections (2) to (5).

• (2) In Part 3 (National Underground Asset Register)—

• (a) sections 56, 57(1) to (7) and 60(1) and Schedule 1 extend to England and Wales only, and

• (b) sections 58, 59 and 60(2) and Schedule 2 extend to Northern Ireland only.

• (3) In Part 4 (registers of births and deaths)—

• (a) sections 61 to 64 extend to England and Wales only, and

• (b) an amendment or repeal made by Schedule 3 (minor and consequential amendments) has the same extent as the enactment amended or repealed.

• (4) In Part 6 (the Information Commission), paragraph 23 of Schedule 12A to the Data Protection Act 2018 (inserted by Schedule 14 to this Act) extends to England and Wales and Northern Ireland only.

• (5) In Part 7—

• (a) section 121 and Schedule 15 (information standards for health and adult social care) extend to England and Wales only;

• (b) paragraphs 2, 3 and 5 to 7 of Schedule 16 (grant of smart meter communication licences) extend to England and Wales and Scotland only;

• (c) section 138(1) to (3) and (6) (creating, or requesting the creation of, purported intimate image of adult) extend to England and Wales only;

• (d) section 138(4) (amendment of the Armed Forces Act 2006) extends to—

• (i) England and Wales, Scotland and Northern Ireland,

• (ii) the Isle of Man, and

• (iii) the British overseas territories, except Gibraltar;

• (e) section 138(5) (amendment of the Serious Crime Act 2007) extends to England and Wales and Northern Ireland only.

• (6) The powers conferred by section 384(1) and (2) of the Armed Forces Act 2006 (powers to extend provisions to the Channel Islands and to make provisions apply with modifications as they extend to the Channel Islands, the Isle of Man and British overseas territories other than Gibraltar) may be exercised in relation to section 177DA of that Act (inserted by section 138(4) of this Act).

• (7) The power conferred by section 63(3) of the Immigration, Asylum and Nationality Act 2006 may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man any amendment made by section 55 of this Act of any part of that Act (with or without modification or adaptation).

• (8) The power conferred by section 76(6) of the Immigration Act 2014 may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man any amendment made by section 55 of this Act of any part of that Act (with or without modifications).

• (9) The power conferred by section 95(5) of the Immigration Act 2016 may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man any amendment made by section 55 of this Act of any part of that Act (with or without modifications).

• (10) The power conferred by section 239(7) of the Online Safety Act 2023 may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man any amendment or repeal made by this Act of any part of that Act (with or without modifications).

• (11) In this section, “enactment” has the same meaning as in section 139.

Commencement

142

• (1) Except as provided by subsections (2) to (4), this Act comes into force on such day as the Secretary of State may by regulations appoint.

• (2) The following provisions come into force on the day on which this Act is passed—

• (a) section 66 (meaning of “the 2018 Act” and “the UK GDPR”);

• (b) section 78 (searches in response to data subjects’ requests);

• (c) Part 1 of Schedule 16 (grant of smart meter communication licences) and section 122 so far as relating to that Part of that Schedule;

• (d) section 126 (retention of biometric data and recordable offences);

• (e) section 127 (retention of pseudonymised biometric data);

• (f) section 128 (retention of biometric data from INTERPOL);

• (g) this Part;

• (h) any other provision of this Act (including provision modifying other legislation) so far as it confers power to make regulations or is otherwise necessary for enabling the exercise of such a power on or after the day on which this Act is passed.

• (3) The following provisions come into force at the end of the period of two months beginning with the day on which this Act is passed—

• (a) section 69 (consent to law enforcement processing);

• (b) section 82 (logging of law enforcement processing);

• (c) section 96 (notices from the Information Commissioner);

• (d) section 97 (power of the Information Commissioner to require documents).

• (4) Part 2 of Schedule 16 (grant of smart meter communication licences), and section 122 so far as relating to that Part of that Schedule, come into force on the day on which the first regulations under section 91A(1) of the Energy Act 2008 (inserted by Part 1 of Schedule 16) come into force.

• (5) Regulations under this section may make different provision for different purposes.

Transitional, transitory and saving provision

143

• (1) The Secretary of State may by regulations make transitional, transitory or saving provision in connection with the coming into force of any provision of this Act.

