Data Protection Act 2018

Overview

(1) This Act makes provision about the processing of personal data. (2) Most processing of personal data is subject to the UK GDPR. (3) Part 2 supplements the…

Protection of personal data

(1) The UK GDPR and this Act protect individuals with regard to the processing of personal data, in particular by— (a) requiring personal data to be processed…

Terms relating to the processing of personal data

(1) This section defines some terms used in this Act. (2) “Personal data” means any information relating to an identified or identifiable living individual…

Processing to which this Part applies

(1) This Part is relevant to most processing of personal data. (2) This Part— (a) applies to the types of processing of personal data to which the UK GDPR…

Definitions

(1) Terms used in ... this Part and in the UK GDPR have the same meaning in this Part as they have in the UK GDPR. (2) In subsection (1), the reference to a…

Meaning of “controller”

(1) The definition of “controller” in Article 4(1)(7) of the UK GDPR has effect subject to— (a) subsection (2), (b) section 209, and (c) section 210. (2) For…

Meaning of “public authority” and “public body”

(1) For the purposes of the UK GDPR, the following (and only the following) are “public authorities” and “public bodies” ...— (a) a public authority as defined…

Lawfulness of processing: public interest etc

In Article 6(1) of the UK GDPR (lawfulness of processing), the reference in point (e) to processing of personal data that is necessary for the performance of a…

Processing in reliance on relevant international law

(1) Processing of personal data meets the requirement in Article 6(3), 8A(3)(e), 9(2)(g) or 10(1) of the UK GDPR for a basis in, or authorisation by, relevant…

Special categories of personal data and criminal convictions etc data

(1) Subsections (2) and (3) make provision about the processing of personal data described in Article 9(1) of the UK GDPR (prohibition on processing of special…

Special categories of personal data etc: supplementary

(1) For the purposes of Article 9(2)(h) of the UK GDPR (processing for health or social care purposes etc), the circumstances in which the processing of…

Limits on fees that may be charged by controllers

(1) The Secretary of State may by regulations specify limits on the fees that a controller may charge in reliance on— (a) Article 12(5) of the UK GDPR…

Obligations of credit reference agencies

(1) This section applies where a controller is a credit reference agency (within the meaning of section 145(8) of the Consumer Credit Act 1974). (2) The…

Meaning of “relevant offence” for purpose of right to erasure

(1) The Secretary of State may by regulations amend the table in Article 17(5) of the UK GDPR. (2) Regulations under this section are subject to the…

Exemptions etc

— s. 15 — Exemptions etc (1) Schedules 2, 3 and 4 make provision for exemptions from, and restrictions and adaptations of the application of, rules of the UK…

Power to make further exemptions etc by regulations

(1) The following powers to make provision altering the application of the UK GDPR may be exercised by way of regulations made by the Secretary of State under…

Accreditation of certification providers

(1) Accreditation of a person as a certification provider is only valid when carried out by— (a) the Commission, or (b) the UK national accreditation body. (2)…

Definitions

— s. 21 — Definitions (1) … (2) … (3) … (4) … (5) In this Chapter, “FOI public authority” means— (a) a public authority as defined in the Freedom of…

Manual unstructured data held by FOI public authorities

(1) The provisions of the UK GDPR and this Act listed in subsection (2) do not apply to personal data to which the UK GDPR applies by virtue of Article 2(1A)…

Manual unstructured data used in longstanding historical research

(1) The provisions of the UK GDPR listed in subsection (2) do not apply to personal data to which the UK GDPR applies by virtue of Article 2(1A) (manual…

National security and defence exemption

(1) A provision of the UK GDPR or this Act mentioned in subsection (2) does not apply to personal data to which the UK GDPR applies if exemption from the…

National security: certificate

(1) Subject to subsection (3), a certificate signed by a Minister of the Crown certifying that exemption from all or any of the provisions listed in section…

National security and defence: modifications to Articles 9 and 32 of the UK GDPR

(1) Article 9(1) of the UK GDPR (prohibition on processing of special categories of personal data) does not prohibit the processing of personal data to which…

Processing to which this Part applies

(1) This Part applies to— (a) the processing by a competent authority of personal data wholly or partly by automated means, and (b) the processing by a…

Meaning of “competent authority”

(1) In this Part, “competent authority” means— (a) a person specified or described in Schedule 7, and (b) any other person if and to the extent that the person…

“The law enforcement purposes”

For the purposes of this Part, “the law enforcement purposes” are the purposes of the prevention, investigation, detection or prosecution of criminal offences…

Meaning of “controller” and “processor”

(1) In this Part, “controller” means the competent authority which, alone or jointly with others— (a) determines the purposes and means of the processing of…

Other definitions

(1) This section defines certain other expressions used in this Part. (1A) “Consent” of the data subject to the processing of personal data means a freely…

Overview and general duty of controller

(1) This Chapter sets out the six data protection principles as follows— (a) section 35(1) sets out the first data protection principle (requirement that…

The first data protection principle

(1) The first data protection principle is that the processing of personal data for any of the law enforcement purposes must be lawful and fair. (2) The…

The second data protection principle

(1) The second data protection principle is that— (a) the law enforcement purpose for which personal data is collected (whether from the data subject or…

The third data protection principle

The third data protection principle is that personal data processed for any of the law enforcement purposes must be adequate, relevant and not excessive in…

The fourth data protection principle

(1) The fourth data protection principle is that— (a) personal data processed for any of the law enforcement purposes must be accurate and, where necessary…

The fifth data protection principle

(1) The fifth data protection principle is that personal data processed for any of the law enforcement purposes must be kept for no longer than is necessary…

The sixth data protection principle

The sixth data protection principle is that personal data processed for any of the law enforcement purposes must be so processed in a manner that ensures…

Conditions for consent

(1) This section is about processing of personal data that is carried out in reliance on the consent of the data subject. (2) The controller must be able to…

Safeguards: archiving

(1) This section applies in relation to the processing of personal data for a law enforcement purpose where the processing is carried out— (a) for archiving…

Safeguards: sensitive processing

(1) This section applies for the purposes of section 35(4) and (5) (which require a controller to have an appropriate policy document in place when carrying…

Further provision about sensitive processing

(1) The Secretary of State may by regulations— (a) make provision so that an additional description of processing of personal data is sensitive processing for…

Overview and scope

— s. 43 — Overview and scope (1) This Chapter— (a) imposes general duties on the controller to make information available (see sections 44 and 45A); (b)…

... Controller's general duties

(1) The controller must make available to data subjects the following information (whether by making the information generally available to the public or in…

Right of access by the data subject

(1) A data subject is entitled to obtain from the controller— (a) confirmation as to whether or not personal data concerning him or her is being processed, and…

Exemption from sections 44 and 45: legal professional privilege

(1) Sections 44(2) and 45(1) do not require the controller to give the data subject— (a) information in respect of which a claim to legal professional…

Right to rectification

(1) The controller must, if so requested by a data subject, rectify without undue delay inaccurate personal data relating to the data subject. (2) Where…

Right to erasure or restriction of processing

(1) The controller must erase personal data without undue delay where— (a) the processing of the personal data would infringe section 35, 36(1) to (3), 37…

Rights under section 46 or 47: supplementary

(1) Where a data subject requests the rectification or erasure of personal data or the restriction of its processing, the controller must inform the data…

Automated processing and significant decisions

(1) For the purposes of sections 50B and 50C— (a) a decision is based solely on automated processing if there is no meaningful human involvement in the taking…

Restrictions on automated decision-making based on sensitive processing

(1) A significant decision based entirely or partly on sensitive processing may not be taken based solely on automated processing, unless one of the following…

Safeguards for automated decision-making

(1) Subject to subsection (3), where a significant decision taken by or on behalf of a controller in relation to a data subject is— (a) based entirely or…

Further provision about automated decision-making

(1) The Secretary of State may by regulations provide that, for the purposes of sections 50A(1)(a) and 50C(3)(c), there is, or is not, to be taken to be…

Exercise of rights through the Commission

(1) This section applies where a controller— (a) restricts under section 44(4) the information provided to the data subject under section 44(2) (duty of the…

Form of provision of information etc

(1) The controller must take reasonable steps to ensure that any information that is required by or under this Chapter to be provided to the data subject is…

Manifestly unfounded or excessive requests by the data subject

(1) Where a request made by a data subject under or by virtue of any of sections 45, 46, 47, 50C or 50D is manifestly unfounded or excessive, the controller…

Meaning of “applicable time period”

(1) This section defines “the applicable time period” for the purposes of sections 45(3)(b) and (5), 48(2)(b) and 53(7). (2) “The applicable time period” means…

Overview and scope

— s. 55 — Overview and scope (1) This Chapter— (a) sets out the general obligations of controllers and processors (see sections 56 to 65); (b) sets out…

General obligations of the controller

(1) Each controller must implement appropriate technical and organisational measures to ensure, and to be able to demonstrate, that the processing of personal…

Data protection by design and default

(1) Each controller must implement appropriate technical and organisational measures which are designed— (a) to implement the data protection principles in an…

Joint controllers

(1) Where two or more competent authorities jointly determine the purposes and means of processing personal data, they are joint controllers for the purposes…

Processors

(1) This section applies to the use by a controller of a processor to carry out processing of personal data on behalf of the controller. (2) The controller may…

Processing under the authority of the controller or processor

A processor, and any person acting under the authority of a controller or processor, who has access to personal data may not process the data except— (a) on…

Records of processing activities

(1) Each controller must maintain a record of all categories of processing activities for which the controller is responsible. (2) The controller's record must…

Logging

(1) A controller (or, where personal data is processed on behalf of the controller by a processor, the processor) must keep logs for at least the following…

Co-operation with the Commission

Each controller and each processor must co-operate, on request, with the Commission in the performance of the Commission's tasks.

