Data (Use and Access) Act 2025

(7) Regulations under this Article— (a) are subject to the made affirmative resolution procedure where the Secretary of State has made an urgency statement in respect of them; (b) otherwise, are subject to the affirmative resolution procedure. (8) For the purposes of this Article, an urgency statement is a reasoned statement that the Secretary of State considers it desirable for the regulations to come into force without delay.

Public interest restrictions

10

After Article 49 insert—

(Article 49A) (1) The Secretary of State may by regulations restrict the transfer of a category of personal data to a third country or international organisation where— (a) the transfer is not approved by regulations under Article 45A for the time being in force, and (b) the Secretary of State considers the restriction to be necessary for important reasons of public interest. (2) Regulations under this Article— (a) are subject to the made affirmative resolution procedure where the Secretary of State has made an urgency statement in respect of them; (b) otherwise, are subject to the affirmative resolution procedure. (3) For the purposes of this Article, an urgency statement is a reasoned statement that the Secretary of State considers it desirable for the regulations to come into force without delay.

Schedule 8

Introduction

1

Chapter 5 of Part 3 of the 2018 Act (transfers of personal data to third countries etc) is amended as follows.

Overview and interpretation

2

In section 72 (overview and interpretation), in subsection (1)(b)—

• (a) for “the special conditions that apply” substitute “additional conditions that apply in certain cases”, and

• (b) after “organisation” insert “(see section 73(4)(b))”.

General principles for transfer

3

• (1) Section 73 (general principles for transfers) is amended as follows.

• (2) Before subsection (1) insert—

(A1) This section applies in relation to a transfer of personal data to a third country or international organisation for a law enforcement purpose.

• (3) In subsection (1)—

• (a) for the words before paragraph (a) substitute “The controller in relation to the transfer must secure that the transfer takes place only if—”,

• (b) omit the “and” at the end of paragraph (a), and

• (c) after paragraph (b) insert

, and— (c) the transfer is carried out in accordance with the other provisions of this Part.

• (4) For subsection (3) substitute—

(3) Condition 2 is that the transfer— (a) is approved by regulations under section 74AA that are in force at the time of the transfer, (b) is made subject to appropriate safeguards (see section 75), or (c) is based on special circumstances (see section 76).

• (5) In subsection (4)—

• (a) after paragraph (a) (but before the “or” at the end of that paragraph) insert—

(aa) the intended recipient is a person in a third country who— (i) is not a person described in paragraph (a), but (ii) is a processor whose processing, on behalf of the controller, of the personal data transferred is governed by, or authorised in accordance with, a contract with the controller that complies with section 59,

, and

• (b) in paragraph (b)(i), for “other than a relevant authority” substitute “who is not a person described in paragraph (a) or (aa)”.

• (6) In subsection (5)(a), for the words from “either” to “State” substitute “to the public security, national security or essential interests of a third country or the United Kingdom”.

Transfers approved by regulations

4

• (1) Omit section 74A (transfers based on adequacy regulations).

• (2) After that section insert—

(74AA) (1) For the purposes of section 73, the Secretary of State may by regulations approve transfers of personal data to— (a) a third country, or (b) an international organisation. (2) The Secretary of State may only make regulations under this section approving transfers to a third country or international organisation if the Secretary of State considers that the data protection test is met in relation to the transfers (see section 74AB). (3) In making regulations under this section, the Secretary of State may have regard to any matter which the Secretary of State considers relevant, including the desirability of facilitating transfers of personal data to and from the United Kingdom. (4) Regulations under this section may, among other things— (a) make provision by reference to a third country or international organisation specified in the regulations or a description of country or organisation; (b) approve all transfers of personal data to a third country or international organisation or only transfers specified or described in the regulations; (c) identify a transfer of personal data by any means, including by reference to— (i) a sector or geographic area within a third country, (ii) the controller or processor, (iii) the recipient of the personal data, (iv) the personal data transferred, (v) the means by which the transfer is made, or (vi) relevant legislation, schemes, lists or other arrangements or documents, as they have effect from time to time; (d) confer a discretion on a person. (5) Regulations under this section are subject to the negative resolution procedure. (74AB) (1) For the purposes of section 74AA, the data protection test is met in relation to transfers to a third country or international organisation if the standard of the protection provided for data subjects with regard to law enforcement processing of personal data in the country or by the organisation is not materially lower than the standard of the protection provided for data subjects by or under— (a) this Part, and (b) Parts 5 to 7, so far as relevant to law enforcement processing. (2) In considering whether the data protection test is met in relation to transfers of personal data to a third country or international organisation, the Secretary of State must consider, among other things— (a) respect for the rule of law and for human rights in the country or by the organisation, (b) the existence, and powers, of an authority responsible for enforcing the protection of data subjects with regard to the processing of personal data in the country or by the organisation, (c) arrangements for judicial or non-judicial redress for data subjects in connection with such processing, (d) rules about the transfer of personal data from the country or by the organisation to other countries or international organisations, (e) relevant international obligations of the country or organisation, and (f) the constitution, traditions and culture of the country or organisation. (3) In subsections (1) and (2)— (a) the references to the protection provided for data subjects are to that protection taken as a whole, (b) the references to law enforcement processing are to processing by a competent authority for any of the law enforcement purposes or equivalent types of processing in the third country or by the international organisation (as appropriate), and (c) the references to processing of personal data in the third country or by the international organisation are references only to the processing of personal data transferred to the country or organisation by means of processing to which this Act applies as described in section 207(2). (4) When the data protection test is applied only to certain transfers to a third country or international organisation that are specified or described, or to be specified or described, in regulations (in accordance with section 74AA(4)(b))— (a) the references in subsections (1) to (3) to personal data are to be read as references only to personal data likely to be the subject of such transfers, and (b) the reference in subsection (2)(d) to transfer to other countries or international organisations is to be read as including transfer within the third country or international organisation.

Transfers approved by regulations: monitoring

5

• (1) Section 74B (transfers based on adequacy regulations: review etc) is amended as follows.

• (2) For the heading substitute “Transfers approved by regulations: monitoring”.

• (3) Omit subsections (1) and (2).

• (4) In subsection (3), for “under section 74A” substitute “giving approval under section 74AA”.

• (5) In subsection (4), for the words from the beginning to “otherwise,” substitute “Where the Secretary of State becomes aware that the data protection test is no longer met in relation to transfers approved, or of a description approved, in regulations under section 74AA,”.

• (6) In subsection (5)—

• (a) for “section 74A” substitute “section 74AA”, and

• (b) for “remedying the lack of an adequate level of protection” substitute “improving the protection provided to data subjects with regard to the processing of personal data in the country or by the organisation”.

• (7) In subsection (6)(a)—

• (a) omit “, territories and specified sectors within a third country”,

• (b) omit “, territories, sectors”, and

• (c) for “specified in regulations under section 74A” substitute “approved by regulations under section 74AA as places or persons to which personal data may be transferred”.

• (8) In subsection (6)(b)—

• (a) omit “, territories and specified sectors within a third country”,

• (b) omit “, territories, sectors”, and

• (c) for “specified in” substitute “approved by”.