• (2) Regulations under this section may amend Schedule 21 to the Data Protection Act 2018 or Part 2 of Schedule 9 to this Act by adding, varying or repealing provision.

• (3) Regulations under this section containing provision described in subsection (2) are subject to the negative resolution procedure.

• (4) Regulations under this section may make different provision for different purposes.

Short title

144

This Act may be cited as the Data (Use and Access) Act 2025.

Schedule 1

In the New Roads and Street Works Act 1991, after Schedule 5 insert—

Schedule 2

In the Street Works (Northern Ireland) Order 1995 (S.I. 1995/3210 (N.I. 19)), after Schedule 2 insert—

Schedule 3

Part 1 — Amendments of the Births and Deaths Registration Act 1953

1

The Births and Deaths Registration Act 1953 is amended as follows.

2

• (1) Section 3A (registration of births of abandoned children) is amended as follows.

• (2) In subsection (5), for the words from “direct” to the end substitute “enter in the margin of the relevant register of births a reference to the re-registration of the birth or, if the relevant register of births is in hard copy form, shall direct the officer having custody of that register to do so.”

• (3) After that subsection insert—

(6) In subsection (5) “the relevant register of births”, in relation to the re-registration of the birth of a child, means the register of births in which the entry relating to the child was previously made.

3

• (1) Section 13 (registration of name of child or of alteration of name) is amended as follows.

• (2) In subsection (1), for “the registrar or superintendent registrar having the custody of the register” substitute “the relevant registration officer for the register”.

• (3) In subsection (1A), for “The registrar or superintendent registrar having custody of the register in question” substitute “The relevant registration officer”.

• (4) In subsection (1B), for “the registrar or superintendent registrar” substitute “the relevant registration officer”.

• (5) After subsection (2) insert—

(2A) In this section the “relevant registration officer” for a register means— (a) the registrar of births and deaths for the sub-district for which the register is or has been kept, or (b) the superintendent registrar for the district containing that sub-district.

4

In Part 3 (general), the italic heading before section 25 becomes “Registers, etc”.

5

• (1) Section 29 (correction of errors in registers) is amended as follows.

• (2) In subsection (3), for “the officer having the custody of the register” substitute “the appropriate registration officer”.

• (3) In subsection (3A)(b), for “the officer having the custody of the register” substitute “the appropriate registration officer”.

• (4) In subsection (3B)(b), for “the officer having the custody of the register” substitute “the appropriate registration officer”.

• (5) In subsection (4), for “the officer having the custody of the register” substitute “the appropriate registration officer for the register”.

• (6) After subsection (4) insert—

(5) In this section the “appropriate registration officer”, in relation to a register, means— (a) in the case of a register of live-births or of deaths in hard copy form, the superintendent registrar having custody of the register; (b) in the case of a register of live-births or of deaths not in hard copy form— (i) the registrar of births and deaths for the sub-district for which the register is or has been kept, or (ii) the superintendent registrar for the district containing that sub-district; (c) in the case of a register of still-births, the Registrar General.

6

In section 29A (alternative procedure for certain corrections), in subsection (4)—

• (a) for “the officer having custody of the register” substitute “the appropriate registration officer”;

• (b) at the end insert—

• “Appropriate registration officer” has the same meaning as in section 29 of this Act.

7

• (1) Section 30 (searches of indexes kept by Registrar General) is amended as follows.

• (2) After subsection (1) insert—

(1ZA) The Registrar General shall cause the following indexes to be made and kept in the General Register Office— (a) an index of the entries in the registers kept under section 1 of this Act; (b) an index of the entries in the registers kept under section 15 of this Act.

• (3) In subsection (2), after “certified copies” insert “or in the said registers (as the case may be)”.

• (4) In subsection (3)—

• (a) for “to certified copies of entries in” substitute “in relation to”;

• (b) for the words from “any such” to the end substitute “any register of still-births”.

8

In section 31 (searches of indexes kept by superintendent registrars), for subsection (1) substitute—

(1) The superintendent registrar for each district shall cause the following indexes to be made— (a) an index of the entries in the registers of live-births kept for the sub-districts within that district; (b) an index of the entries in the registers of deaths kept for the sub-districts within that district. (1A) The indexes must be kept with the other records of the register office for the district.