Data protection impact assessment

(1) Where a type of processing is likely to result in a high risk to the rights and freedoms of individuals, the controller must, prior to the processing…

Prior consultation with the Commission

(1) This section applies where a controller intends to create a filing system and process personal data forming part of it. (2) The controller must consult the…

Security of processing

(1) Each controller and each processor must implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks…

Notification of a personal data breach to the Commission

(1) If a controller becomes aware of a personal data breach in relation to personal data for which the controller is responsible, the controller must notify…

Communication of a personal data breach to the data subject

(1) Where a personal data breach is likely to result in a high risk to the rights and freedoms of individuals, the controller must inform the data subject of…

Designation of a data protection officer

(1) The controller must designate a data protection officer, unless the controller is a court, or other judicial authority, acting in its judicial capacity…

Position of data protection officer

(1) The controller must ensure that the data protection officer is involved, properly and in a timely manner, in all issues which relate to the protection of…

Tasks of data protection officer

(1) The controller must entrust the data protection officer with at least the following tasks— (a) informing and advising the controller, any processor engaged…

Codes of conduct

— s. 71A — Codes of conduct (1) The Commission must encourage expert public bodies to produce codes of conduct intended to contribute to compliance with this…

Overview and interpretation

— s. 72 — Overview and interpretation (1) This Chapter deals with the transfer of personal data to third countries or international organisations, as follows—…

General principles for transfers of personal data

(A1) This section applies in relation to a transfer of personal data to a third country or international organisation for a law enforcement purpose. (1) The…

Transfers approved by regulations

(1) For the purposes of section 73, the Secretary of State may by regulations approve transfers of personal data to— (a) a third country, or (b) an…

The data protection test

(1) For the purposes of section 74AA, the data protection test is met in relation to transfers to a third country or international organisation if the standard…

Transfers approved by regulations: monitoring

(1) … (2) … (3) The Secretary of State must, on an ongoing basis, monitor developments in third countries and international organisations that could affect…

Transfers subject to appropriate safeguards

(1) … (1A) A transfer of personal data to a third country or an international organisation is made subject to appropriate safeguards only if— (a) an…

Transfers based on special circumstances

(A1) A transfer of personal data to a third country or international organisation is based on special circumstances where— (a) it is made in the absence of…

Additional conditions for transfers in reliance on section 73(4)(b)

(1) The additional conditions referred to in section 73(4)(b)(ii) are the following four conditions. (2) Condition 1 is that the transfer is strictly necessary…

Subsequent transfers

— s. 78 — Subsequent transfers (A1) Subsections (1) to (6) apply where a transfer to which section 73 applies takes place otherwise than in reliance on section…

National security exemption

(1) A provision mentioned in subsection (2) does not apply to personal data processed for law enforcement purposes if exemption from the provision is required…

National security: certificate

(1) … (2) … (3) … (3A) Subject to subsection (5), a certificate signed by a Minister of the Crown certifying that exemption from all or any of the provisions…

Special processing restrictions

(1) Subsections (3) and (4) apply where, for a law enforcement purpose, a controller transmits or otherwise makes available personal data to a non-UK…

Reporting of infringements

(1) Each controller must implement effective mechanisms to encourage the reporting of an infringement of this Part. (2) The mechanisms implemented under…

Processing to which this Part applies

(A1) This Part— (a) applies to processing of personal data by an intelligence service, and (b) applies to processing of personal data by a qualifying competent…

Designation of processing by a qualifying competent authority

(1) For the purposes of this Part, the Secretary of State may give a notice designating processing of personal data by a qualifying competent authority (a…

Duration of designation notice

(1) A designation notice must state when it comes into force. (2) A designation notice ceases to be in force at the earliest of the following times— (a) at the…

Review and withdrawal of designation notice

(1) Subsections (2) to (4) apply where processing is the subject of a designation notice for the time being in force. (2) A person who applied for the…

Records of designation notices

(1) Where the Secretary of State gives a designation notice— (a) the Secretary of State must send a copy of the notice to the Commission, and (b) the…

Appeal against designation notice

(1) A person directly affected by a designation notice may appeal to the Tribunal against the notice. (2) If, on an appeal under this section, the Tribunal…

Meaning of “controller” and “processor”

(A1) For the purposes of this Part— (a) an intelligence service is the “controller” in relation to the processing of personal data if it satisfies subsection…

Other definitions

(1) This section defines other expressions used in this Part. (2) “Consent”, in relation to the processing of personal data relating to an individual, means a…

Overview

— s. 85 — Overview (1) This Chapter sets out the six data protection principles as follows— (a) section 86 sets out the first data protection principle…

The first data protection principle

(1) The first data protection principle is that the processing of personal data must be— (a) lawful, and (b) fair and transparent. (2) The processing of…

The second data protection principle

(1) The second data protection principle is that— (a) the purpose for which personal data is collected (whether from the data subject or otherwise) must be…

The third data protection principle

The third data protection principle is that personal data must be adequate, relevant and not excessive in relation to the purpose for which it is processed.

The fourth data protection principle

The fourth data protection principle is that personal data undergoing processing must be accurate and, where necessary, kept up to date.

The fifth data protection principle

The fifth data protection principle is that personal data must be kept for no longer than is necessary for the purpose for which it is processed.

The sixth data protection principle

(1) The sixth data protection principle is that personal data must be processed in a manner that includes taking appropriate security measures as regards risks…

Further provision about sensitive processing

(1) The Secretary of State may by regulations— (a) make provision so that an additional description of processing of personal data is sensitive processing for…

Overview

— s. 92 — Overview (1) This Chapter sets out the rights of the data subject as follows— (a) section 93 deals with the information to be made available to the…

Right to information

(1) The controller must give a data subject the following information— (a) the identity and the contact details of the controller; (b) the legal basis on…

Right of access

(1) An individual is entitled to obtain from a controller— (a) confirmation as to whether or not personal data concerning the individual is being processed…

Right of access: supplementary

(1) The controller must comply with the obligation imposed by section 94(1)(b)(i) by supplying the data subject with a copy of the information in writing…

Right not to be subject to automated decision-making

(1) The controller may not take a decision significantly affecting a data subject that is based on entirely automated processing of personal data relating to…

Right to intervene in automated decision-making

(1) This section applies where— (a) the controller takes a decision significantly affecting a data subject that is based on entirely automated processing of…

Right to information about decision-making

(1) Where— (a) the controller processes personal data relating to a data subject, and (b) results produced by the processing are applied to the data subject…

Right to object to processing

(1) A data subject is entitled at any time, by notice given to the controller, to require the controller— (a) not to process personal data relating to the data…

Rights to rectification and erasure

(1) If a court is satisfied on the application of a data subject that personal data relating to the data subject is inaccurate, the court may order the…

Overview

— s. 101 — Overview This Chapter sets out— (a) the general obligations of controllers and processors (see sections 102 to 106); (b) specific obligations of…

General obligations of the controller

Each controller must implement appropriate measures— (a) to ensure, and (b) to be able to demonstrate, in particular to the Commission, that the processing of…

Data protection by design

(1) Where a controller proposes that a particular type of processing of personal data be carried out by or on behalf of the controller, the controller must…

Joint controllers

(1) Where two or more controllers jointly determine the purposes and means of processing personal data, they are joint controllers for the purposes of this…

Processors

(1) This section applies to the use by a controller of a processor to carry out processing of personal data on behalf of the controller. (2) The controller may…

Processing under the authority of the controller or processor

A processor, and any person acting under the authority of a controller or processor, who has access to personal data may not process the data except— (a) on…

Security of processing

(1) Each controller and each processor must implement security measures appropriate to the risks arising from the processing of personal data. (2) In the case…

Communication of a personal data breach

(1) If a controller becomes aware of a serious personal data breach in relation to personal data for which the controller is responsible, the controller must…

Transfers of personal data outside the United Kingdom

— s. 109 — Transfers of personal data outside the United Kingdom (1) A controller may not transfer personal data to— (a) a country or territory outside the…

National security

(1) A provision mentioned in subsection (2) does not apply to personal data to which this Part applies if exemption from the provision is required for the…

National security: certificate

(1) Subject to subsection (3), a certificate signed by a Minister of the Crown certifying that exemption from all or any of the provisions mentioned in section…

Other exemptions

Schedule 11 provides for further exemptions.

Power to make further exemptions

(1) The Secretary of State may by regulations amend Schedule 11— (a) by adding exemptions from any provision of this Part; (b) by omitting exemptions added by…

The Information Commission

— The Information Commission — s. 114A — The Information Commission (1) A body corporate called the Information Commission is established. (2) Schedule 12A…

General functions under the UK GDPR and safeguards

(1) … (2) General functions are conferred on the Commission by— (a) Article 57 of the UK GDPR (tasks), and (b) Article 58 of the UK GDPR (powers), (and see…

Other general functions

(A1) The Commission is responsible for monitoring the application of Part 3 of this Act, in order to protect the fundamental rights and freedoms of individuals…

Competence in relation to courts etc

Nothing in this Act or the UK GDPR permits or requires the Commission to exercise functions in relation to the processing of personal data by— (a) an…

Co-operation between parties to the Data Protection Convention

(1) … (2) … (3) … (4) … (5) Part 2 of Schedule 14 makes provision as to the functions to be carried out by the Commission for the purposes of Article 13 of the…

Inspection of personal data in accordance with international obligations

(1) The Commission may inspect personal data where the inspection is necessary in order to discharge an international obligation of the United Kingdom, subject…

Standard clauses for transfers to third countries etc

(1) The Commission may issue a document specifying standard data protection clauses which the Commission considers are capable of securing that the data…

Further international role

(1) The Commission must, in relation to third countries and international organisations, take appropriate steps to— (a) develop international co-operation…

Principal objective

It is the principal objective of the Commission, in carrying out functions under the data protection legislation— (a) to secure an appropriate level of…

Duties in relation to functions under the data protection legislation

In carrying out functions under the data protection legislation, the Commission must have regard to such of the following as appear to the Commission to be…

Strategy

(1) The Commission must prepare a strategy for carrying out the Commission's functions under the data protection legislation in accordance with the…

Duty to consult other regulators

(1) The Commission must, at such times as the Commission considers appropriate, consult the persons mentioned in subsection (2) about how the manner in which…

Data-sharing code

(1) The Commission must prepare a code of practice which contains— (a) practical guidance in relation to the sharing of personal data in accordance with the…

Direct marketing code

(1) The Commission must prepare a code of practice which contains— (a) practical guidance in relation to the carrying out of direct marketing in accordance…

Age-appropriate design code

(1) The Commission must prepare a code of practice which contains such guidance as the Commission considers appropriate on standards of age-appropriate design…

Data protection and journalism code

(1) The Commission must prepare a code of practice which contains— (a) practical guidance in relation to the processing of personal data for the purposes of…

Other codes of practice

(1) The Commission must prepare appropriate codes of practice giving guidance as to good practice in the processing of personal data if required to do so by…

Panels to consider codes of practice

(1) This section applies where a code is prepared under section 121, 122, 123, 124 or 124A, subject to subsection (11). (2) The Commission must establish a…

Impact assessments for codes of practice

(1) Where a code is prepared under section 121, 122, 123, 124 or 124A, the Commission must carry out and publish an assessment of— (a) who would be likely to…

Approval of codes prepared under sections 121 to 124A

(1) When a code is prepared under section 121, 122, 123, 124 or 124A— (a) the Commission must submit the final version to the Secretary of State, and (b) the…

Publication and review of codes issued under section 125(4)