• (9) In subsection (7)—

• (a) for “regulations under section 74A which specify that an adequate level of protection of personal data is ensured only for a transfer” substitute “regulations under section 74AA which approve only certain transfers to a third country or international organisation that are”,

• (b) after “the regulations” insert “(in accordance with section 74AA(4)(b))”, and

• (c) omit paragraph (a) (together with the final “and”).

Transfers subject to appropriate safeguards

6

• (1) Section 75 (transfers on the basis of appropriate safeguards) is amended as follows.

• (2) In the heading, for “on the basis of” substitute “subject to”.

• (3) Omit subsection (1).

• (4) After that subsection insert—

(1A) A transfer of personal data to a third country or an international organisation is made subject to appropriate safeguards only if— (a) an appropriate legal instrument binds the intended recipient of the data (see subsection (4)), or (b) the controller, acting reasonably and proportionately, considers that the data protection test is met in relation to the transfer or that type of transfer (see subsection (5)).

• (5) In subsection (2), for “subsection (1)(b)” substitute “subsection (1A)(b) but not in reliance on section 73(4)(aa) (transfer to processor)”.

• (6) In subsection (3), for “subsection (1)” substitute “this section but not in reliance on section 73(4)(aa) (transfer to processor)”.

• (7) At the end insert—

(4) For the purposes of this section, a legal instrument is “appropriate”, in relation to a transfer of personal data, if— (a) the instrument is intended to be relied on in connection with the transfer or that type of transfer, (b) at least one competent authority is a party to the instrument, and (c) each competent authority that is a party to the instrument, acting reasonably and proportionately, considers that the data protection test is met in relation to the transfers, or types of transfer, intended to be made in reliance on the instrument (see subsection (5)). (5) For the purposes of this section, the data protection test is met in relation to a transfer, or a type of transfer, of personal data if, after the transfer, the standard of the protection provided for the data subject with regard to that personal data, whether by a binding legal instrument or by other means, would not be materially lower than the standard of the protection provided for the data subject with regard to the personal data by or under— (a) this Part, and (b) Parts 5 to 7, so far as they relate to processing by a competent authority for any of the law enforcement purposes. (6) For the purposes of subsections (1A)(b) and (4)(c), what is reasonable and proportionate is to be determined by reference to all the circumstances, or likely circumstances, of the transfer or type of transfer, including the nature and volume of the personal data transferred. (7) In this section, references to the protection provided for the data subject are to that protection taken as a whole.

Transfers based on special circumstances

7

• (1) Section 76 (transfers on the basis of special circumstances) is amended as follows.

• (2) In the heading, for “on the basis of” substitute “based on”.

• (3) Before subsection (1) insert—

(A1) A transfer of personal data to a third country or international organisation is based on special circumstances where— (a) it is made in the absence of approval by regulations under section 74AA and of compliance with section 75 (appropriate safeguards), and (b) it is necessary for a special purpose.

• (4) In subsection (1)—

• (a) for the words before paragraph (a) substitute “A transfer of personal data is necessary for a special purpose if it is necessary—”,

• (b) in paragraph (c)—

• (i) after “public security” insert “or national security”, and

• (ii) at the end insert “or the United Kingdom”,

• (c) in paragraph (d), for “in individual cases” substitute “in particular circumstances,”, and

• (d) in paragraph (e), for “in individual cases” substitute “in particular circumstances,”.

• (5) In subsection (2), for “But subsection (1)(d) and (e) do not apply” substitute “But a transfer of personal data is not necessary for a special purpose by virtue of subsection (1)(d) or (e)”.

• (6) After subsection (2) insert—

(2A) In accordance with the third data protection principle, the amount of personal data transferred in reliance on this section must not be excessive in relation to the special purpose relied on.

• (7) In subsection (3), for “subsection (1)” substitute “this section”.

Transfers to particular recipients

8

For the italic heading before section 77 substitute “Additional conditions”.

9

• (1) Section 77 (conditions for transfers of personal data to persons other than relevant authorities) is amended as follows.

• (2) For the heading substitute “Additional conditions for transfers in reliance on section 73(4)(b)”.

• (3) In subsection (6), for “other than a relevant authority” substitute “in reliance on section 73(4)(b)”.

• (4) In subsection (7)(a), for “other than a relevant authority” substitute “that takes place in reliance on section 73(4)(b)”.

Subsequent transfers

10

• (1) Section 78 (subsequent transfers) is amended as follows.

• (2) Before subsection (1) insert—

(A1) Subsections (1) to (6) apply where a transfer to which section 73 applies takes place otherwise than in reliance on section 73(4)(aa) (transfer to processor).

• (3) In subsection (1)—

• (a) omit “Where personal data is transferred in accordance with section 73,”,

• (b) after “transfer” insert

— (a)

,

• (c) for “the data” substitute “the personal data”, and

• (d) at the end insert “(the

“UK authoriser”), or (b) that— (i) the personal data is not to be so transferred without such authorisation except where subsection (1A) applies, and (ii) where a transfer is made without such authorisation, the UK authoriser must be informed without delay.

• (4) After subsection (1) insert—

(1A) This subsection applies if— (a) the transfer is necessary for the prevention of an immediate and serious threat to the public security or national security of a third country or the United Kingdom, and (b) authorisation from the UK authoriser cannot be obtained in good time.

• (5) In subsection (2)—

• (a) for “A competent authority” substitute “The UK authoriser”, and

• (b) for “under subsection (1)” substitute “for the purposes of a condition described in subsection (1)”.

• (6) In subsection (3), for “competent authority” substitute “UK authoriser”.

• (7) In subsection (4), for “an authorisation may not be given under subsection (1)” substitute “the UK authoriser may not give an authorisation for the purposes of a condition described in subsection (1)”.

• (8) In subsection (5)(a), for the words from “either” to “State” substitute “to the public security, national security or essential interests of a third country or the United Kingdom”.

• (9) In subsection (6)—

• (a) after “made” insert “in a case described in subsection (4)”,

• (b) for “subsection (4)” substitute “that subsection (whether made with or without authorisation from the UK authoriser), the UK authoriser must, without delay, inform”, and

• (c) omit “must be informed without delay”.

• (10) At the end insert—

(7) Where a transfer takes place in reliance on section 73(4)(aa) (transfer to processor), the transferring controller must make it a condition of the transfer that the data is only to be further transferred to a third country or international organisation where— (a) the terms of any relevant contract entered into, or authorisation given, by the transferring controller in accordance with section 59 are complied with, and (b) the further transfer satisfies the requirements in section 73(1).

Schedule 9

Part 1 — Minor and consequential amendments

The UK GDPR

1

The UK GDPR is amended as follows.

2

In Article 13(1)(f) (information to be provided where personal data is collected from the data subject)—

• (a) for “adequacy regulations under section 17A of the 2018 Act” substitute “regulations under Article 45A”, and

• (b) for “reference to the appropriate or suitable safeguards” substitute “the safeguards relied on”.

3

In Article 14(1)(f) (information to be provided where personal data is not obtained from the data subject)—

• (a) for “adequacy regulations under section 17A of the 2018 Act” substitute “regulations under Article 45A”, and

• (b) for “reference to the appropriate or suitable safeguards” substitute “the safeguards relied on”.