9

For section 32 (searches in registers kept by registrars) substitute—

(32) (1) Any person is entitled to obtain from a registrar for a sub-district, at any time when the registrar’s office is required to be open for the transaction of public business, a copy certified by the registrar of any entry in any register of births or register of deaths kept for that sub-district. (2) But subsection (1) does not apply in relation to any register of still-births except as the registrar may, with the consent of the Registrar General, in any particular case allow.

10

• (1) Section 33 (short certificate of birth) is amended as follows.

• (2) In subsection (1), for “the Registrar General, a superintendent registrar or a registrar” substitute “the appropriate registration officer”.

• (3) After subsection (1) insert—

(1A) In subsection (1) the “appropriate registration officer” means— (a) in the case of a live-birth, the Registrar General, a superintendent registrar or a registrar; (b) in the case of a still-birth— (i) the Registrar General, or (ii) a registrar acting at the time of the registration of the still-birth or with the consent of the Registrar General.

• (4) In subsection (2)—

• (a) for the words from “the records and registers” to “may be” substitute “the register in which the entry relating to the birth is made, or, in the case of the Registrar General, from the records in the Registrar General’s custody”;

• (b) for “any such records or registers” substitute “any register of births or in any such records”.

11

In section 33A (short certificate of death), in subsection (2), for the words from “the records and registers” to “may be” substitute “the register in which the entry relating to the death is made, or, in the case of the Registrar General, from the records in the Registrar General’s custody”.

12

In section 34 (entry in register as evidence of birth or death), in subsection (5), before “on which” insert “in or”.

13

• (1) Section 34A (searches and records of information: additional provision) is amended as follows.

• (2) In subsection (1)—

• (a) after paragraph (a) insert—

(aa) to carry out, on request, a search to find out whether any of the registers kept under this Act contains a particular entry;

;

• (b) in paragraph (b), after “copies” insert “or in such a register”.

• (3) In subsection (5), at the end insert “or in a register kept under this Act”.

14

In section 35 (offences relating to registers), in paragraph (b), after “deaths” insert “kept in hard copy form”.

15

In section 40 (sending and providing notices, information or other documents), omit “, return”.

16

In section 41 (interpretation), after subsection (3) insert—

(4) For the purposes of this Act a register is in hard copy form if it consists of a paper copy or similar form capable of being read with the naked eye.

Part 2 — Amendments of other legislation

Registration Service Act 1953

17

The Registration Service Act 1953 is amended as follows.

18

In section 10 (district register offices), in subsection (1), omit the words from “, and shall provide” to the end.

19

In section 12 (provision of register boxes), omit “registrar of births and deaths and”.

20

In section 13 (local schemes of organisation), in subsection (2), after paragraph (b) insert—

(ba) determining the equipment or facilities to be provided at those offices and stations by the council for the non-metropolitan county or metropolitan district;

.

Public Records Act 1958

21

In Schedule 1 to the Public Records Act 1958 (definition of public records), in paragraph 2(2)(b), after “adoptions,” insert “or to any other records held by the Registrar General of information entered in any register of births or deaths kept under any such enactment,”.

Social Security Administration Act 1992

22

In section 124 of the Social Security Administration Act 1992 (provisions relating to age, death and marriage), after subsection (5) insert—

(6) The reference in subsection (1) above to a register in the custody of a registrar or superintendent registrar includes, in relation to registers of births or deaths kept under the Births and Deaths Registration Act 1953, a reference to any such register kept for the registrar’s sub-district or (as the case may be) for a sub-district within the superintendent registrar’s district; and references in subsection (3) above to the custodian of the register are to be read accordingly.

Education Act 1996

23

• (1) Section 564 of the Education Act 1996 (certificates of birth and registrars’ returns) is amended as follows.

• (2) In subsection (1), for “the registrar having the custody of the register of births and deaths” substitute “the relevant registrar for the register”.

• (3) In subsection (3)—

• (a) for “A registrar” substitute “The relevant registrar for a register”;

• (b) for “any register of births and deaths in his custody” substitute “the register”.