(1) The Commission must publish a code issued under section 125(4). (2) Where an amendment of a code is issued under section 125(4), the Commission must…

Effect of codes issued under section 125(4)

(1) A failure by a person to act in accordance with a provision of a code issued under section 125(4) does not of itself make that person liable to legal…

Consensual audits

— s. 129 — Consensual audits (1) The Commission's functions under Article 58(1) of the UK GDPR and paragraph 1 of Schedule 13 include power, with the consent…

Records of national security certificates

— s. 130 — Records of national security certificates (1) A Minister of the Crown who issues a certificate under section 27, 79 or 111 must send a copy of the…

Disclosure of information to the Commission

(1) No enactment or rule of law prohibiting or restricting the disclosure of information precludes a person from providing the Commission with information…

Confidentiality of information

(1) A person who is or has been a member of the Commission or a member of its staff, or an agent of the Commission, must not disclose information which— (a)…

Guidance about privileged communications

(1) The Commission must produce and publish guidance about— (a) how the Commission proposes to secure that privileged communications which the Commission…

Fees for services

The Commission may require a person other than a data subject or a data protection officer to pay a reasonable fee for a service provided to the person, or at…

Manifestly unfounded or excessive requests by data subjects etc

(A1) This section makes provision about cases in which a request made to the Commission, to which the Commission is required or authorised to respond under the…

Guidance about fees

(1) The Commission must produce and publish guidance about the fees the Commission proposes to charge in accordance with— (a) section 134 or 135, ... (b) … (2)…

Charges payable to the Commission by controllers

(1) The Secretary of State may by regulations require controllers to pay charges of an amount specified in the regulations to the Commission. (2) Regulations…

Regulations under section 137: supplementary

(1) Before making regulations under section 137(1) or (6), the Secretary of State must consult such representatives of persons likely to be affected by the…

Reporting to Parliament

(1) The Commission must— (a) produce a general report on the carrying out of the Commission's functions annually, (b) arrange for it to be laid before…

Analysis of performance

(1) The Commission must prepare and publish an analysis of the Commissioner’s performance using key performance indicators. (2) The analysis must be prepared…

Publication by the Commission

A duty under this Act for the Commission to publish a document is a duty for the Commission to publish it, or to arrange for it to be published, in such form…

Notices from the Commission

(1) This section applies in relation to a notice authorised or required by this Act to be given to a person by the Commission. (2) The notice may be given to…

Information notices

— s. 142 — Information notices (1) The Commission may, by written notice (an “information notice”)— (a) require a controller or processor to provide the…

Information notices: restrictions

(1) The Commission may not give an information notice with respect to the processing of personal data for the special purposes unless— (a) a determination…

False statements made in response to information notices

It is an offence for a person, in response to an information notice— (a) to make a statement which the person knows to be false in a material respect, or (b)…

Information orders

(1) This section applies if, on an application by the Commission, a court is satisfied that a person has failed to comply with a requirement of an information…

Assessment notices

— s. 146 — Assessment notices (1) The Commission may by written notice (an “assessment notice”) require a controller or processor to permit the Commission to…

Assessment notices: approval of person to prepare report etc

(1) This section applies where an assessment notice requires a controller or processor to make arrangements for an approved person to prepare a report. (2) The…

Assessment notices: restrictions

(1) An assessment notice does not require a person to do something to the extent that requiring the person to do it would involve an infringement of the…

Destroying or falsifying information and documents etc

(1) This section applies where a person— (a) has been given an information notice requiring the person to provide the Commission with information or a…

Interview notices

— s. 148A — Interview notices (1) This section applies where the Commission suspects that a controller or processor— (a) has failed or is failing as described…

Interview notices: restrictions

(1) An interview notice does not require an individual to answer questions to the extent that requiring the person to do so would involve an infringement of…

False statements made in response to interview notices

It is an offence for an individual, in response to an interview notice— (a) to make a statement which the individual knows to be false in a material respect…

Enforcement notices

— s. 149 — Enforcement notices (1) Where the Commission is satisfied that a person has failed, or is failing, as described in subsection (2), (3), (4), (5) or…

Enforcement notices: supplementary

(1) An enforcement notice must— (a) state what the person has failed or is failing to do, and (b) give the Commission's reasons for reaching that opinion. (2)…

Enforcement notices: rectification and erasure of personal data etc

(1) Subsections (2) and (3) apply where an enforcement notice is given in respect of a failure by a controller or processor— (a) to comply with a data…

Enforcement notices: restrictions

(1) The Commission may not give a controller or processor an enforcement notice in reliance on section 149(2) with respect to the processing of personal data…

Enforcement notices: cancellation and variation

(1) The Commission may cancel or vary an enforcement notice by giving written notice to the person to whom it was given. (2) A person to whom an enforcement…

Powers of entry and inspection

— s. 154 — Powers of entry and inspection Schedule 15 makes provision about powers of entry and inspection.

Penalty notices

(1) If the Commission is satisfied that a person— (a) has failed or is failing as described in section 149(2), (3), (4), (5) or (5A), ... (b) has failed to…

Penalty notices: restrictions

(1) The Commission may not give a controller or processor a penalty notice in reliance on section 149(2) with respect to the processing of personal data for…

Maximum amount of penalty

(1) In relation to an infringement of a provision of the UK GDPR, the maximum amount of the penalty that may be imposed by a penalty notice is— (a) the amount…

Fixed penalties for non-compliance with charges regulations

(1) The Commission must produce and publish a document specifying the amount of the penalty for a failure to comply with regulations made under section 137…

Amount of penalties: supplementary

(1) For the purposes of Article 83 of the UK GDPR and section 157, the Secretary of State may by regulations— (a) provide that a person of a description…

Guidance about regulatory action

(1) The Commission must produce and publish guidance about how the Commission proposes to exercise the Commission's functions in connection with— (a)…

Approval of first guidance about regulatory action

(1) When the first guidance is produced under section 160(1)— (a) the Commission must submit the final version to the Secretary of State, and (b) the Secretary…

Annual report on regulatory action

(1) The Commission must produce and publish an annual report containing the information described in subsections (2) to (5). (2) The report must include the…

Rights of appeal

(1) A person who is given any of the following notices may appeal to the Tribunal— (a) an information notice; (b) an assessment notice; (ba) an interview…

Determination of appeals

(1) Subsections (2) to (4) apply where a person appeals to the Tribunal under section 162(1) or (3). (2) The Tribunal may review any determination of fact on…

Applications in respect of urgent notices

(1) This section applies where an information notice, an assessment notice, an interview notice or an enforcement notice given to a person contains an urgency…

Complaints by data subjects to controllers

(1) A data subject may make a complaint to the controller if the data subject considers that, in connection with personal data relating to the data subject…

Controllers to notify the Commission of the number of complaints

(1) The Secretary of State may by regulations require a controller to notify the Commission of the number of complaints made to the controller under section…

Complaints by data subjects to the Commission

(1) … (2) A data subject may make a complaint to the Commission if the data subject considers that, in connection with personal data relating to him or her…

Orders to progress complaints to the Commission

(1) This section applies where, after a data subject makes a complaint under section 165 ..., the Commission— (a) fails to take appropriate steps to respond to…

Compliance orders

(1) This section applies if, on an application by a data subject, a court is satisfied that there has been an infringement of the data subject's rights under…

Compensation for contravention of the UK GDPR

(1) In Article 82 of the UK GDPR (right to compensation for material or non-material damage), “non-material damage” includes distress. (2) Subsection (3)…

Compensation for contravention of other data protection legislation

(1) A person who suffers damage by reason of a contravention of a requirement of the data protection legislation, other than the UK GDPR, is entitled to…

Unlawful obtaining etc of personal data

(1) It is an offence for a person knowingly or recklessly— (a) to obtain or disclose personal data without the consent of the controller, (b) to procure the…

Re-identification of de-identified personal data

(1) It is an offence for a person knowingly or recklessly to re-identify information that is de-identified personal data without the consent of the controller…

Re-identification: effectiveness testing conditions

(1) For the purposes of section 171, in relation to a person who re-identifies information that is de-identified personal data, “the effectiveness testing…

Alteration etc of personal data to prevent disclosure to data subject

(1) Subsection (3) applies where— (a) a request has been made in exercise of a data subject access right, and (b) the person making the request would have been…

The special purposes

— s. 174 — The special purposes (1) In this Part, “the special purposes” means one or more of the following— (a) the purposes of journalism; (b) academic…

Provision of assistance in special purposes proceedings

(1) An individual who is a party, or prospective party, to special purposes proceedings may apply to the Commission for assistance in those proceedings. (2) As…

Staying special purposes proceedings

(1) In any special purposes proceedings before a court, if the controller or processor claims, or it appears to the court, that any personal data to which the…

Guidance about how to seek redress against media organisations

(1) The Commission must produce and publish guidance about the steps that may be taken where an individual considers that a media organisation is failing or…

Review of processing of personal data for the purposes of journalism

(1) The Commission must— (a) review the extent to which, during each review period, the processing of personal data for the purposes of journalism complied…

Effectiveness of the media's dispute resolution procedures

(1) The Secretary of State must, before the end of each review period, lay before Parliament a report produced by the Secretary of State or an appropriate…

Jurisdiction

and court procedure — s. 180 — Jurisdiction (1) The jurisdiction conferred on a court by the provisions listed in subsection (2) is exercisable— (a) in England…

Procedure in connection with subject access requests

(1) This section applies where a court is required to determine whether a data subject is entitled to information by virtue of a right under— (a) Article 15 of…

Interpretation of Part 6

In this Part— “assessment notice” has the meaning given in section 146; “certification provider” has the meaning given in section 17; “enforcement notice” has…

Regulations and consultation

(1) Regulations under this Act are to be made by statutory instrument. (2) Before making regulations under this Act, the Secretary of State must consult— (a)…

Power to reflect changes to the Data Protection Convention

(1) The Secretary of State may by regulations make such provision as the Secretary of State considers necessary or appropriate in connection with an amendment…

Protection of prohibitions and restrictions etc on processing: relevant enactments

(1) A relevant enactment or rule of law which imposes a duty, or confers a power, to process personal data does not override a requirement under the main data…

Protection of prohibitions and restrictions etc on processing: other enactments

(1) This section is about the relationship between— (a) a pre-commencement enactment which imposes a duty, or confers a power, to process personal data, and…

Prohibition of requirement to produce relevant records

(1) It is an offence for a person (“P1”) to require another person to provide P1 with, or give P1 access to, a relevant record in connection with— (a) the…

Avoidance of certain contractual terms relating to health records

(1) A term or condition of a contract is void in so far as it purports to require an individual to supply another person with a record which— (a) consists of…