4

In Article 15(2) (right of access by the data subject)—

• (a) after “organisation” insert “in reliance on Article 46”, and

• (b) for “appropriate safeguards pursuant to Article 46 relating to” substitute “safeguards provided in accordance with Article 46(1A)(a)(i) or (b)(i) for the purposes of”.

5

• (1) Article 40 (codes of conduct) is amended as follows.

• (2) In paragraph 3 omit “appropriate” in both places.

• (3) In paragraph 5, for “provides sufficient appropriate safeguards” substitute “is capable of providing safeguards for the purposes of Article 46”.

6

In Article 42(2) (certification) omit “appropriate” in both places.

7

In Article 46(2)(d) (transfers subject to appropriate safeguards: standard data protection clauses), after “Commissioner” insert “for the purposes of this Article”.

8

In Article 57(1) (Commissioner’s tasks)—

• (a) in point (m) omit “which provide sufficient safeguards,”, and

• (b) after point (s) insert—

(sa) provide authorisation required under regulations made under Article 47A;

.

9

In Article 58(3) (authorisation and advisory powers of the Commissioner), after point (j) insert—

(k) to provide authorisation required under regulations made under Article 47A

.

10

In Article 83(5)(c) (general conditions for imposing administrative fines), for “44” substitute “44A”.

The 2018 Act

11

The 2018 Act is amended as follows.

12

Omit section 17A (transfers based on adequacy regulations) and the italic heading before it.

13

Omit section 17B (transfers based on adequacy regulations: review etc).

14

Omit section 17C (standard data protection clauses).

15

Omit section 18 (transfers of personal data to third countries etc: public interest).

16

In section 24(2) (manual unstructured data held by FOI public authorities)—

• (a) in paragraph (c), for “44 to 49” substitute “44A to 49A”, and

• (b) omit paragraph (ca).

17

In section 26(2) (national security and defence exemption), omit paragraph (fa).

18

In section 75 (transfers on the basis of appropriate safeguards), after subsection (7) (inserted by Schedule 8 to this Act) insert—

(8) For provision about standard data protection clauses which the Commissioner considers are capable of securing that the data protection test in this section is met, see section 119A.

19

In section 78A (law enforcement processing: national security exemption) (inserted by section 88 of this Act), in subsection (2)(e), after sub-paragraph (i) insert—

(ia) section 119A (standard clauses for transfers to third countries);

.

20

• (1) Section 119A (power of Commissioner to specify standard clauses for transfers to third countries etc providing appropriate safeguards) is amended as follows.

• (2) In subsection (1), for the words from “provide” to the end substitute “are capable of securing that the data protection test set out in Article 46 of the UK GDPR or section 75 of this Act (or both) is met in relation to transfers of personal data”.

• (3) In subsection (3), after paragraph (a) insert—

(aa) may make provision generally or in relation to types of transfer described in the document,

.

21

In section 149(2)(e) (enforcement notices), for “44 to 49” substitute “44A to 49A”.

22

• (1) Section 182 (regulations and consultation) is amended as follows.

• (2) Omit subsection (4).

• (3) In subsection (6), for “Where regulations under this Act” substitute “For the purposes of this Act, where regulations”.

• (4) In subsection (7), for “Where regulations under this Act” substitute “For the purposes of this Act, where regulations”.

• (5) In subsection (8)—

• (a) for “Where regulations under this Act” substitute “For the purposes of this Act, regulations”,

• (b) after “procedure”” insert “if”,

• (c) in paragraph (a), for “the urgency” substitute “an urgency”, and

• (d) in paragraph (b), for “the period of 120 days” substitute “a period”.

• (6) Omit subsections (9) and (10).

• (7) In subsection (11), after “by regulations” insert “made under this Act or another enactment that are”.

• (8) For subsection (14) substitute—

(14) For the purposes of this section, an urgency statement is a reasoned statement that the Secretary of State considers it desirable for regulations to come into force without delay.

23

In section 205(2)(e) (references to periods of time) omit “and (9)”.

24

In paragraph 26(9)(d) of Schedule 2 (exemptions etc for journalistic, academic, artistic and literary purposes), for “44” substitute “44A”.

25

• (1) Part 3 of Schedule 21 (further transitional provision etc: transfers to third countries and international organisations) is amended as follows.

• (2) In the heading before paragraph 4, for “adequacy decisions and adequacy regulations” substitute “transfers approved by regulations”.

• (3) In paragraph 4 (UK GDPR: adequacy decisions and adequacy regulations)—

• (a) in sub-paragraph (1), for “based on adequacy regulations” substitute “to be treated as approved by regulations made under Article 45A of the UK GDPR”,

• (b) in sub-paragraph (4)(a), for “lists or other” substitute “schemes, lists or other arrangements or”, and

• (c) omit sub-paragraph (6).

• (4) In paragraph 6 (UK GDPR: application of certain provisions referring to regulations made under section 17A of the 2018 Act)—

• (a) in sub-paragraph (1)(a), for “section 17A” substitute “Article 45A of the UK GDPR”,

• (b) for sub-paragraph (2) substitute—

(2) Those provisions are Articles 13(1)(f), 14(1)(f), 45C, 49(1) and 49A(1) of the UK GDPR.

, and

• (c) after that sub-paragraph insert—

(3) In its application to transfers treated as approved by virtue of paragraph 1, Article 45C(5) of the UK GDPR (transfers approved by regulations: monitoring) has effect as if the reference to Article 45A(4)(b) were omitted.

• (5) Omit paragraphs 7 and 8 (UK GDPR: transfers subject to appropriate safeguards provided by standard data protection clauses).

• (6) In paragraph 9 (UK GDPR: transfers subject to appropriate safeguards provided by binding corporate rules)—

• (a) in sub-paragraph (1)—

• (i) for “The appropriate safeguards referred to in Article 46(1) of the UK GDPR may be provided for” substitute “The requirement for safeguards to be provided under Article 46(1A)(a)(i) of the UK GDPR may be satisfied”, and

• (ii) after “described” insert “in”,

• (b) in sub-paragraph (3)(a)—

• (i) for “or provision” substitute “, of provision”, and

• (ii) for “(or both)” substitute “or of the amendment of Chapter 5 of the UK GDPR by the Data (Use and Access) Act 2025”, and

• (c) in sub-paragraph (4), after paragraph (a) insert—

(aa) changing references to provision made by regulations under section 17A into references to provision made by regulations made under Article 45A of the UK GDPR;

.

• (7) In the heading before paragraph 10, for “adequacy decisions and adequacy regulations” substitute “transfers approved by regulations”.

• (8) In paragraph 10 (law enforcement processing: adequacy decisions and adequacy regulations)—

• (a) in sub-paragraph (1), for “based on adequacy regulations” substitute “to be treated as approved by regulations made under section 74AA”,

• (b) in sub-paragraph (4)(a), for “lists or other” substitute “schemes, lists or other arrangements or”, and

• (c) omit sub-paragraph (6).