• (4) In subsection (4)—

• (a) in the definition of “the appropriate fee”, for “the registrar having custody of the register concerned” substitute “the relevant registrar for a register”;

• (b) for the definition of “register of births and deaths” substitute—

• “register” means a register of births or register of deaths kept under that Act,

;

• (c) at the end insert—

• “the relevant registrar” for a register means— in the case of a register in hard copy form (within the meaning of the Births and Deaths Registration Act 1953), the superintendent registrar having custody of the register; in the case of a register not in hard copy form (within the meaning of that Act)— the registrar of births and deaths for the sub-district for which the register is or has been kept, or the superintendent registrar for the district containing that sub-district.

Adoption and Children Act 2002

24

In section 78 of the Adoption and Children Act 2002 (Adopted Children Register: searches and copies), in subsection (4)—

• (a) in paragraph (a), omit “certified copies of”;

• (b) in paragraph (b), for “certified copies”, in the second place it occurs, substitute “registers”.

Gender Recognition Act 2004

25

The Gender Recognition Act 2004 is amended as follows.

26

• (1) Section 10 (registration) is amended as follows.

• (2) In subsection (2), omit the “or” after paragraph (a) and after paragraph (b) insert

, or (c) an entry in a register kept under section 1 of the Births and Deaths Registration Act 1953,

.

• (3) For subsection (3) substitute—

(3) “The appropriate Registrar General” means— (a) in relation to a UK birth register entry of which a certified copy is kept by a Registrar General or which is in a register so kept, whichever Registrar General keeps that certified copy or that register; (b) in relation to a UK birth register entry in a register kept under section 1 of the Births and Deaths Registration Act 1953, the Registrar General for England and Wales. (3A) For the purposes of this section each of the following is a Registrar General— (a) the Registrar General for England and Wales; (b) the Registrar General for Scotland; (c) the Registrar General for Northern Ireland.

27

In Part 1 of Schedule 3 (registration: England and Wales), in paragraphs 5(3) and 8(2), for “or (b)” substitute “, (b) or (c)”.

Presumption of Death Act 2013

28

In Schedule 1 to the Presumption of Death Act 2013 (Register of Presumed Deaths), in paragraph 7 (interpretation)—

• (a) after “means” insert

— (a)

;

• (b) at the end insert

, or (b) the index kept in the General Register Office of such entries.

Schedule 4

In the UK GDPR, at the end insert—

Schedule 5

In the UK GDPR, after Annex 1 (inserted by Schedule 4 to this Act) insert—

Schedule 6

The UK GDPR

1

The UK GDPR is amended as follows.

2

• (1) Article 12 (transparent information, communication and modalities for the exercise of the rights of the data subject) is amended as follows.

• (2) In paragraph 1, for “under Articles 15 to 22” substitute “made under or by virtue of Articles 15 to 22D”.

• (3) In paragraph 2—

• (a) for “under Articles 15 to 22”, in the first place it occurs, substitute “arising under or by virtue of Articles 15 to 22D”, and

• (b) for “his or her rights under Articles 15 to 22” substitute “those rights”.

• (4) In paragraph 3, for “under Articles 15 to 22” substitute “made under or by virtue of Articles 15 to 22D”.

• (5) In paragraph 5, for “under Articles 15 to 22” substitute “under or by virtue of Articles 15 to 22D”.

• (6) In paragraph 6, for “referred to in Articles 15 to 21” substitute “made under or by virtue of Articles 15 to 22D”.

3

In Article 13(2)(f) (information about automated decision-making to be provided where personal data is collected from the data subject), for “referred to in Article 22(1) and (4)” substitute “which is subject to the requirement to provide safeguards under Article 22C”.

4

In Article 14(2)(g) (information about automated decision-making to be provided where personal data is not obtained from the data subject), for “referred to in Article 22(1) and (4)” substitute “which is subject to the requirement to provide safeguards under Article 22C”.

5

In Article 15(1)(h) (right of access by the data subject), for “referred to in Article 22(1) and (4)” substitute “which is subject to the requirement to provide safeguards under Article 22C”.

6

In the heading of Section 4 of Chapter 3, omit “and automated decision-making”.

7

In Article 23(1) (restrictions), for “provided for in Articles 12 to 22”, in both places it occurs, substitute “arising under or by virtue of Articles 12 to 22D”.