Protection of data subject’s rights

(1) An enactment or rule of law prohibiting or restricting the disclosure of information, or authorising the withholding of information, does not remove or…

Protection of data subject’s rights: further provision

(1) This section is about the relationship between— (a) a pre-commencement enactment which prohibits or restricts the disclosure of information or authorises…

Representation of data subjects with their authority

(1) In relation to the processing of personal data to which the UK GDPR applies, Article 80(1) of the UK GDPR (representation of data subjects)— (a)…

Representation of data subjects with their authority: collective proceedings

(1) The Secretary of State may by regulations make provision for representative bodies to bring proceedings before a court or tribunal in England and Wales or…

Duty to review provision for representation of data subjects

(1) Before the end of the review period, the Secretary of State must— (a) review the matters listed in subsection (2) in relation to England and Wales and…

Post-review powers to make provision about representation of data subjects

(1) After the report under section 189(1) is laid before Parliament, the Secretary of State may by regulations— (a) exercise the powers under Article 80(2) of…

Framework for Data Processing by Government

— s. 191 — Framework for Data Processing by Government (1) The Secretary of State may prepare a document, called the Framework for Data Processing by…

Approval of the Framework

(1) Before issuing a document prepared under section 191, the Secretary of State must lay it before Parliament. (2) If, within the 40-day period, either House…

Publication and review of the Framework

(1) The Secretary of State must publish a document issued under section 192(3). (2) Where an amendment of a document is issued under section 192(3), the…

Effect of the Framework

(1) When carrying out processing of personal data which is the subject of a document issued under section 192(3) which is for the time being in force, a person…

Reserve forces: data-sharing by HMRC

(1) The Reserve Forces Act 1996 is amended as follows. (2) After section 125 insert— Supply of contact details by HMRC 125A (1) This subsection applies to…

Penalties for offences

(1) A person who commits an offence under section 119 or 173 or paragraph 15 of Schedule 15 is liable— (a) on summary conviction in England and Wales, to a…

Prosecution

(1) In England and Wales, proceedings for an offence under this Act may be instituted only— (a) by the Commission, or (b) by or with the consent of the…

Liability of directors etc

(1) Subsection (2) applies where— (a) an offence under this Act has been committed by a body corporate, and (b) it is proved to have been committed with the…

Recordable offences

(1) … (2) Regulations under section 27(4) of the Police and Criminal Evidence Act 1984 (recordable offences) may repeal subsection (1).

Guidance about PACE codes of practice

(1) The Commission must produce and publish guidance about how the Commission proposes to perform the duty under section 67(9) of the Police and Criminal…

Disclosure of information to the Tribunal

(1) No enactment or rule of law prohibiting or restricting the disclosure of information precludes a person from providing the First-tier Tribunal or the Upper…

Proceedings in the First-tier Tribunal: contempt

(1) This section applies where— (a) a person does something, or fails to do something, in relation to proceedings before the First-tier Tribunal— (i) on an…

Tribunal Procedure Rules

(1) Tribunal Procedure Rules may make provision for regulating— (a) the exercise of the rights of appeal conferred by section 27, 79, 82E, 111 or 162, and (b)…

Meaning of “health professional” and “social work professional”

(1) In this Act, “health professional” means any of the following— (a) a registered medical practitioner; (b) a registered nurse or midwife; (c) a registered…

General interpretation

(1) In this Act— “biometric data” means personal data resulting from specific technical processing relating to the physical, physiological or behavioural…

Index of defined expressions

The Table below lists provisions which define or otherwise explain terms defined for this Act, for a Part of this Act or for Chapter 2 or 3 of Part 2 of this…

Territorial application of this Act

(1) This Act applies only to processing of personal data described in subsections (1A) and (2). (1A) In the case of the processing of personal data to which…

Children in Scotland

(1) Subsections (2) and (3) apply where a question falls to be determined in Scotland as to the legal capacity of a person aged under 16 to— (a) exercise a…

Application to the Crown

(1) This Act binds the Crown. (2) For the purposes of the UK GDPR and this Act, each government department is to be treated as a person separate from the other…

Application to Parliament

(1) Parts 1, 2 and 5 to 7 of this Act apply to the processing of personal data by or on behalf of either House of Parliament. (2) Where the purposes for which…

Minor and consequential provision

(1) In Schedule 19— (a) Part 1 contains minor and consequential amendments of primary legislation; (b) Part 2 contains minor and consequential amendments of…

Commencement

(1) Except as provided by subsections (2) and (3), this Act comes into force on such day as the Secretary of State may by regulations appoint. (2) This section…

Transitional provision

(1) Schedule 20 contains transitional, transitory and saving provision. (2) The Secretary of State may by regulations make transitional, transitory or saving…

Extent

(1) This Act extends to England and Wales, Scotland and Northern Ireland, subject to— (a) subsections (2) to (5), ... (b) … (2) Section 199 extends to England…

Short title

This Act may be cited as the Data Protection Act 2018.

Sch. 1 para. 1

(1) This condition is met if— (a) the processing is necessary for the purposes of performing or exercising obligations or rights which are imposed or conferred…

Sch. 1 para. 2

(1) This condition is met if the processing is necessary for health or social care purposes. (2) In this paragraph “health or social care purposes” means the…

Sch. 1 para. 3

This condition is met if the processing— (a) is necessary for reasons of public interest in the area of public health, and (b) is carried out— (i) by or under…

Sch. 1 para. 4

This condition is met if the processing— (a) is necessary for archiving purposes, scientific or historical research purposes or statistical purposes, (b) is…

Sch. 1 para. 5

(1) Except as otherwise provided, a condition in this Part of this Schedule is met only if, when the processing is carried out, the controller has an…

Sch. 1 para. 6

(1) This condition is met if the processing— (a) is necessary for a purpose listed in sub-paragraph (2), and (b) is necessary for reasons of substantial public…

Sch. 1 para. 7

This condition is met if the processing is necessary— (a) for the administration of justice, or (b) for the exercise of a function of either House of…

Sch. 1 para. 8

(1) This condition is met if the processing— (a) is of a specified category of personal data, and (b) is necessary for the purposes of identifying or keeping…

Sch. 1 para. 9

(1) This condition is met if the processing— (a) is of personal data revealing racial or ethnic origin, (b) is carried out as part of a process of identifying…

Sch. 1 para. 10

(1) This condition is met if the processing— (a) is necessary for the purposes of the prevention, investigation or detection of an unlawful act, (b) must be…

Sch. 1 para. 11

(1) This condition is met if the processing— (a) is necessary for the exercise of a protective function, (b) must be carried out without the consent of the…

Sch. 1 para. 12

(1) This condition is met if— (a) the processing is necessary for the purposes of complying with, or assisting other persons to comply with, a regulatory…

Sch. 1 para. 13

(1) This condition is met if— (a) the processing consists of, or is carried out in preparation for, the disclosure of personal data for the special purposes…

Sch. 1 para. 14

(1) This condition is met if the processing— (a) is necessary for the purposes of preventing fraud or a particular kind of fraud, and (b) consists of— (i) the…

Sch. 1 para. 15

This condition is met if the processing is necessary for the purposes of making a disclosure in good faith under either of the following— (a) section 21CA of…

Sch. 1 para. 16

(1) This condition is met if the processing— (a) is carried out by a not-for-profit body which provides support to individuals with a particular disability or…

Sch. 1 para. 17

(1) This condition is met if the processing— (a) is necessary for the provision of confidential counselling, advice or support or of another similar service…

Sch. 1 para. 18

(1) This condition is met if— (a) the processing is necessary for the purposes of— (i) protecting an individual from neglect or physical, mental or emotional…

Sch. 1 para. 19

(1) This condition is met if the processing— (a) is necessary for the purposes of protecting the economic well-being of an individual at economic risk who is…

Sch. 1 para. 20

(1) This condition is met if the processing— (a) is necessary for an insurance purpose, (b) is of personal data revealing racial or ethnic origin, religious or…

Sch. 1 para. 21

(1) This condition is met if the processing— (a) is necessary for the purpose of making a determination in connection with eligibility for, or benefits payable…

Sch. 1 para. 22

(1) This condition is met if the processing— (a) is of personal data revealing political opinions, (b) is carried out by a person or organisation included in…

Sch. 1 para. 23

(1) This condition is met if— (a) the processing is carried out— (i) by an elected representative or a person acting with the authority of such a…

Sch. 1 para. 24

(1) This condition is met if— (a) the processing consists of, or is carried out in preparation for, the disclosure of personal data— (i) to an elected…

Sch. 1 para. 25

(1) This condition is met if— (a) the processing consists of the processing of personal data about a prisoner for the purpose of informing a member of the…

Sch. 1 para. 26

This condition is met if the processing— (a) consists of the publication of a judgment or other decision of a court or tribunal, or (b) is necessary for the…

Sch. 1 para. 27

(1) This condition is met if the processing is necessary— (a) for the purposes of measures designed to eliminate doping which are undertaken by or under the…

Sch. 1 para. 28

(1) This condition is met if the processing— (a) is necessary for the purposes of measures designed to protect the integrity of a sport or a sporting event…

Sch. 1 para. 29

This condition is met if the data subject has given consent to the processing.

Sch. 1 para. 30

This condition is met if— (a) the processing is necessary to protect the vital interests of an individual, and (b) the data subject is physically or legally…

Sch. 1 para. 31

This condition is met if the processing is carried out— (a) in the course of its legitimate activities with appropriate safeguards by a foundation, association…

Sch. 1 para. 32

This condition is met if the processing relates to personal data which is manifestly made public by the data subject.

Sch. 1 para. 33

This condition is met if the processing— (a) is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal…

Sch. 1 para. 34

This condition is met if the processing is necessary when a court or tribunal is acting in its judicial capacity.