• (9) In paragraph 12 (Part 3 (law enforcement processing): application of certain provisions referring to regulations made under section 74A)—

• (a) the existing text becomes sub-paragraph (1),

• (b) in that sub-paragraph—

• (i) for the words before paragraph (a) substitute “In sections 74B and 76(A1)—”, and

• (ii) in paragraph (a), for “74A” substitute “74AA”, and

• (c) after that sub-paragraph insert—

(2) In its application to transfers treated as approved by virtue of paragraph 10, section 74B(7) (transfers approved by regulations: monitoring) has effect as if the reference to section 74AA(4)(b) were omitted.

Part 2 — Transitional provision

The UK GDPR: transfers approved by regulations

26

• (1) Regulations made under section 17A of the 2018 Act (transfers based on adequacy regulations) and in force immediately before the relevant day are to be treated, on and after that day, as if made under Article 45A of the UK GDPR (inserted by Schedule 7 to this Act).

• (2) In this paragraph, “the relevant day” means the day on which paragraph 4 of Schedule 7 to this Act comes into force.

The UK GDPR: transfers subject to appropriate safeguards

27

• (1) For the purposes of Article 44A(1)(a) and (2)(b) of the UK GDPR (general principles for transfers of personal data), a transfer of personal data to a third country or an international organisation made on or after the relevant day is made subject to appropriate safeguards where—

• (a) the transfer is made under arrangements entered into before the relevant day,

• (b) safeguards are provided in accordance with paragraph 2 or 3 of Article 46 of the UK GDPR or paragraph 9 of Schedule 21 to the 2018 Act, and

• (c) if the transfer had been made immediately before the relevant day, it would have satisfied—

• (i) the condition in Article 46(1) of the UK GDPR relating to data subjects’ rights and legal remedies, and

• (ii) the requirements of the last sentence of Article 44 of the UK GDPR (level of protection must not be undermined).

• (2) Sub-paragraph (1) has effect in addition to Article 46(1A) of the UK GDPR.

• (3) In this paragraph—

• “international organisation” has the same meaning as in the 2018 Act (see section 205 of that Act);

• “personal data” has the same meaning as in the 2018 Act (see section 3 of that Act);

• “the relevant day” means the day on which paragraph 6 of Schedule 7 to this Act comes into force;

• “third country” has the same meaning as in Part 3 of the 2018 Act (see section 33 of that Act).

The UK GDPR: transfers subject to appropriate safeguards provided by standard data protection clauses

28

• (1) Regulations made under section 17C of the 2018 Act (standard data protection clauses) and in force immediately before the relevant day are to be treated, on and after that day, as if made under Article 47A(1) of the UK GDPR (inserted by Schedule 7 to this Act).

• (2) In this paragraph, “the relevant day” means the day on which paragraph 8 of Schedule 7 to this Act comes into force.

29

• (1) This paragraph applies to a requirement for safeguards to be provided under—

• (a) Article 46(1A)(a)(i) of the UK GDPR, or

• (b) paragraph 27(1)(b) of this Schedule.

• (2) The requirement may be satisfied on and after the relevant day by a version of pre-commencement standard clauses incorporating changes where—

• (a) all of the changes are made in consequence of the amendment of Chapter 5 of the UK GDPR by this Act, and

• (b) none of the changes alters the effect of the clauses.

• (3) Changing a reference to regulations under section 17A of the 2018 Act into a reference to regulations made under Article 45A of the UK GDPR is to be treated as a change falling within sub-paragraph (2).

• (4) Sub-paragraphs (2) and (3) cease to apply in relation to pre-commencement standard clauses if—

• (a) the clauses are specified in regulations and a provision of the regulations relating to the clauses is amended or revoked on or after the relevant day, or

• (b) the clauses are specified in another document and a provision of the document relating to the clauses is amended or withdrawn by the Information Commissioner on or after the relevant day.

• (5) Sub-paragraph (2) has effect in addition to Article 46(2) and (3) of the UK GDPR.

• (6) In this paragraph—

• “pre-commencement standard clauses” means standard data protection clauses specified in—regulations made under section 17C of the 2018 Act and in force immediately before the relevant day, ora document issued by the Information Commissioner under section 119A of the 2018 Act before the relevant day and not withdrawn before that day;

• “the relevant day” means the day on which paragraph 6 of Schedule 7 to this Act comes into force.

The UK GDPR: transfers necessary for important reasons of public interest

30

• (1) Regulations made under section 18(1) of the 2018 Act (transfers necessary for important reasons of public interest) and in force immediately before the relevant day are to be treated, on and after that day, as if made under Article 49(4A) of the UK GDPR (inserted by Schedule 7 to this Act).

• (2) In this paragraph, “the relevant day” means the day on which paragraph 9(5) of Schedule 7 to this Act comes into force.

The UK GDPR: restrictions on transfers of personal data to third countries and international organisations

31

• (1) Regulations made under section 18(2) of the 2018 Act (restrictions on transfers of personal data to third countries and international organisations) and in force immediately before the relevant day are to be treated, on and after that day, as if made under Article 49A of the UK GDPR (inserted by Schedule 7 to this Act).

• (2) In this paragraph, “the relevant day” means the day on which paragraph 10 of Schedule 7 to this Act comes into force.

Part 3 of the 2018 Act (law enforcement processing): transfers approved by regulations

32

• (1) Regulations made under section 74A of the 2018 Act (transfers based on adequacy regulations) and in force immediately before the relevant day are to be treated, on and after that day, as if made under section 74AA of that Act (inserted by Schedule 8 to this Act).

• (2) In this paragraph, “the relevant day” means the day on which paragraph 4 of Schedule 8 to this Act comes into force.

Part 3 of the 2018 Act (law enforcement processing): transfers subject to appropriate safeguards

33

• (1) For the purposes of section 73(3) of the 2018 Act (general principles for transfers of personal data), a transfer of personal data to a third country or an international organisation made on or after the relevant day is a transfer made subject to appropriate safeguards where—

• (a) an appropriate pre-commencement legal instrument binds the intended recipient of the data, and

• (b) if the transfer had been made immediately before the relevant day, the requirement in section 75(1)(a) of the 2018 Act (binding legal instrument containing appropriate safeguards) would have been satisfied by virtue of that instrument.

• (2) Sub-paragraph (1) has effect in addition to section 75(1A) of the 2018 Act.

• (3) For the purposes of sub-paragraph (1), a legal instrument is an “appropriate pre-commencement legal instrument”, in relation to a transfer of personal data, if—

• (a) it was entered into before the relevant day,

• (b) it is intended to be relied on in connection with the transfer or that type of transfer, and

• (c) at least one competent authority is a party to the instrument.

• (4) In this paragraph—

• “competent authority” has the same meaning as in Part 3 of the 2018 Act (see section 30 of that Act);

• “international organisation” has the same meaning as in the 2018 Act (see section 205 of that Act);

• “personal data” has the same meaning as in the 2018 Act (see section 3 of that Act);

• “the relevant day” means the day on which paragraph 6 of Schedule 8 to this Act comes into force;

• “third country” has the same meaning as in Part 3 of the 2018 Act (see section 33 of that Act).

Schedule 10

The UK GDPR

1

The UK GDPR is amended as follows.