8

In Article 47(2)(e) (binding corporate rules), for the words from “the right not” to “Article 22” substitute “the right to protection in accordance with, and with regulations made under, Articles 22A to 22D in connection with decisions based solely on automated processing (including decisions reached by means of profiling)”.

9

In Article 83(5) (general conditions for imposing administrative fines)—

• (a) in point (b), for “22” substitute “21”, and

• (b) after that point insert—

(ba) Article 22B or 22C (restrictions on, and safeguards for, automated decision-making);

.

The 2018 Act

10

The 2018 Act is amended as follows.

11

Omit section 14 (automated decision-making authorised by law: safeguards).

12

In section 43(1)(d) (overview and scope of provisions in Part 3 about rights of the data subject), for “sections 49 and 50” substitute “sections 50A to 50D”.

13

• (1) Section 52 (form of provision of information etc) is amended as follows.

• (2) In subsection (1), after “by” insert “or under”.

• (3) In subsection (3), for “by the data subject under section 45, 46, 47 or 50” substitute “made by the data subject under or by virtue of any of sections 45, 46, 47, 50C or 50D”.

• (4) In subsection (4), for “under section 45, 46 or 47” substitute “under or by virtue of any of sections 45, 46, 47, 50C or 50D”.

• (5) In subsection (5), after “by” insert “or under”.

• (6) In subsection (6), for “under sections 45 to 50” substitute “arising under or by virtue of sections 45 to 50D”.

14

• (1) Section 53 (manifestly unfounded or excessive requests by the data subject) is amended as follows.

• (2) In subsection (1), for “from a data subject under section 45, 46, 47 or 50” substitute “made by a data subject under or by virtue of any of sections 45, 46, 47, 50C or 50D”.

• (3) In subsection (3), for “under section 45, 46, 47 or 50” substitute “described in subsection (1)”.

15

In section 149(2)(b) (enforcement notices)—

• (a) after “provision of” insert “or made under”, and

• (b) for “22” substitute “22D”.

16

In section 157(2)(a) (maximum amount of penalty), for “49,” substitute “50B, 50C,”.

Schedule 7

Introduction

1

Chapter 5 of the UK GDPR (transfers of personal data to third countries or international organisations) is amended as follows.

General principles for transfers

2

• (1) Omit Article 44 (transfers of personal data to third countries etc: general principle for transfers).

• (2) After that Article insert—

(Article 44A) (1) A controller or processor may transfer personal data to a third country or an international organisation only if— (a) the condition in paragraph 2 is met, and (b) the transfer is carried out in compliance with the other provisions of this Regulation. (2) The condition is met if the transfer— (a) is approved by regulations under Article 45A that are in force at the time of the transfer, (b) is made subject to appropriate safeguards (see Article 46), or (c) is made in reliance on a derogation for specific situations (see Article 49). (3) A transfer may not be made in reliance on paragraph 2(b) or (c) if, or to the extent that, it would breach a restriction in regulations under Article 49A.

Transfers approved by regulations

3

Omit Article 45 (transfers on the basis of an adequacy decision).

