The Data Protection Act 2018 (Commencement No. 1 and Transitional and Saving Provisions) Regulations 2018

Made: 24th May 2018

The Secretary of State makes the following Regulations in exercise of the powers conferred by section 212(1) and section 213(2) of the Data Protection Act 2018[^f00001].

Citation and interpretation

1

• (1) These Regulations may be cited as the Data Protection Act 2018 (Commencement No. 1 and Transitional and Saving Provisions) Regulations 2018.

• (2) In these Regulations “the 2018 Act” means the Data Protection Act 2018.

Provisions coming into force on 25th May 2018

2

• (1) The following provisions of the 2018 Act, so far as not already in force (see section 212(2) of the 2018 Act), come into force on 25th May 2018—

• (a) section 2 (protection of personal data);

• (b) Part 2 (general processing) (including Schedules 1, 2, 3, 4, 5 and 6), other than paragraph 62 of Schedule 6;

• (c) Part 3 (law enforcement processing) (including Schedules 7 and 8);

• (d) Part 4 (intelligence services processing) (including Schedules 9, 10 and 11), other than the provisions listed in paragraph (2);

• (e) Part 5 (the Information Commissioner) (including Schedules 12, 13 and 14), other than the provisions listed in—

• (i) section 212(3) of the 2018 Act; and

• (ii) regulation 3;

• (f) Part 6 (enforcement) (including Schedules 15, 16 and 17), other than the provisions listed in section 212(3) of the 2018 Act;

• (g) Part 7 (supplementary and final provision) (including Schedules 18, 19 and 20), other than the provisions listed in—

• (i) paragraph (3); and

• (ii) regulation 3.

• (2) The provisions referred to in paragraph (1)(d) are—

• (a) section 93 (right to information);

• (b) section 102 (general obligations of the controller);

• (c) section 103 (data protection by design);

• (d) section 104 (joint controllers);

• (e) section 105 (processors);

• (f) section 108 (communication of a personal data breach).

• (3) The provisions referred to in paragraph (1)(g)(i) are the following paragraphs in Schedule 19—

• (a) paragraph 76;

• (b) paragraph 201;

• (c) paragraph 211;

• (d) paragraph 227.

Provisions coming into force on 23rd July 2018

3

The following provisions of the 2018 Act come into force on 23rd July 2018—

• (a) section 123 (age-appropriate design code);

• (b) section 125 (approval of codes prepared under section 121 to 124) so far as it relates to a code prepared under section 123 (age-appropriate design code);

• (c) section 126 (publication and review of codes issued under section 125(4)) so far as it relates to a code prepared under section 123 (age-appropriate design code);

• (d) section 127 (effect of codes issued under section 125(4)) so far as it relates to a code prepared under section 123 (age-appropriate design code);

• (e) section 188 (representation of data subjects with their authority: collective proceedings);

• (f) section 189 (duty to review provision for representation of data subjects);

• (g) section 190 (post-review powers to make provision about representation of data subjects);

• (h) section 191 (Framework for Data Processing by Government);

• (i) section 192 (approval of the Framework);

• (j) section 193 (publication and review of the Framework);

• (k) section 194 (effect of the Framework);

• (l) section 195 (reserve forces: data sharing by HMRC).

Transitional and saving provisions relating to the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016

4

• (1) In this regulation—

• the 1998 Act

means the Data Protection Act 1998[^f00002];

• the eIDAS Regulation

means Regulation (EU) No 910/2014 of the European Parliament and of the Council on electronic identification and trust services for electronic transactions in the internal market[^f00003], as amended from time to time;

• the EITSET Regulations

means the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016[^f00004];

• the new Schedule

means Schedule 2 to the EITSET Regulations as inserted by paragraph 406 of Schedule 19 to the 2018 Act;

• the old Schedule

means Schedule 2 to the EITSET Regulations as it is in force immediately before 25th May 2018.