2

In Article 12(4) (transparent information, communication and modalities for the exercise of the rights of the data subject), for “lodging a complaint with the Commissioner” substitute “making a complaint to the controller under section 164A of the 2018 Act, making a complaint to the Commissioner under section 165 of that Act”.

3

• (1) Article 13(2) (information to be provided where personal data is collected from the data subject) is amended as follows.

• (2) After point (c) insert—

(ca) the right to make a complaint to the controller under section 164A of the 2018 Act;

.

• (3) In point (d), for “lodge a complaint with the Commissioner” substitute “make a complaint to the Commissioner under section 165 of the 2018 Act”.

4

• (1) Article 14(2) (information to be provided where personal data is not obtained from the data subject) is amended as follows.

• (2) After point (d) insert—

(da) the right to make a complaint to the controller (see section 164A of the 2018 Act);

.

• (3) In point (e), for “lodge a complaint with the Commissioner” substitute “make a complaint to the Commissioner under section 165 of the 2018 Act”.

5

• (1) Article 15(1) (right of access by the data subject) is amended as follows.

• (2) After point (e) insert—

(ea) the right to make a complaint to the controller under section 164A of the 2018 Act;

.

• (3) In point (f), for “lodge a complaint with the Commissioner” substitute “make a complaint to the Commissioner under section 165 of the 2018 Act”.

6

In Article 47 (binding corporate rules), in paragraph 2(e), for “lodge a complaint with the Commissioner and” substitute “make a complaint to the controller under section 164A of the 2018 Act, the right to make a complaint to the Commissioner under section 165 of the 2018 Act, the right to lodge a complaint”.

7

• (1) Article 80 (representation of data subjects) is amended as follows.

• (2) In paragraph 1—

• (a) for “lodge the complaint” substitute “make a complaint under section 164A or 165 of the 2018 Act”, and

• (b) omit “77,”.

• (3) In paragraph 2, for “lodge a complaint with the Commissioner” substitute “make a complaint under section 164A or 165 of the 2018 Act”.

The 2018 Act

8

The 2018 Act is amended as follows.

9

In section 26(2)(f) (national security and defence exemption), omit sub-paragraph (ai) (inserted by section 88 of this Act).

10

• (1) Section 44 (information: controller’s general duties) is amended as follows.

• (2) In subsection (1)—

• (a) after paragraph (d) insert—

(da) the existence of the right to make a complaint to the controller (see section 164A);

, and

• (b) in paragraph (e), after “Commissioner”, in the first place it occurs, insert “(see section 165)”.

• (3) In subsection (5)—

• (a) after paragraph (c) insert—

(ca) of the data subject’s right to make a complaint to the controller under section 164A,

, and

• (b) in paragraph (d), after “Commissioner” insert “under section 165”.

11

• (1) Section 45 (right of access by the data subject) is amended as follows.

• (2) In subsection (2)—

• (a) after paragraph (e) insert—

(ea) the existence of the data subject’s right to make a complaint to the controller (see section 164A);

, and

• (b) in paragraph (f), after “the Commissioner”, in the first place it occurs, insert “(see section 165)”.

• (3) In subsection (5)—

• (a) after paragraph (c) insert—

(ca) of the data subject’s right to make a complaint to the controller under section 164A,

, and

• (b) in paragraph (d), at the end insert “under section 165”.

12

In section 45A (exemption from sections 44 and 45: legal professional privilege) (inserted by section 79 of this Act), in subsection (2), after paragraph (c) insert—

(ca) the data subject’s right to make a complaint to the controller under section 164A,

.

13

• (1) Section 48 (rights to rectification, to erasure or to restriction of processing: supplementary) is amended as follows.

• (2) In subsection (1)(b)—

• (a) after sub-paragraph (ii) insert—

(iia) of the data subject’s right to make a complaint to the controller under section 164A,

, and

• (b) in sub-paragraph (iii), after “Commissioner” insert “under section 165”.

• (3) In subsection (4)—

• (a) after paragraph (b) insert—

(ba) of the data subject’s right to make a complaint to the controller under section 164A,

, and

• (b) in paragraph (c), after “Commissioner” insert “under section 165”.

14

In section 93(1)(e) (right to information), after “Commissioner”, in the first place it occurs, insert “under section 165”.

15

In section 94(2)(f) (right of access), after “Commissioner”, in the first place it occurs, insert “under section 165”.

16

• (1) Section 149 (enforcement notices) is amended as follows.

• (2) In subsection (1), for “or (5)” substitute “, (5) or (5A)”.

• (3) After subsection (5) insert—

(5A) The fifth type of failure is where a controller has failed, or is failing, to comply with section 164A or with regulations under section 164B.

• (4) In subsection (6), for “or (5)” substitute “, (5) or (5A)”.

17

In section 155 (penalty notices), in subsection (1)(a), for “or (5)” substitute “, (5) or (5A)”.

18

In section 157 (maximum amount of penalty), after subsection (4) insert—

(4A) In relation to an infringement of section 164A or of regulations under section 164B, the maximum amount of the penalty that may be imposed by a penalty notice is the standard maximum amount.

19

In section 165 (complaints by data subjects), in the heading, at the end insert “to the Commissioner”.

20

• (1) Section 166 (orders to progress complaints) is amended as follows.

• (2) In the heading, at the end insert “to the Commissioner”.

• (3) In subsection (1), omit “or Article 77 of the UK GDPR”.

21

• (1) Section 187 (representation of data subjects with their authority) is amended as follows.

• (2) In subsection (1)(a)—

• (a) for “Articles 77,” substitute “sections 164A and 165 (complaints) and Articles”, and

• (b) omit “to lodge complaints and”.

• (3) In subsection (2)—

• (a) before paragraph (a) insert—

(za) the right under section 164A (complaints to the controller);

, and

• (b) in paragraph (a), for “165(2) and (4)(d)” substitute “165”.

Schedule 11

The UK GDPR

1

The UK GDPR is amended as follows.

2

• (1) Article 4(1) (interpretation) is amended as follows.

• (2) After point (15) insert—

(15A) - “direct marketing” means the communication (by whatever means) of advertising or marketing material which is directed to particular individuals;

.

• (3) After point (28) insert—

(29) - “enactment” has the same meaning as in the 2018 Act (see section 205 of that Act); (30) - “tribunal” means any tribunal in which legal proceedings may be brought.

3

After Article 4 insert—

(Article 4A) (1) References in this Regulation to a period expressed in hours, days, weeks, months or years are to be interpreted in accordance with Article 3 of the Periods of Time Regulation, except in Article 91A(8) and (9). (2) In this Article, “the Periods of Time Regulation” means Regulation (EEC, Euratom) No. 1182/71 of the Council of 3 June 1971 determining the rules applicable to periods, dates and time limits.

4

In Article 9 (processing of special categories of personal data)—

• (a) in paragraph 2, after “apply if” insert “the processing is based on Article 6(1) and”,

• (b) in paragraph 2(f), after “courts” insert “or tribunals”, and

• (c) in paragraph 3, for the words from the beginning to “data are” substitute “Paragraph 1 is only disapplied by point (h) of paragraph 2 if the personal data is”.

5

In Article 12(5) (information etc to be provided free of charge), at the beginning insert “Subject to Article 15(3),”.