4

After that Article insert—

(Article 45A) (1) For the purposes of Article 44A, the Secretary of State may by regulations approve transfers of personal data to— (a) a third country, or (b) an international organisation. (2) The Secretary of State may only make regulations under this Article approving transfers to a third country or international organisation if the Secretary of State considers that the data protection test is met in relation to the transfers (see Article 45B). (3) In making regulations under this Article, the Secretary of State may have regard to any matter which the Secretary of State considers relevant, including the desirability of facilitating transfers of personal data to and from the United Kingdom. (4) Regulations under this Article may, among other things— (a) make provision in relation to a third country or international organisation specified in the regulations or a description of country or organisation; (b) approve all transfers of personal data to a third country or international organisation or only transfers specified or described in the regulations; (c) identify a transfer of personal data by any means, including by reference to— (i) a sector or geographic area within a third country, (ii) the controller or processor, (iii) the recipient of the personal data, (iv) the personal data transferred, (v) the means by which the transfer is made, or (vi) relevant legislation, schemes, lists or other arrangements or documents, as they have effect from time to time; (d) confer a discretion on a person. (5) Regulations under this Article are subject to the negative resolution procedure. (Article 45B) (1) For the purposes of Article 45A, the data protection test is met in relation to transfers of personal data to a third country or international organisation if the standard of the protection provided for data subjects with regard to general processing of personal data in the country or by the organisation is not materially lower than the standard of the protection provided for data subjects by or under— (a) this Regulation, (b) Part 2 of the 2018 Act, and (c) Parts 5 to 7 of that Act, so far as relevant to general processing. (2) In considering whether the data protection test is met in relation to transfers of personal data to a third country or international organisation, the Secretary of State must consider, among other things— (a) respect for the rule of law and for human rights in the country or by the organisation, (b) the existence, and powers, of an authority responsible for enforcing the protection of data subjects with regard to the processing of personal data in the country or by the organisation, (c) arrangements for judicial or non-judicial redress for data subjects in connection with such processing, (d) rules about the transfer of personal data from the country or by the organisation to other countries or international organisations, (e) relevant international obligations of the country or organisation, and (f) the constitution, traditions and culture of the country or organisation. (3) In paragraphs 1 and 2— (a) the references to the protection provided for data subjects are to that protection taken as a whole, (b) the references to general processing are to processing to which this Regulation applies or equivalent types of processing in the third country or by the international organisation (as appropriate), and (c) the references to processing of personal data in the third country or by the international organisation are references only to the processing of personal data transferred to the country or organisation by means of processing to which this Regulation applies as described in Article 3. (4) When the data protection test is applied only to certain transfers to a third country or international organisation that are specified or described, or to be specified or described, in regulations (in accordance with Article 45A(4)(b))— (a) the references in paragraphs 1 to 3 to personal data are to be read as references only to personal data likely to be the subject of such transfers, and (b) the reference in paragraph 2(d) to transfer to other countries or international organisations is to be read as including transfer within the third country or international organisation.

Transfers approved by regulations: monitoring

5

After Article 45B (inserted by paragraph 4) insert—

(Article 45C) (1) The Secretary of State must, on an ongoing basis, monitor developments in third countries and international organisations that could affect decisions to make regulations under Article 45A or to amend or revoke such regulations. (2) Where the Secretary of State becomes aware that the data protection test is no longer met in relation to transfers approved, or of a description approved, in regulations under Article 45A, the Secretary of State must, to the extent necessary, amend or revoke the regulations. (3) Where regulations under Article 45A are amended or revoked in accordance with paragraph 2, the Secretary of State must enter into consultations with the third country or international organisation concerned with a view to improving the protection provided to data subjects with regard to the processing of personal data in the country or by the organisation. (4) The Secretary of State must publish— (a) a list of the third countries and international organisations, and the descriptions of such countries and organisations, which are for the time being approved by regulations under Article 45A as places or persons to which personal data may be transferred, and (b) a list of the third countries and international organisations, and the descriptions of such countries and organisations, which have been but are no longer approved by such regulations. (5) In the case of regulations under Article 45A which approve only certain transfers to a third country or international organisation specified or described in the regulations (in accordance with Article 45A(4)(b)), the lists published under paragraph 4 must specify or describe the relevant transfers.

Transfers subject to appropriate safeguards

6

• (1) Article 46 (transfers subject to appropriate safeguards) is amended as follows.

• (2) Omit paragraph 1.

• (3) After that paragraph insert—

(1A) A transfer of personal data to a third country or an international organisation by a controller or processor is made subject to appropriate safeguards only— (a) in a case in which— (i) safeguards are provided in connection with the transfer as described in paragraph 2 or 3 or regulations made under Article 47A(4), and (ii) the controller or processor, acting reasonably and proportionately, considers that the data protection test is met in relation to the transfer or that type of transfer (see paragraph 6), or (b) in a case in which— (i) safeguards are provided in accordance with paragraph 2(a) by an instrument that is intended to be relied on in connection with the transfer or that type of transfer, and (ii) each public body that is a party to the instrument, acting reasonably and proportionately, considers that the data protection test is met in relation to the transfers, or types of transfer, intended to be made in reliance on the instrument (see paragraph 6).