Sch. 1 para. 35

(1) This condition is met if— (a) the processing is of personal data about a conviction or caution for an offence listed in sub-paragraph (2), (b) the…

Sch. 1 para. 36

This condition is met if the processing would meet a condition in Part 2 of this Schedule but for an express requirement for the processing to be necessary for…

Sch. 1 para. 37

This condition is met if the processing— (a) would meet the condition in paragraph 20 in Part 2 of this Schedule (the “insurance condition”), or (b) would meet…

Sch. 1 para. 38

This Part of this Schedule makes provision about the processing of personal data carried out in reliance on a condition in Part 1, 2 or 3 of this Schedule…

Sch. 1 para. 39

The controller has an appropriate policy document in place in relation to the processing of personal data in reliance on a condition described in paragraph 38…

Sch. 1 para. 40

(1) Where personal data is processed in reliance on a condition described in paragraph 38, the controller must during the relevant period— (a) retain the…

Sch. 1 para. 41

A record maintained by the controller, or the controller's representative, under Article 30 of the UK GDPR in respect of the processing of personal data in…

Sch. 2 para. 1

In this Part of this Schedule, “the listed GDPR provisions” means— (a) the following provisions of the UK GDPR (the rights and obligations in which may be…

Sch. 2 para. 2

(1) The listed GDPR provisions and Article 34(1) and (4) of the UK GDPR (communication of personal data breach to the data subject) do not apply to personal…

Sch. 2 para. 3

(1) The UK GDPR provisions listed in sub-paragraph (3) do not apply to personal data which consists of a classification applied to the data subject as part of…

Sch. 2 para. 4

(1) The relevant UK GDPR provisions do not apply to personal data processed by the Secretary of State for any of the following purposes— (a) the maintenance of…

Sch. 2 para. 4A

(1) A decision under paragraph 4(1) as to whether, and the extent to which, the application of the relevant UK GDPR provisions would be likely to prejudice any…

Sch. 2 para. 4B

(1) Where the Secretary of State makes a decision mentioned in paragraph 4A(4), the Secretary of State must keep a record of it and the reasons for it. (2)…

Sch. 2 para. 5

(1) The listed GDPR provisions do not apply to personal data consisting of information that the controller is obliged by an enactment to make available to the…

Sch. 2 para. 6

In this Part of this Schedule, “the listed GDPR provisions” means the following provisions of the UK GDPR (the rights and obligations in which may be…

Sch. 2 para. 7

The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a function that— (a) is designed as described in column 1 of…

Sch. 2 para. 8

(1) The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a function listed in sub-paragraph (2) to the extent…

Sch. 2 para. 9

(1) The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a relevant function of the Bank of England to the extent…

Sch. 2 para. 10

(1) The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a function listed in sub-paragraph (2) to the extent…

Sch. 2 para. 11

The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a function that— (a) is a function of a person described in…

Sch. 2 para. 12

In the Table in paragraph 11— ... ... the “Financial Ombudsman” means the scheme operator within the meaning of Part 16 of the Financial Services and Markets…

Sch. 2 para. 13

The listed GDPR provisions and Article 34(1) and (4) of the UK GDPR (communication of personal data breach to the data subject) do not apply to personal data…

Sch. 2 para. 14

(1) The listed GDPR provisions do not apply to personal data processed for the purposes of assessing a person's suitability for judicial office or the office…

Sch. 2 para. 15

(1) The listed GDPR provisions do not apply to personal data processed for the purposes of the conferring by the Crown of any honour or dignity. (2) The listed…

Sch. 2 para. 16

(1) Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers), and Article 5 of the UK GDPR…

Sch. 2 para. 17

(1) For the purposes of paragraph 16(2)(b), it is to be considered reasonable for a controller to disclose information to a data subject without the consent of…

Sch. 2 para. 18

In this Part of this Schedule, “the listed GDPR provisions” means the following provisions of the UK GDPR (the rights and obligations in which may be…

Sch. 2 para. 19

The listed GDPR provisions do not apply to personal data that consists of— (a) information in respect of which a claim to legal professional privilege or, in…

Sch. 2 para. 20

(1) A person need not comply with the listed GDPR provisions to the extent that compliance would, by revealing evidence of the commission of an offence, expose…

Sch. 2 para. 21

(1) The listed GDPR provisions do not apply to personal data processed for the purposes of or in connection with a corporate finance service provided by a…

Sch. 2 para. 22

The listed GDPR provisions do not apply to personal data processed for the purposes of management forecasting or management planning in relation to a business…

Sch. 2 para. 23

The listed GDPR provisions do not apply to personal data that consists of records of the intentions of the controller in relation to any negotiations with the…

Sch. 2 para. 24

The listed GDPR provisions do not apply to personal data consisting of a reference given (or to be given) in confidence for the purposes of— (a) the education…

Sch. 2 para. 25

(1) The listed GDPR provisions do not apply to personal data consisting of information recorded by candidates during an exam. (2) Where personal data consists…

Sch. 2 para. 26

(1) In this paragraph, “the special purposes” means one or more of the following— (a) the purposes of journalism; (b) academic purposes; (c) artistic purposes…

Sch. 2 para. 27

(1) The listed GDPR provisions do not apply to personal data processed for— (a) scientific or historical research purposes, or (b) statistical purposes, to the…

Sch. 2 para. 28

(1) The listed GDPR provisions do not apply to personal data processed for archiving purposes in the public interest to the extent that the application of…

Sch. 3 para. 1

In this Schedule “the listed GDPR provisions” means the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of…

Sch. 3 para. 2

(1) In this Part of this Schedule— “the appropriate health professional”, in relation to a question as to whether the serious harm test is met with respect to…

Sch. 3 para. 3

(1) The listed GDPR provisions do not apply to data concerning health if— (a) it is processed by a court, (b) it consists of information supplied in a report…

Sch. 3 para. 4

(1) This paragraph applies where a request for data concerning health is made in exercise of a power conferred by an enactment or rule of law and— (a) in…

Sch. 3 para. 5

(1) Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not apply to data concerning…

Sch. 3 para. 6

(1) Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not permit the disclosure of…

Sch. 3 para. 7

(1) In this Part of this Schedule— “education data” has the meaning given by paragraph 17 of this Schedule; “Health and Social Care trust” means a Health and…

Sch. 3 para. 8

(1) This paragraph applies to personal data falling within any of the following descriptions— (a) data processed by a local authority— (i) in connection with…

Sch. 3 para. 9

(1) The listed GDPR provisions do not apply to data that is not education data or data concerning health if— (a) it is processed by a court, (b) it consists of…

Sch. 3 para. 10

(1) This paragraph applies where a request for social work data is made in exercise of a power conferred by an enactment or rule of law and— (a) in relation to…

Sch. 3 para. 11

Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not apply to social work data to…

Sch. 3 para. 12

(1) This paragraph applies where— (a) a question arises as to whether a controller who is a social work authority is obliged by Article 15(1) to (3) of the UK…

Sch. 3 para. 13

In this Part of this Schedule “educational record” means a record to which paragraph 14, 15 or 16 applies.

Sch. 3 para. 14

(1) This paragraph applies to a record of information which— (a) is processed by or on behalf of the proprietor of, or a teacher at, a school in England and…

Sch. 3 para. 15

(1) This paragraph applies to a record of information which is processed— (a) by an education authority in Scotland, and (b) for the purpose of the relevant…

Sch. 3 para. 16

(1) This paragraph applies to a record of information which— (a) is processed by or on behalf of the Board of Governors, proprietor or trustees of, or a…

Sch. 3 para. 17

(1) In this Part of this Schedule— “education authority” and “further education” have the same meaning as in the Education (Scotland) Act 1980; “education…

Sch. 3 para. 18

(1) The listed GDPR provisions do not apply to education data if— (a) it is processed by a court, (b) it consists of information supplied in a report or other…

Sch. 3 para. 19

Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not apply to education data to…

Sch. 3 para. 20

(1) This paragraph applies where— (a) a question arises as to whether a controller who is an education authority is obliged by Article 15(1) to (3) of the UK…

Sch. 3 para. 21

(1) This paragraph applies where a request for child abuse data is made in exercise of a power conferred by an enactment or rule of law and— (a) the data…

Sch. 4 para. 1

In this Schedule “the listed GDPR provisions” means the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of…

Sch. 4 para. 2

The listed GDPR provisions do not apply to personal data consisting of information the disclosure of which is prohibited or restricted by any of sections 31…

Sch. 4 para. 3

(1) The listed GDPR provisions do not apply to personal data consisting of information the disclosure of which is prohibited or restricted by an enactment…

Sch. 4 para. 4

(1) The listed GDPR provisions do not apply to personal data consisting of information the disclosure of which is prohibited or restricted by an enactment…

Sch. 4 para. 5

(1) The listed GDPR provisions do not apply to personal data consisting of information the disclosure of which is prohibited or restricted by an enactment…

Sch. 4 para. 6

The listed GDPR provisions do not apply to personal data consisting of information the disclosure of which is prohibited or restricted by any of the following…

Sch. 5 para. 1

(1) This Schedule applies where— (a) a person (“the applicant”) applies to an accreditation authority for accreditation as a certification provider, and (b) is…

Sch. 5 para. 2

(1) The applicant may ask the accreditation authority to review the decision. (2) The request must be made in writing before the end of the period of 28 days…

Sch. 5 para. 3

(1) If the applicant is dissatisfied with the decision on the review under paragraph 2, the applicant may ask the accreditation authority to refer the decision…

Sch. 5 para. 4

(1) If the applicant makes a request in accordance with paragraph 3, an appeal panel must be established in accordance with this paragraph. (2) An appeal panel…

Sch. 5 para. 5

(1) If the appeal panel considers it necessary, a hearing must be held at which both the applicant and the accreditation authority may be represented. (2) Any…

Sch. 5 para. 6

(1) The appeal panel must, before the end of the period of 28 days beginning with the day on which the appeal panel is established in accordance with paragraph…

Sch. 5 para. 7

In this Schedule, “working day” means any day other than— (a) Saturday or Sunday, (b) Christmas Day or Good Friday, or (c) a day which is a bank holiday under…

Sch. 7 para. 1

Any United Kingdom government department other than a non-ministerial government department.

Sch. 7 para. 2

The Scottish Ministers.

Sch. 7 para. 3

Any Northern Ireland department.

Sch. 7 para. 4

The Welsh Ministers.

Sch. 7 para. 5

The chief constable of a police force maintained under section 2 of the Police Act 1996.

Sch. 7 para. 6

The Commissioner of Police of the Metropolis.

Sch. 7 para. 7

The Commissioner of Police for the City of London.

Sch. 7 para. 8

The Chief Constable of the Police Service of Northern Ireland.

Sch. 7 para. 9

The chief constable of the Police Service of Scotland.

Sch. 7 para. 10

The chief constable of the British Transport Police.

Sch. 7 para. 11

The chief constable of the Civil Nuclear Constabulary.

Sch. 7 para. 12

The chief constable of the Ministry of Defence Police.

Sch. 7 para. 13

The Provost Marshal of the Royal Navy Police.

Sch. 7 para. 14

The Provost Marshal of the Royal Military Police.

Sch. 7 para. 15

The Provost Marshal of the Royal Air Force Police.

Sch. 7 para. 15A

The Provost Marshal for serious crime.

Sch. 7 para. 16

The chief officer of— (a) a body of constables appointed under provision incorporating section 79 of the Harbours, Docks, and Piers Clauses Act 1847; (b) a…

Sch. 7 para. 17

A body established in accordance with a collaboration agreement under section 22A of the Police Act 1996.