6

In Article 23(1)(h) (restrictions), for “(a)” substitute “(c)”.

7

In Article 24(3) (responsibility of the controller), for “an element by which to demonstrate” substitute “a means of demonstrating”.

8

In Article 25(3) (data protection by design and by default), for “an element to demonstrate” substitute “a means of demonstrating”.

9

In Article 28(5) (processors), for “an element by which to demonstrate” substitute “a means of demonstrating”.

10

In Article 32(3) (security of processing), for “an element by which to demonstrate” substitute “a means of demonstrating”.

11

In Article 37(1)(a), after “courts” insert “and tribunals”.

12

Omit Article 59 (activity reports).

The 2018 Act

13

The 2018 Act is amended as follows.

14

In section 3(9) (definition of “the data protection legislation”)—

• (a) insert “and” at the end of paragraph (c), and

• (b) omit paragraph (e) (regulations under section 2(2) of the European Communities Act 1972 which relate to the EU GDPR or the Law Enforcement Directive) and the “and” before it.

15

Omit section 20 (meaning of “court” in Part 2).

16

In section 94 (data subject’s right of access under Part 4), in subsection (10), for “subsection (6)” substitute “subsections (3), (5) and (6)”.

17

In section 119A(11) (standard clauses for transfers to third countries etc), after “any” insert “whole days that fall within a”.

18

In section 124(5) (data protection and journalism code), in the definition of “good practice in the processing of personal data for the purposes of journalism”—

• (a) in paragraph (a), omit “, including compliance with the requirements of the data protection legislation”, and

• (b) after paragraph (b) insert—

and includes compliance with the requirements of the data protection legislation;

.

19

• (1) Section 125 (approval of codes of practice prepared by the Commissioner) is amended as follows.

• (2) Omit subsection (2).

• (3) In subsection (8), after “any” insert “whole days that fall within a”.

• (4) In subsection (9), for “subsections (2) and (5)” substitute “subsection (5)”.

20

In section 139 (reporting to Parliament), omit subsection (2).

21

In section 161(6) (approval of first guidance about regulatory action), after “any” insert “whole days that fall within a”.

22

In section 170(2)(a) (unlawful obtaining etc of personal data), after “preventing” insert “, investigating”.

23

• (1) Section 171 (re-identification of de-identified personal data) is amended as follows.

• (2) In subsection (3)(a), after “preventing” insert “, investigating”.

• (3) In subsection (6)(a), after “preventing” insert “, investigating”.

24

In section 181 (interpretation of Part 6) omit the definition of “representative”.

25

In section 184(4) (prohibition of requirement to produce relevant records), after “prevention” insert “, investigation”.

26

In section 192(6) (approval of the Framework), after “any” insert “whole days that fall within a”.

27

In section 206 (index of defined expressions), in the Table, omit the entry for “representative (in Part 6)”.

28

• (1) Schedule 1 (special categories of personal data and criminal convictions etc data) is amended as follows.

• (2) In the heading before paragraph 10, for “or detecting” substitute “etc”.

• (3) In paragraph 10(1)(a) (preventing etc unlawful acts), after “prevention” insert “, investigation”.

• (4) In paragraph 13(1)(a) (journalism etc in connection with unlawful acts and dishonesty etc), after “consists of” insert “, or is carried out in preparation for,”.

• (5) In paragraph 14(1)(b) (preventing fraud), after sub-paragraph (ii) (but before the “or” at the end of that sub-paragraph) insert—

(iia) the processing of personal data carried out in preparation for disclosure described in sub-paragraph (i) or (ii),

.

• (6) In paragraph 24(1)(a) (disclosure to elected representatives), after “consists of” insert “, or is carried out in preparation for,”.

29

• (1) Schedule 2 (exemptions etc from the UK GDPR) is amended as follows.

• (2) In paragraph 2(1)(a) (crime), after “prevention” insert “, investigation”.

• (3) In paragraph 3(2)(b)(ii) (crime: risk assessment systems), after “prevention” insert “, investigation”.

30

In paragraph 8(1)(b) of Schedule 8 (conditions for sensitive processing under Part 3: preventing fraud), after sub-paragraph (ii) (but before the “or” at the end of that sub-paragraph) insert—

(iia) the processing of personal data carried out in preparation for disclosure described in sub-paragraph (i) or (ii),

.

31

In paragraph 2(a) of Schedule 11 (other exemptions under Part 4: crime), after “prevention” insert “, investigation”.

Victims and Prisoners Act 2024

32

The following provisions (inserted by section 31 of the Victims and Prisoners Act 2024) extend to Scotland and Northern Ireland (as well as to England and Wales)—

• (a) Article 17(1)(g), (4) and (5) of the UK GDPR (right to erasure), and

• (b) section 13A of the 2018 Act (meaning of “relevant offence” for purpose of right to erasure).