• (4) In paragraph 2—

• (a) in the words before point (a)—

• (i) omit “appropriate”, and

• (ii) for “paragraph 1” substitute “paragraph 1A(a)”,

• (b) in point (a), for “public authorities or bodies” substitute “a public body and another relevant person or persons”,

• (c) in point (b), after “rules” insert “approved”,

• (d) in point (c), for “section 17C of the 2018 Act” substitute “Article 47A(1)”,

• (e) in point (e), for “appropriate safeguards” substitute “safeguards provided by the code”, and

• (f) in point (f), for “appropriate safeguards” substitute “safeguards provided by the mechanism”.

• (5) In paragraph 3, in the words before point (a)—

• (a) omit “appropriate”,

• (b) for “paragraph 1” substitute “paragraph 1A(a)”,

• (c) omit “, in particular,”, and

• (d) in point (b), for “public authorities or bodies” substitute “a public body and another relevant person or persons”.

• (6) At the end insert—

(6) For the purposes of this Article, the data protection test is met in relation to a transfer, or a type of transfer, of personal data if, after the transfer, the standard of the protection provided for the data subject with regard to that personal data by the safeguards required under paragraph 1A, and (where relevant) by other means, would not be materially lower than the standard of the protection provided for the data subject with regard to the personal data by or under— (a) this Regulation, (b) Part 2 of the 2018 Act, and (c) Parts 5 to 7 of that Act, so far as relevant to processing to which this Regulation applies. (7) For the purposes of paragraph 1A(a)(ii) and (b)(ii), what is reasonable and proportionate is to be determined by reference to all the circumstances, or likely circumstances, of the transfer or type of transfer, including the nature and volume of the personal data transferred. (8) In this Article— (a) references to the protection provided for the data subject are to that protection taken as a whole; (b) “relevant person” means a public body or another person exercising functions of a public nature.

7

In the heading of Article 47 (binding corporate rules) at the beginning insert “Transfers subject to appropriate safeguards:”.

8

After Article 47 insert—

(Article 47A) (1) The Secretary of State may by regulations specify standard data protection clauses which the Secretary of State considers are capable of securing that the data protection test set out in Article 46 is met in relation to transfers of personal data generally or in relation to a type of transfer specified in the regulations. (2) The Secretary of State must keep under review the standard data protection clauses specified in regulations under paragraph 1 that are for the time being in force. (3) Regulations under paragraph 1 are subject to the negative resolution procedure. (4) The Secretary of State may by regulations make provision about further safeguards that may be relied on for the purposes of Article 46(1A)(a). (5) The Secretary of State may only make regulations under paragraph 4 if the Secretary of State considers that the further safeguards are capable of securing that the data protection test set out in Article 46 is met in relation to transfers of personal data generally or in relation to a type of transfer specified in the regulations. (6) Regulations under paragraph 4 may, among other things— (a) make provision by adopting safeguards prepared or published by another person; (b) make provision about ways of providing safeguards which require authorisation from the Commissioner. (7) Regulations under paragraph 4 which amend Article 46 may do so only in the following ways— (a) by adding ways of providing safeguards, or (b) by varying or omitting ways of providing safeguards which were added by regulations under this Article. (8) Regulations under paragraph 4 are subject to the affirmative resolution procedure.

Derogations for specific situations

9

• (1) Article 49 (derogations for specific situations) is amended as follows.

• (2) In paragraph 1, in the first subparagraph—

• (a) for “adequacy regulations under section 17A of the 2018 Act, or of appropriate safeguards pursuant to Article 46, including binding corporate rules” substitute “approval by regulations under Article 45A and of compliance with Article 46 (appropriate safeguards)”, and

• (b) in point (a), for “an adequacy decision” substitute “approval by regulations under Article 45A”.

• (3) In paragraph 1, in the second subparagraph, for “a provision in Article 45” substitute “Article 45A”.

• (4) In paragraph 4, for “section 18(1) of the 2018 Act” substitute “paragraph 4A”.

• (5) After paragraph 4 insert—

(4A) The Secretary of State may by regulations specify for the purposes of point (d) of paragraph 1— (a) circumstances in which a transfer of personal data to a third country or international organisation is to be taken to be necessary for important reasons of public interest, and (b) circumstances in which a transfer of personal data to a third country or international organisation which is not required by an enactment is not to be taken to be necessary for important reasons of public interest.

• (6) Omit paragraph 5A.

• (7) After paragraph 6 insert—