Sch. 7 para. 18

The Director General of the Independent Office for Police Conduct.

Sch. 7 para. 18A

The Service Police Complaints Commissioner.

Sch. 7 para. 19

The Police Investigations and Review Commissioner.

Sch. 7 para. 20

The Police Ombudsman for Northern Ireland.

Sch. 7 para. 21

The Commissioners for Her Majesty's Revenue and Customs.

Sch. 7 para. 22

The Welsh Revenue Authority.

Sch. 7 para. 23

Revenue Scotland.

Sch. 7 para. 24

The Director General of the National Crime Agency.

Sch. 7 para. 25

The Director of the Serious Fraud Office.

Sch. 7 para. 26

The Director of Border Revenue.

Sch. 7 para. 27

The Financial Conduct Authority.

Sch. 7 para. 28

The Health and Safety Executive.

Sch. 7 para. 29

The Competition and Markets Authority.

Sch. 7 para. 30

The Gas and Electricity Markets Authority.

Sch. 7 para. 31

The Food Standards Agency.

Sch. 7 para. 32

Food Standards Scotland.

Sch. 7 para. 33

Her Majesty's Land Registry.

Sch. 7 para. 34

The Criminal Cases Review Commission.

Sch. 7 para. 35

The Scottish Criminal Cases Review Commission.

Sch. 7 para. 36

A provider of probation services (other than the Secretary of State), acting in pursuance of arrangements made under section 3(2) of the Offender Management…

Sch. 7 para. 37

The Youth Justice Board for England and Wales.

Sch. 7 para. 38

The Parole Board for England and Wales.

Sch. 7 para. 39

The Parole Board for Scotland.

Sch. 7 para. 40

The Parole Commissioners for Northern Ireland.

Sch. 7 para. 41

The Probation Board for Northern Ireland.

Sch. 7 para. 42

The Prisoner Ombudsman for Northern Ireland.

Sch. 7 para. 43

A person who has entered into a contract for the running of, or part of— (a) a prison or young offender institution under section 84 of the Criminal Justice…

Sch. 7 para. 44

A person who has entered into a contract with the Secretary of State— (a) under section 80 of the Criminal Justice Act 1991 for the purposes of prisoner escort…

Sch. 7 para. 45

A person who is, under or by virtue of any enactment, responsible for securing the electronic monitoring of an individual.

Sch. 7 para. 46

A youth offending team established under section 39 of the Crime and Disorder Act 1998.

Sch. 7 para. 47

The Director of Public Prosecutions.

Sch. 7 para. 48

The Director of Public Prosecutions for Northern Ireland.

Sch. 7 para. 49

The Lord Advocate.

Sch. 7 para. 50

A Procurator Fiscal.

Sch. 7 para. 51

The Director of Service Prosecutions.

Sch. 7 para. 51A

The Information Commission.

Sch. 7 para. 53

The Scottish Information Commissioner.

Sch. 7 para. 54

The Scottish Courts and Tribunal Service.

Sch. 7 para. 55

The Crown agent.

Sch. 7 para. 56

A court or tribunal.

Sch. 7 para. 57

The Border Security Commander.

Sch. 8 para. 1

This condition is met if the processing— (a) is necessary for the exercise of a function conferred on a person by an enactment or rule of law, and (b) is…

Sch. 8 para. 2

This condition is met if the processing is necessary for the administration of justice.

Sch. 8 para. 3

This condition is met if the processing is necessary to protect the vital interests of the data subject or of another individual.

Sch. 8 para. 4

(1) This condition is met if— (a) the processing is necessary for the purposes of— (i) protecting an individual from neglect or physical, mental or emotional…

Sch. 8 para. 5

This condition is met if the processing relates to personal data which is manifestly made public by the data subject.

Sch. 8 para. 6

This condition is met if the processing— (a) is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal…

Sch. 8 para. 7

This condition is met if the processing is necessary when a court or other judicial authority is acting in its judicial capacity.

Sch. 8 para. 8

(1) This condition is met if the processing— (a) is necessary for the purposes of preventing fraud or a particular kind of fraud, and (b) consists of— (i) the…

Sch. 8 para. 9

This condition is met if the processing is necessary— (a) for archiving purposes in the public interest, (b) for scientific or historical research purposes, or…

Sch. 9 para. 1

The data subject has given consent to the processing.

Sch. 9 para. 2

The processing is necessary— (a) for the performance of a contract to which the data subject is a party, or (b) in order to take steps at the request of the…

Sch. 9 para. 3

The processing is necessary for compliance with a legal obligation to which the controller is subject, other than an obligation imposed by contract.

Sch. 9 para. 4

The processing is necessary in order to protect the vital interests of the data subject or of another individual.

Sch. 9 para. 5

The processing is necessary— (a) for the administration of justice, (b) for the exercise of any functions of either House of Parliament, (c) for the exercise…

Sch. 9 para. 6

(1) The processing is necessary for the purposes of legitimate interests pursued by— (a) the controller, or (b) the third party or parties to whom the data is…

Sch. 10 para. 1

The data subject has given consent to the processing.

Sch. 10 para. 2

The processing is necessary for the purposes of exercising or performing any right or obligation which is conferred or imposed by an enactment or rule of law…

Sch. 10 para. 3

The processing is necessary— (a) in order to protect the vital interests of the data subject or of another person, in a case where— (i) consent cannot be given…

Sch. 10 para. 4

(1) This condition is met if— (a) the processing is necessary for the purposes of— (i) protecting an individual from neglect or physical, mental or emotional…

Sch. 10 para. 5

The information contained in the personal data has been made public as a result of steps deliberately taken by the data subject.

Sch. 10 para. 6

The processing— (a) is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings), (b) is necessary…

Sch. 10 para. 7

The processing is necessary— (a) for the administration of justice, (b) for the exercise of any functions of either House of Parliament, (c) for the exercise…

Sch. 10 para. 8

(1) The processing is necessary for medical purposes and is undertaken by— (a) a health professional, or (b) a person who in the circumstances owes a duty of…

Sch. 10 para. 9

(1) The processing— (a) is of sensitive personal data consisting of information as to racial or ethnic origin, (b) is necessary for the purpose of identifying…

Sch. 11 para. 1

In this Schedule, “the listed provisions” means— (a) Chapter 2 of Part 4 (the data protection principles), except section 86(1)(a) and (2) and Schedules 9 and…

Sch. 11 para. 2

The listed provisions do not apply to personal data processed for any of the following purposes— (a) the prevention, investigation and detection of crime, or…

Sch. 11 para. 3

(1) The listed provisions do not apply to personal data consisting of information that the controller is obliged by an enactment to make available to the…

Sch. 11 para. 4

The listed provisions do not apply to personal data where this is required for the purpose of avoiding an infringement of the privileges of either House of…

Sch. 11 para. 5

The listed provisions do not apply to personal data to the extent that the application of the listed provisions would be likely to prejudice judicial…

Sch. 11 para. 6

The listed provisions do not apply to personal data processed for the purposes of the conferring by the Crown of any honour or dignity.

Sch. 11 para. 7

The listed provisions do not apply to personal data to the extent that the application of the listed provisions would be likely to prejudice the combat…

Sch. 11 para. 8

The listed provisions do not apply to personal data to the extent that the application of the listed provisions would be likely to prejudice the economic…

Sch. 11 para. 9

The listed provisions do not apply to personal data that consists of— (a) information in respect of which a claim to legal professional privilege or, in…

Sch. 11 para. 10

The listed provisions do not apply to personal data that consists of records of the intentions of the controller in relation to any negotiations with the data…

Sch. 11 para. 11

The listed provisions do not apply to personal data consisting of a reference given (or to be given) in confidence by the controller for the purposes of— (a)…

Sch. 11 para. 12

(1) The listed provisions do not apply to personal data consisting of information recorded by candidates during an exam. (2) Where personal data consists of…

Sch. 11 para. 13

(1) The listed provisions do not apply to personal data processed for— (a) scientific or historical research purposes, or (b) statistical purposes, to the…

Sch. 11 para. 14

(1) The listed provisions do not apply to personal data processed for archiving purposes in the public interest to the extent that the application of those…

Status

(1) The Commission is not to be regarded— (a) as a servant or agent of the Crown, or (b) as enjoying any status, immunity or privilege of the Crown. (2) The…

Number of members

(1) The number of members of the Commission is to be determined by the Secretary of State. (2) That number must not be— (a) less than 3, or (b) more than 14…

Membership: general

(1) The Commission is to consist of— (a) the non-executive members, and (b) the executive members. (2) The non-executive members are— (a) a chair appointed by…

Membership: non-executive members to outnumber executive members

The Secretary of State must exercise the powers conferred on the Secretary of State by paragraphs 2 and 3 so as to secure that the number of non-executive…

Membership: selection on merit etc

(1) The Secretary of State may not recommend a person for appointment as the chair of the Commission unless the person has been selected on merit on the basis…

Membership: conflicts of interests

(1) Before— (a) recommending a person for appointment as the chair of the Commission, or (b) appointing a person as a non-executive member of the Commission…

Tenure of the chair

(1) The chair of the Commission holds and vacates office in accordance with the terms of the chair’s appointment, subject to the provisions of this paragraph…

Tenure of deputy chair

(1) A deputy chair of the Commission may resign that office by giving written notice to the Commission. (2) A deputy chair of the Commission ceases to hold…

Tenure of the other non-executive members

(1) This paragraph applies to a non-executive member of the Commission appointed by the Secretary of State. (2) The member holds and vacates office in…

Remuneration and pensions of non-executive members

(1) The Commission may pay to the non-executive members of the Commission such remuneration and allowances as the Secretary of State may determine. (2) The…

Executive members: terms and conditions

(1) The executive members of the Commission are to be employees of the Commission. (2) The executive members are to be employed by the Commission on such terms…

Other staff: appointment, terms and conditions

(1) The Commission may— (a) appoint other employees, and (b) make such other arrangements for the staffing of the Commission as it considers appropriate. (2)…

Committees

(1) The Commission may establish committees. (2) A committee of the Commission may consist of or include persons who are neither members nor employees of the…

Delegation of functions

(1) The Commission may delegate any of its functions to— (a) a member of the Commission, (b) an employee of the Commission, or (c) a committee of the…

Advice from committees

The Commission may require a committee of the Commission to give the Commission advice about matters relating to the discharge of the Commission’s functions.