Schedule 12

In the PEC Regulations, before Schedule 1 insert—

Schedule 13

This is the Schedule to be substituted for Schedule 1 to the PEC Regulations—

Schedule 14

Schedule 12A to the Data Protection Act 2018

1

In the Data Protection Act 2018, after Schedule 12 insert—

Schedule 12A (1) (1) The Commission is not to be regarded— (a) as a servant or agent of the Crown, or (b) as enjoying any status, immunity or privilege of the Crown. (2) The Commission’s property is not to be regarded— (a) as property of the Crown, or (b) as property held on behalf of the Crown. (2) (1) The number of members of the Commission is to be determined by the Secretary of State. (2) That number must not be— (a) less than 3, or (b) more than 14. (3) The Secretary of State may by regulations substitute a different number for the number for the time being specified in sub-paragraph (2)(b). (4) Regulations under this paragraph are subject to the negative resolution procedure. (3) (1) The Commission is to consist of— (a) the non-executive members, and (b) the executive members. (2) The non-executive members are— (a) a chair appointed by His Majesty by Letters Patent on the recommendation of the Secretary of State, and (b) such other members as the Secretary of State may appoint. (3) The executive members are— (a) a chief executive appointed by the non-executive members or in accordance with paragraph 25, and (b) such other members, if any, as the non-executive members may appoint. (4) The Secretary of State must consult the chair of the Commission before appointing a non-executive member. (5) The non-executive members must consult the Secretary of State before appointing the chief executive. (6) The non-executive members must consult the chief executive about whether there should be any executive members within sub-paragraph (3)(b) and, if so, how many there should be. (7) The Secretary of State may by direction set a maximum and a minimum number of executive members. (8) The Commission may appoint one of the non-executive members as a deputy to the chair. (4) The Secretary of State must exercise the powers conferred on the Secretary of State by paragraphs 2 and 3 so as to secure that the number of non-executive members of the Commission is, so far as practicable, at all times greater than the number of executive members. (5) (1) The Secretary of State may not recommend a person for appointment as the chair of the Commission unless the person has been selected on merit on the basis of fair and open competition. (2) A person may not be appointed as a member of the Commission unless the person has been selected on merit on the basis of fair and open competition. (6) (1) Before— (a) recommending a person for appointment as the chair of the Commission, or (b) appointing a person as a non-executive member of the Commission, the Secretary of State must be satisfied that the person does not have a conflict of interest. (2) The Secretary of State must check from time to time that none of the non-executive members has a conflict of interest. (3) The Secretary of State may require a non-executive member to provide whatever information the Secretary of State considers necessary for the purpose of checking that the member does not have a conflict of interest. (4) A non-executive member who is required to provide information under sub-paragraph (3) must provide it within such period as may be specified by the Secretary of State. (5) In this Schedule, “conflict of interest”, in relation to a person, means a financial or other interest which is likely to affect prejudicially the discharge by the person of the person’s functions as a member of the Commission. (7) (1) The chair of the Commission holds and vacates office in accordance with the terms of the chair’s appointment, subject to the provisions of this paragraph. (2) The chair must be appointed for a term of not more than 7 years. (3) On the recommendation of the Secretary of State, His Majesty may by Letters Patent extend the term of the chair’s appointment but not so the term as extended is more than 7 years. (4) A person cannot be appointed as the chair more than once. (5) The chair may be relieved from office by His Majesty at the chair’s own request. (6) The chair may be removed from office by His Majesty on an Address from both Houses of Parliament. (7) No motion is to be made in either House of Parliament for such an Address unless the Secretary of State has presented a report to that House stating that the Secretary of State is satisfied that— (a) the chair is guilty of serious misconduct, (b) the chair has a conflict of interest (see paragraph 6(5)), (c) the chair has failed to comply with paragraph 6(4), or (d) the chair is unable, unfit or unwilling to carry out the chair’s functions. (8) (1) A deputy chair of the Commission may resign that office by giving written notice to the Commission. (2) A deputy chair of the Commission ceases to hold that office on ceasing to be a non-executive member of the Commission. (3) A deputy chair of the Commission may be removed from that office by the Commission. (9) (1) This paragraph applies to a non-executive member of the Commission appointed by the Secretary of State. (2) The member holds and vacates office in accordance with the terms of their appointment, subject to the provisions of this paragraph. (3) The member must be appointed for a term of not more than 7 years. (4) The Secretary of State may extend the term of the member’s appointment but not so that the term as extended is more than 7 years. (5) The Secretary of State may not appoint the member as a non-executive member of the Commission on a subsequent occasion. (6) The member may resign from office by giving written notice to the Secretary of State and the Commission. (7) The Secretary of State may remove the member from office by written notice if satisfied that— (a) the member is guilty of serious misconduct, (b) the member has a conflict of interest (see paragraph 6(5)), (c) the member has failed to comply with paragraph 6(4), or (d) the member is unable, unfit or unwilling to carry out the member’s functions. (8) At the time of removing the member from office the Secretary of State must make public the decision to do so. (9) The Secretary of State must— (a) give the member a statement of reasons for the removal, and (b) if asked to do so by the member, publish the statement. (10) (1) The Commission may pay to the non-executive members of the Commission such remuneration and allowances as the Secretary of State may determine. (2) The Commission may pay, or make provision for paying, to or in respect of the non-executive members of the Commission, such sums by way of pensions, allowances or gratuities (including pensions, allowances or gratuities paid by way of compensation in respect of loss of office) as the Secretary of State may determine. (3) The Commission may make a payment to a person of such amount as the Secretary of State may determine where— (a) the person ceases to be a non-executive member of the Commission otherwise than on the expiry of the person’s term of office, and (b) it appears to the Secretary of State that there are special circumstances which make it appropriate for the person to receive compensation. (11) (1) The executive members of the Commission are to be employees of the Commission. (2) The executive members are to be employed by the Commission on such terms and conditions, including those as to remuneration, as the non-executive members of the Commission may determine. (3) The Commission must— (a) pay to or in respect of the executive members of the Commission such pensions, allowances or gratuities (including pensions, allowances or gratuities paid by way of compensation in respect of loss of office) as the non-executive members of the Commission may determine, and (b) provide and maintain for them such pension schemes (whether contributory or not) as the non-executive members of the Commission may determine. (12) (1) The Commission may— (a) appoint other employees, and (b) make such other arrangements for the staffing of the Commission as it considers appropriate. (2) In appointing an employee, the Commission must have regard to the principle of selection on merit on the basis of fair and open competition. (3) Employees appointed by the Commission are to be appointed on such terms and conditions, including those as to remuneration, as the Commission may determine. (4) The Commission may— (a) pay to or in respect of those employees such pensions, allowances or gratuities (including pensions, allowances or gratuities paid by way of compensation in respect of loss of employment) as the Commission may determine, and (b) provide and maintain for them such pension schemes (whether contributory or not) as the Commission may determine. (13) (1) The Commission may establish committees. (2) A committee of the Commission may consist of or include persons who are neither members nor employees of the Commission. (3) But a committee of the Commission to which functions are delegated under paragraph 14(1)(c) must include at least one person who is either a member or an employee of the Commission. (4) Where a person who is neither a member nor an employee of the Commission is a member of a committee of the Commission, the Commission may pay to that person such remuneration and expenses as it may determine. (14) (1) The Commission may delegate any of its functions to— (a) a member of the Commission, (b) an employee of the Commission, or (c) a committee of the Commission. (2) A function is delegated under sub-paragraph (1) to the extent and on the terms that the Commission determines. (3) A committee of the Commission may delegate any function delegated to it to a member of the committee. (4) A function is delegated under sub-paragraph (3) to the extent and on the terms that the committee determines. (5) The power of a committee of the Commission to delegate a function, and to determine the extent and terms of the delegation, is subject to the Commission’s power to direct what a committee established by it may and may not do. (6) The delegation of a function by the Commission or a committee of the Commission under this paragraph does not prevent the Commission or the committee from exercising that function. (15) The Commission may require a committee of the Commission to give the Commission advice about matters relating to the discharge of the Commission’s functions. (16) (1) The Commission may make arrangements for regulating— (a) its own procedure, and (b) the procedure of a committee of the Commission. (2) The non-executive members of the Commission may by majority make arrangements for regulating the procedure for the carrying out of the separate functions which are conferred on them under this Schedule. (3) Arrangements under this paragraph may include arrangements as to quorum and the making of decisions by a majority. (4) The Commission must publish arrangements which it makes under this paragraph. (5) This paragraph is subject to paragraph 18. (17) The Commission must make arrangements for the keeping of proper records of— (a) its proceedings, (b) the proceedings of a committee of the Commission, (c) the proceedings at a meeting of the non-executive members of the Commission, (d) anything done by a member or employee of the Commission under paragraph 14(1), and (e) anything done by a member of a committee of the Commission under paragraph 14(3). (18) (1) This paragraph applies if— (a) a member of the Commission has a direct or indirect interest in a matter falling to be considered at a meeting of the Commission, (b) a non-executive member of the Commission has a direct or indirect interest in a matter falling to be considered at a meeting of the non-executive members, or (c) a member of a committee of the Commission has a direct or indirect interest in a matter falling to be considered at a meeting of the committee. (2) The member with the interest must declare it. (3) The declaration must be recorded in the minutes of the meeting. (4) The member with the interest may not take part in a discussion or decision at the meeting relating to the matter, unless— (a) in the case of a meeting of the Commission, the other members of the Commission who are present have resolved unanimously that the interest is to be disregarded, (b) in the case of a meeting of the non-executive members, the other non-executive members who are present have resolved unanimously that the interest is to be disregarded, or (c) in the case of a meeting of a committee, the other members of the committee who are present have, in the manner authorised by the Commission, resolved that the interest is to be disregarded. (5) In giving authorisation for the purposes of sub-paragraph (4)(c), the Commission must secure that a resolution for those purposes does not allow a member to take part in a discussion or decision at a meeting of a committee to which functions are delegated under paragraph 14(1)(c) unless the number of other members of the committee in favour of the resolution— (a) is not less than two thirds of those who are both present and entitled to vote on the resolution, and (b) is not less than its quorum. (6) For the purposes of this paragraph, a notification given at or sent to a meeting of the Commission that a person— (a) is a member of a company or firm, and (b) is to be regarded as interested in any matter involving that company or firm, is to be regarded as compliance with sub-paragraph (2) in relation to any such matter for the purposes of that meeting and subsequent meetings of the Commission, of the non-executive members or of a committee. (7) For the purposes of this paragraph, a notification given at or sent to a meeting of the non-executive members of the Commission or of a committee of the Commission that— (a) a person is a member of a company or firm, and (b) is to be regarded as interested in any matter involving that company or firm, is to be regarded as compliance with sub-paragraph (2) in relation to any such matter for the purposes of that meeting and subsequent meetings of the non-executive members or (as the case may be) of the committee. (8) A notification described in sub-paragraph (6) or (7) remains in force until it is withdrawn. (9) A person required to make a declaration for the purposes of this paragraph in relation to any meeting— (a) is not required to attend the meeting, but (b) is to be taken to have complied with the requirements of this paragraph if the person takes reasonable steps to secure that notice of the person’s interest is read out, and taken into consideration, at the meeting in question. (19) (1) The validity of proceedings of the Commission, of the non-executive members of the Commission or of a committee of the Commission is not affected by— (a) a vacancy in the membership of the Commission or of the committee, (b) a defect in the appointment of a member of the Commission, (c) a failure of the Secretary of State to comply with the requirements of paragraph 4, or (d) a failure to comply with arrangements under paragraph 16 or with a requirement under paragraph 18. (2) Nothing in sub-paragraph (1)(d) validates proceedings of a meeting which is inquorate unless it is inquorate by reason only of a matter within sub-paragraph (1)(b) or (c). (20) The Secretary of State may make payments to the Commission. (21) (1) All fees, charges, penalties and other sums received by the Commission in carrying out its functions are to be paid to the Secretary of State. (2) Sub-paragraph (1) does not apply where the Secretary of State otherwise directs. (3) Any sums received by the Secretary of State under this paragraph are to be paid into the Consolidated Fund. (22) (1) The Commission must keep proper accounts and proper records in relation to them. (2) The Commission must prepare a statement of accounts in respect of each financial year in the form specified by the Secretary of State. (3) The Commission must send a copy of each statement of accounts to the Secretary of State and the Comptroller and Auditor General before the end of August next following the financial year to which the statement relates. (4) The Comptroller and Auditor General must— (a) examine, certify and report on the statement of accounts, and (b) send a copy of the certified statement and the report to the Secretary of State. (5) The Secretary of State must lay before Parliament each document received under sub-paragraph (4)(b). (6) In this paragraph “financial year” means— (a) the period beginning with the date on which the Commission is established and ending with the 31 March following that date, and (b) each successive period of 12 months. (23) (1) The application of the Commission’s seal must be authenticated by the signature of— (a) the chair of the Commission, or (b) another person authorised for that purpose by the Commission. (2) A document purporting to be duly executed under the Commission’s seal or signed on its behalf— (a) is to be received in evidence, and (b) is to be taken to be executed or signed in that way, unless the contrary is shown. (3) This paragraph does not extend to Scotland. (24) The Commission may do anything it thinks appropriate for the purposes of, or in connection with, its functions. (25) (1) The first chief executive of the Commission is to be appointed by the chair of the Commission. (2) Before making the appointment the chair must consult the Secretary of State. (3) The appointment must be for a term of not more than 2 years. (4) The chair may extend the term of the appointment but not so the term as extended is more than 2 years. (5) For the term of appointment, the person appointed under sub-paragraph (1) is “the interim chief executive”. (6) Until the expiry of the term of appointment, the powers conferred on the non-executive members by paragraph 11(2) and (3) are exercisable in respect of the interim chief executive by the chair (instead of by the non-executive members). (7) In sub-paragraphs (5) and (6), the references to the term of appointment are to the term of appointment described in sub-paragraph (3), including any extension of the term under sub-paragraph (4). (26) In this Schedule— (a) references to pensions, allowances or gratuities include references to any similar benefits provided on death or retirement, and (b) references to the payment of pensions, allowances or gratuities to or in respect of a person include references to the making of payments towards the provision of pensions, allowances or gratuities to be paid to or in respect of a person.