• (2) This regulation has effect for the purposes of enforcing the EITSET Regulations and the eIDAS Regulation.

• (3) On or after 25th May 2018—

• (a) an information notice served under section 43 of the 1998 Act as applied by the old Schedule, and not cancelled before 25th May 2018, has effect as if given under section 142 of the 2018 Act as applied by the new Schedule;

• (b) an assessment notice served under section 41A of the 1998 Act as applied by the old Schedule, and not cancelled before 25th May 2018, has effect as if given under section 146 of the 2018 Act as applied by the new Schedule;

• (c) an enforcement notice served under section 40 of the 1998 Act as applied by the old Schedule, and not cancelled before 25th May 2018, has effect as if given under section 149 of the 2018 Act as applied by the new Schedule;

• (d) any steps taken before 25th May under Schedule 9 to the 1998 Act (powers of entry and inspection) as applied by the old Schedule in connection with an application for a warrant (including the issuing of a warrant) that has not been decided, or a warrant that remains in force, immediately before 25th May 2018 are to be treated as having been taken under Schedule 15 to the 2018 Act;

• (e) an appeal under section 48 of the 1998 Act as applied by the old Schedule which has not been decided or otherwise ended before 25th May 2018 has effect as if it were an appeal under section 162 of the 2018 Act as applied by the new Schedule, subject to paragraph (5).

• (4) A notice or step described in paragraph (3) which satisfied the requirements of the 1998 Act when it was given or taken before 25th May 2018 is to be treated as valid after that time even if it does not satisfy a requirement under the 2018 Act.

• (5) In the case of an appeal under section 48(3) of the 1998 Act as applied by the old Schedule (appeal against urgency statement) which has not been decided or otherwise ended before 25th May 2018—

• (a) paragraph (3)(e) does not apply; and

• (b) the repeal of section 48 of the 1998 Act, the substitution of the old Schedule and paragraph (3) do not affect the application of that section and that Schedule to the case on or after 25th May 2018.

• (6) A penalty notice may not be given under section 155 of the 2018 Act as applied by the new Schedule in relation to a failure to comply with an information notice, assessment notice or enforcement notice originally served under the 1998 Act as applied by the old Schedule.

• (7) The substitution of the new Schedule for the old Schedule does not affect the application, on or after 25th May 2018, of sections 47(1) and 60 of the 1998 Act (offence of failing to comply with certain notices) as applied by the old Schedule in connection with an information or enforcement notice served under the 1998 Act as applied by the old Schedule.

Signed

Margot James — Minister of State — Department for Digital, Culture, Media and Sport — 24th May 2018

Explanatory note

(This note is not part of the Regulations)

EXPLANATORY NOTE

These Regulations bring into force specified provisions of the Data Protection Act 2018 (c.12) (“the 2018 Act”) and make transitional and saving provision in connection with the coming into force of those provisions for the purposes of enforcing the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 (“the EITSET Regulations”) and Regulation (EU) No 910/2014 of the European Parliament and of the Council in electronic identification and trust services for electronic transactions in the internal market (as amended from time to time) (“the eIDAS Regulation”). Certain provisions were brought into force on Royal Assent by virtue of section 212(2) of the 2018 Act.

Regulation 2(1) lists the provisions that will come into force on 25th May 2018, subject to certain exceptions, which are listed in section 212(3) of the 2018 Act, and regulation 2(2) and (3) and regulation 3 of these Regulations. Section 212(3) of the 2018 Act brings certain provisions into force two months after Royal Assent. The provisions listed in regulation 2(2) and (3), will be brought into force at a later date.

Regulation 3 lists the provisions that will come into force on 23rd July 2018.

Regulation 4 makes transitional and saving provision about the enforcement regime for the EITSET Regulations and the eIDAS Regulation.

Footnotes

[^f00001]: 2018 c.12.

[^f00002]: 1998 c.29.

[^f00003]: OJ No L257, 28.8.2014, p73.

[^f00004]: S.I. 2016/696.