Proceedings

(1) The Commission may make arrangements for regulating— (a) its own procedure, and (b) the procedure of a committee of the Commission. (2) The non-executive…

Records of proceedings

The Commission must make arrangements for the keeping of proper records of— (a) its proceedings, (b) the proceedings of a committee of the Commission, (c) the…

Disqualification for acting in relation to certain matters

(1) This paragraph applies if— (a) a member of the Commission has a direct or indirect interest in a matter falling to be considered at a meeting of the…

Validity of proceedings

(1) The validity of proceedings of the Commission, of the non-executive members of the Commission or of a committee of the Commission is not affected by— (a) a…

Money

The Secretary of State may make payments to the Commission.

Fees etc and other sums

(1) All fees, charges, penalties and other sums received by the Commission in carrying out its functions are to be paid to the Secretary of State. (2)…

Accounts

(1) The Commission must keep proper accounts and proper records in relation to them. (2) The Commission must prepare a statement of accounts in respect of each…

Authentication of seal and presumption of authenticity of documents

(1) The application of the Commission’s seal must be authenticated by the signature of— (a) the chair of the Commission, or (b) another person authorised for…

Supplementary powers

The Commission may do anything it thinks appropriate for the purposes of, or in connection with, its functions.

Transitional provision: interim chief executive

(1) The first chief executive of the Commission is to be appointed by the chair of the Commission. (2) Before making the appointment the chair must consult the…

Interpretation

In this Schedule— (a) references to pensions, allowances or gratuities include references to any similar benefits provided on death or retirement, and (b)…

Sch. 13 para. 1

(1) The Commission must— (a) monitor and enforce Parts 3 and 4 of this Act; (b) promote public awareness and understanding of the risks, rules, safeguards and…

Sch. 13 para. 2

The Commission has the following investigative, corrective, authorisation and advisory powers in relation to processing of personal data to which Part 3 or 4…

Sch. 13 para. 3

In this Schedule— “foreign designated authority” means an authority designated for the purposes of Article 13 of the Data Protection Convention by a party…

Sch. 14 para. 6

(1) The Commission must, at the request of a foreign designated authority— (a) provide that authority with such information referred to in Article 13(3)(a) of…

Sch. 14 para. 7

(1) This paragraph applies where a request for assistance in exercising any of the rights referred to in Article 8 of the Data Protection Convention in the…

Sch. 14 para. 8

(1) This paragraph applies where a request for assistance in exercising any of the rights referred to in Article 8 of the Data Protection Convention in a…

Sch. 14 para. 9

Where the Commission receives information from a foreign designated authority as a result of— (a) a request made by the Commission under paragraph 6(2), or (b)…

Sch. 14 para. 10

In this Part of this Schedule, “foreign designated authority” means an authority designated for the purposes of Article 13 of the Data Protection Convention by…

Sch. 15 para. 1

(1) This paragraph applies if a judge of the High Court, a circuit judge or a District Judge (Magistrates' Courts) is satisfied by information on oath supplied…

Sch. 15 para. 2

(1) This paragraph applies if a judge of the High Court, a circuit judge or a District Judge (Magistrates' Courts) is satisfied by information on oath supplied…

Sch. 15 para. 3

A judge must not issue a warrant under this Schedule in respect of personal data processed for the special purposes unless a determination under section 174…

Sch. 15 para. 4

(1) A judge must not issue a warrant under this Schedule unless satisfied that— (a) the conditions in sub-paragraphs (2) to (4) are met, (b) compliance with…

Sch. 15 para. 5

(1) A warrant issued under this Schedule must authorise any of the Commission’s officers or staff— (a) to enter the premises, (b) to search the premises, and…

Sch. 15 para. 6

A judge who issues a warrant under this Schedule must— (a) issue two copies of it, and (b) certify them clearly as copies.

Sch. 15 para. 7

A person executing a warrant issued under this Schedule may use such reasonable force as may be necessary.

Sch. 15 para. 8

A warrant issued under this Schedule may be executed only at a reasonable hour, unless it appears to the person executing it that there are grounds for…

Sch. 15 para. 9

(1) If an occupier of the premises in respect of which a warrant is issued under this Schedule is present when the warrant is executed, the person executing…

Sch. 15 para. 10

(1) This paragraph applies where a person executing a warrant under this Schedule seizes something. (2) The person must, on request— (a) give a receipt for it…

Sch. 15 para. 11

(1) The powers of inspection and seizure conferred by a warrant issued under this Schedule are not exercisable in respect of a communication which is made— (a)…

Sch. 15 para. 12

The powers of inspection and seizure conferred by a warrant issued under this Schedule are not exercisable where their exercise would involve an infringement…

Sch. 15 para. 13

(1) This paragraph applies if a person in occupation of premises in respect of which a warrant is issued under this Schedule objects to the inspection or…

Sch. 15 para. 14

(1) Where a warrant issued under this Schedule is executed— (a) it must be returned to the court from which it was issued after being executed, and (b) the…

Sch. 15 para. 15

(1) It is an offence for a person— (a) intentionally to obstruct a person in the execution of a warrant issued under this Schedule, or (b) to fail without…

Sch. 15 para. 16

(1) An explanation given, or information provided, by a person in response to a requirement under paragraph 5(2)(c) or (d) or (3)(c) or (d) may only be used in…

Sch. 15 para. 17

In this Schedule— (a) “premises” includes a vehicle, vessel or other means of transport, and (b) references to the occupier of premises include the person in…

Sch. 15 para. 18

In the application of this Schedule to Scotland— (a) references to a judge of the High Court have effect as if they were references to a judge of the Court of…

Sch. 15 para. 19

In the application of this Schedule to Northern Ireland— (a) references to a circuit judge have effect as if they were references to a county court judge, and…

Sch. 16 para. 1

In this Schedule, “penalty” means a penalty imposed by a penalty notice.

Sch. 16 para. 2

(1) Before giving a person a penalty notice, the Commission must, by written notice (a “notice of intent”) inform the person that the Commission intends to…

Sch. 16 para. 3

(1) A notice of intent must contain the following information— (a) the name and address of the person to whom the Commission proposes to give a penalty notice…

Sch. 16 para. 4

(A1) This paragraph applies where the Commission gives a notice of intent to a person. (A2) Within the period of 6 months beginning when the notice is given…

Sch. 16 para. 5

(1) A penalty notice must contain the following information— (a) the name and address of the person to whom it is addressed; (b) details of the notice of…

Sch. 16 para. 6

(1) A penalty must be paid to the Commission within the period specified in the penalty notice. (2) The period specified must be a period of not less than 28…

Sch. 16 para. 7

(1) The Commission may vary a penalty notice by giving written notice (a “penalty variation notice”) to the person to whom it was given. (2) A penalty…

Sch. 16 para. 8

(1) The Commission may cancel a penalty notice by giving written notice to the person to whom it was given. (2) If a penalty notice is cancelled, the…

Sch. 16 para. 9

(1) The Commission must not take action to recover a penalty unless— (a) the period specified in accordance with paragraph 6 has ended, (b) any appeals against…

Sch. 17 para. 1

In this Schedule— “relevant period” means— ... the period of 12 months beginning when the Commission starts a ... review under section 178; “the relevant…

Sch. 17 para. 2

(1) This paragraph applies where the Commission gives an information notice during a relevant period. (2) If the information notice— (a) states that, in the…

Sch. 17 para. 3

(1) Sub-paragraph (2) applies where the Commission gives an assessment notice to a person during a relevant period. (2) If the assessment notice— (a) states…

Sch. 17 para. 3A

(1) Sub-paragraph (2) applies where the Commission gives an interview notice to an individual during a relevant period. (2) If the interview notice— (a) states…

Sch. 17 para. 4

Section 164 applies where an information notice, assessment notice or interview notice contains a statement under paragraph 2(2)(a), 3(2)(a) or 3A(2)(a) as it…

Sch. 18 para. 1

(1) In section 184, “relevant record” means— (a) a relevant health record (see paragraph 2), (b) a relevant record relating to a conviction or caution (see…

Sch. 18 para. 2

“Relevant health record” means a health record which has been or is to be obtained by a data subject in the exercise of a data subject access right.

Sch. 18 para. 3

(1) “Relevant record relating to a conviction or caution” means a record which— (a) has been or is to be obtained by a data subject in the exercise of a data…

Sch. 18 para. 4

(1) “Relevant record relating to statutory functions” means a record which— (a) has been or is to be obtained by a data subject in the exercise of a data…

Sch. 18 para. 5

In this Schedule, “data subject access right” means a right under— (a) Article 15 of the UK GDPR (right of access by the data subject); (b) Article 20 of the…

Sch. 18 para. 6

For the purposes of this Schedule, a record which states that a controller is not processing personal data relating to a particular matter is to be taken to be…

Sch. 18 para. 7

(1) The Secretary of State may by regulations amend this Schedule. (2) Regulations under this paragraph are subject to the affirmative resolution procedure.

Sch. 19 para. 1

(1) Section 19AC of the Registration Service Act 1953 (codes of practice) is amended as follows. (2) In subsection (2), for “issued under section 52B…

Sch. 19 para. 2

(1) Section 1A of the Veterinary Surgeons Act 1966 (functions of the Royal College of Veterinary Surgeons as competent authority) is amended as follows. (2) In…

Sch. 19 para. 3

In section 11AA(1) of the Parliamentary Commissioner Act 1967 (disclosure of information by Parliamentary Commissioner to Information Commissioner)— (a) in…

Sch. 19 para. 4

The Local Government Act 1974 is amended as follows.

Sch. 19 para. 5

In section 33A(1) (disclosure of information by Local Commissioner to Information Commissioner)— (a) in paragraph (a), for sub-paragraph (i) substitute— (i)…

Sch. 19 para. 6

In section 34O(1) (disclosure of information by Local Commissioner to Information Commissioner)— (a) in paragraph (a), for sub-paragraph (i) substitute— (i)…

Sch. 19 para. 7

The Consumer Credit Act 1974 is amended as follows.

Sch. 19 para. 8

In section 157(2A) (duty to disclose name etc of agency)— (a) in paragraph (a), for “the Data Protection Act 1998” substitute “ the GDPR ”, and (b) in…

Sch. 19 para. 9

In section 159(1)(a) (correction of wrong information) for “section 7 of the Data Protection Act 1998” substitute “ Article 15(1) to (3) of the GDPR…

Sch. 19 para. 10

In section 189(1) (definitions), at the appropriate place insert— “the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see…

Sch. 19 para. 11

The Pharmacy (Northern Ireland) Order 1976 is amended as follows.

Sch. 19 para. 12

In article 2(2) (interpretation), omit the definition of “Directive 95/46/EC”.