Transitional provision: first chair

2

• (1) This paragraph applies to the person who holds the office of Information Commissioner immediately before the day on which this Schedule comes into force.

• (2) The person is to be treated as having been appointed as the chair of the Information Commission for a term that expires at the time the person would cease to hold the office of Information Commissioner but for the abolition of that office by section 118.

• (3) For the purposes of paragraph 7(3) of Schedule 12A to the Data Protection Act 2018 (extension of chair’s term), the term of the person’s appointment as chair of the Information Commission is to be treated as a term beginning when the person began to hold the office of Information Commissioner.

Transitional provision: consultation about non-executive members

3

• (1) This paragraph is about the requirement under paragraph 3(4) of Schedule 12A to the Data Protection Act 2018 for the Secretary of State to consult the chair of the Information Commission before appointing a non-executive member of the Information Commission.

• (2) The requirement may be satisfied by consultation, before this Schedule comes into force, with the person who holds the office of Information Commissioner.

Transitional provision: consultation about interim chief executive

4

• (1) This paragraph is about the requirement under paragraph 25 of Schedule 12A to the Data Protection Act 2018 (transitional provision: interim chief executive) for the chair of the Information Commission to consult the Secretary of State before appointing the first chief executive of the Information Commission.

• (2) The requirement may be satisfied by consultation carried out, before this Schedule comes into force, by the person who holds the office of Information Commissioner.

Schedule 15

1

Chapter 1 of Part 9 of the Health and Social Care Act 2012 (health and adult social care services: information standards) is amended as follows.

2

Before section 250 insert—

.

3

• (1) Section 250 (powers to publish information standards) is amended as follows.

• (2) In subsection (2), at the end insert “and includes, among other things, a standard relating to information technology or IT services used, or intended to be used, in connection with the processing of information (see section 250A)”.

• (3) In subsection (2B)(c)—

• (a) after “provision” insert “in, or in relation to, England”, and

• (b) omit “in England”.

• (4) In subsection (2B), at the end insert—

(e) a relevant IT provider.

• (5) In subsection (3)—

• (a) after “provision” insert “in, or in relation to, England”, and

• (b) omit “in England”.

• (6) In subsection (7)—