Sch. 19 para. 13

In article 8D (European professional card), after paragraph (3) insert— (4) In Schedule 2C, “the GDPR” means Regulation (EU) 2016/679 of the European…

Sch. 19 para. 14

In article 22A(6) (Directive 2005/36/EC: functions of competent authority etc.), before sub-paragraph (a) insert— (za) “the GDPR” means Regulation (EU)…

Sch. 19 para. 15

(1) Schedule 2C (Directive 2005/36/EC: European professional card) is amended as follows. (2) In paragraph 8(1) (access to data), for “Directive 95/46/EC”…

Sch. 19 para. 16

(1) The table in Schedule 2D (functions of the Society under Directive 2005/36/EC) is amended as follows. (2) In the entry for Article 56(2), in the second…

Sch. 19 para. 17

(1) Paragraph 2 of Schedule 3 (fitness to practice: disclosure of information) is amended as follows. (2) In sub-paragraph (2)(a), after “provision” insert “…

Sch. 19 para. 18

(1) Schedule 2 to the Representation of the People Act 1983 (provisions which may be contained in regulations as to registration etc) is amended as follows…

Sch. 19 para. 19

The Medical Act 1983 is amended as follows.

Sch. 19 para. 20

(1) Section 29E (evidence) is amended as follows. (2) In subsection (5), after “enactment” insert “ or the GDPR ”. (3) For subsection (7) substitute— (7) In…

Sch. 19 para. 21

(1) Section 35A (General Medical Council's power to require disclosure of information) is amended as follows. (2) In subsection (4), after “enactment” insert “…

Sch. 19 para. 22

In section 49B(7) (Directive 2005/36: designation of competent authority etc.), after “Schedule 4A” insert — “the GDPR” means Regulation (EU) 2016/679 of the…

Sch. 19 para. 23

In section 55(1) (interpretation), omit the definition of “Directive 95/46/EC”.

Sch. 19 para. 24

(1) Paragraph 9B of Schedule 1 (incidental powers of the General Medical Council) is amended as follows. (2) In sub-paragraph (2)(a), after “enactment” insert…

Sch. 19 para. 25

(1) Paragraph 5A of Schedule 4 (professional performance assessments and health assessments) is amended as follows. (2) In sub-paragraph (8), after “enactment”…

Sch. 19 para. 26

(1) The table in Schedule 4A (functions of the General Medical Council as competent authority under Directive 2005/36) is amended as follows. (2) In the entry…

Sch. 19 para. 27

The Dentists Act 1984 is amended as follows.

Sch. 19 para. 28

(1) Section 33B (the General Dental Council's power to require disclosure of information: the dental profession) is amended as follows. (2) In subsection (3)…

Sch. 19 para. 29

In section 36ZA(6) (Directive 2005/36: designation of competent authority etc), after “Schedule 4ZA—” insert— “the GDPR” means Regulation (EU) 2016/679 of the…

Sch. 19 para. 30

(1) Section 36Y (the General Dental Council's power to require disclosure of information: professions complementary to dentistry) is amended as follows. (2) In…

Sch. 19 para. 31

In section 53(1) (interpretation), omit the definition of “Directive 95/46/EC”.

Sch. 19 para. 32

(1) The table in Schedule 4ZA (Directive 2005/36: functions of the General Dental Council under section 36ZA(3)) is amended as follows. (2) In the entry for…

Sch. 19 para. 33

In section 449(11) of the Companies Act 1985 (provision for security of information obtained), for “the Data Protection Act 1998” substitute “ the data…

Sch. 19 para. 34

In section 2(1) of the Access to Medical Reports Act 1988 (interpretation), for the definition of “health professional” substitute— “health professional” has…

Sch. 19 para. 35

(1) Section 13B of the Opticians Act 1989 (the Council's power to require disclosure of information) is amended as follows. (2) In subsection (3), after…

Sch. 19 para. 36

The Access to Health Records Act 1990 is amended as follows.

Sch. 19 para. 37

For section 2 substitute— Health professionals 2 In this Act, “health professional” has the same meaning as in the Data Protection Act 2018 (see section 204 of…

Sch. 19 para. 38

(1) Section 3 (right of access to health records) is amended as follows. (2) In subsection (2), omit “Subject to subsection (4) below,”. (3) In subsection (4)…

Sch. 19 para. 39

(1) Section 33D of the Human Fertilisation and Embryology Act 1990 (disclosure for the purposes of medical or other research) is amended as follows. (2) In…

Sch. 19 para. 40

(1) Section 251B of the Trade Union and Labour Relations (Consolidation) Act 1992 (prohibition on disclosure of information) is amended as follows. (2) In…

Sch. 19 para. 41

In the table in Part 1 of Schedule 1 to the Tribunals and Inquiries Act 1992 (tribunals to which the Act applies), in the second column, in paragraph 14(a)…

Sch. 19 para. 42

(1) Article 90B of the Industrial Relations (Northern Ireland) Order 1992 (prohibition on disclosure of information held by the Labour Relations Agency) is…

Sch. 19 para. 43

In section 18A(1) of the Health Service Commissioners Act 1993 (power to disclose information)— (a) in paragraph (a), for sub-paragraph (i) substitute— (i)…

Sch. 19 para. 44

The Data Protection Act 1998 is repealed, with the exception of section 62 and paragraphs 13, 15, 16, 18 and 19 of Schedule 15 (which amend other enactments).

Sch. 19 para. 45

In section 17A(4) of the Crime and Disorder Act 1998 (sharing of information), for “(within the meaning of the Data Protection Act 1998)” substitute “ (within…

Sch. 19 para. 46

(1) Section 19 of the Food Standards Act 1999 (publication etc by the Food Standards Agency of advice and information) is amended as follows. (2) In subsection…

Sch. 19 para. 47

(1) Section 13 of the Immigration and Asylum Act 1999 (proof of identity of persons to be removed or deported) is amended as follows. (2) For subsection (4)…

Sch. 19 para. 48

The Financial Services and Markets Act 2000 is amended as follows.

Sch. 19 para. 50

In section 391A(6)(b) (publication: special provisions relating to the capital requirements directive), for “the Data Protection Act 1998” substitute “ the…

Sch. 19 para. 51

In section 391C(7)(a) (publication: special provisions relating to the UCITS directive), for “the Data Protection Act 1998” substitute “ the data protection…

Sch. 19 para. 52

In section 391D(9)(a) (publication: special provisions relating to the markets in financial instruments directive), for “the Data Protection Act 1998”…

Sch. 19 para. 53

In section 417 (definitions), at the appropriate place insert— “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see…

Sch. 19 para. 54

In section 21F(2)(d) of the Terrorism Act 2000 (other permitted disclosures between institutions etc) for “(within the meaning of section 1 of the Data…

Sch. 19 para. 55

The Freedom of Information Act 2000 is amended as follows.

Sch. 19 para. 56

In section 2(3) (absolute exemptions), for paragraph (f) substitute— (f) section 40(1), (fa) section 40(2) so far as relating to cases where the first…

Sch. 19 para. 57

In section 18 (the Information Commissioner), omit subsection (1).

Sch. 19 para. 58

(1) Section 40 (personal information) is amended as follows. (2) In subsection (2)— (a) in paragraph (a), for “do” substitute “ does ”, and (b) in paragraph…

Sch. 19 para. 59

Omit section 49 (reports to be laid before Parliament).

Sch. 19 para. 60

For section 61 (appeal proceedings) substitute— Appeal proceedings 61 (1) Tribunal Procedure Rules may make provision for regulating the exercise of rights of…

Sch. 19 para. 61

In section 76(1) (disclosure of information between Commissioner and ombudsmen), for “the Data Protection Act 1998” substitute “ the data protection…

Sch. 19 para. 62

After section 76A insert— Disclosure of information to Tribunal 76B (1) No enactment or rule of law prohibiting or restricting the disclosure of information…

Sch. 19 para. 63

In section 77(1)(b) (offence of altering etc records with intent to prevent disclosure), omit “or section 7 of the Data Protection Act 1998,”.

Sch. 19 para. 64

In section 84 (interpretation), at the appropriate place insert— “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see…

Sch. 19 para. 65

(1) Paragraph 28 of Schedule 19C to the Political Parties, Elections and Referendums Act 2000 (civil sanctions: disclosure of information) is amended as…

Sch. 19 para. 66

The Public Finance and Accountability (Scotland) Act 2000 is amended as follows.

Sch. 19 para. 67

In section 26B(3)(a) (voluntary disclosure of data to Audit Scotland), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation…

Sch. 19 para. 68

In section 26C(3)(a) (power to require disclosure of data), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

Sch. 19 para. 69

In section 29(1) (interpretation), at the appropriate place insert— “the data protection legislation” has the same meaning as in the Data Protection Act 2018…

Sch. 19 para. 70

The Criminal Justice and Police Act 2001 is amended as follows.

Sch. 19 para. 71

In section 57(1) (retention of seized items)— (a) omit paragraph (m), and (b) after paragraph (s) insert— (t) paragraph 10 of Schedule 15 to the Data…

Sch. 19 para. 72

In section 65(7) (meaning of “legal privilege”)— (a) for “paragraph 1 of Schedule 9 to the Data Protection Act 1998 (c. 29)” substitute “ paragraphs 1 and 2 of…

Sch. 19 para. 73

In Schedule 1 (powers of seizure)— (a) omit paragraph 65, and (b) after paragraph 73T insert— Data Protection Act 2018 73T The power of seizure conferred by…

Sch. 19 para. 74

The Anti-terrorism, Crime and Security Act 2001 is amended as follows.

Sch. 19 para. 75

(1) Section 19 (disclosure of information held by revenue departments) is amended as follows. (2) In subsection (7), for “the Data Protection Act 1998 (c. 29)”…

Sch. 19 para. 77

(1) Section 7A of the Health and Personal Social Services Act (Northern Ireland) 2001 (power to obtain information etc) is amended as follows. (2) In…

Sch. 19 para. 78

(1) Section 5A of the Justice (Northern Ireland) Act 2002 (disclosure of information to the Commission) is amended as follows. (2) In subsection (3)(a), for…

Sch. 19 para. 79

The Proceeds of Crime Act 2002 is amended as follows.

Sch. 19 para. 80

In section 333C(2)(d) (other permitted disclosures between institutions etc), for “(within the meaning of section 1 of the Data Protection Act 1998)”…

Sch. 19 para. 81

In section 436(3)(a) (disclosure of information to certain Directors), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation…

Sch. 19 para. 82

In section 438(8)(a) (disclosure of information by certain Directors), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation…

Sch. 19 para. 83

In section 439(3)(a) (disclosure of information to Lord Advocate and to Scottish Ministers), for “the Data Protection Act 1998 (c. 29)” substitute “ the data…

Sch. 19 para. 84

In section 441(7)(a) (disclosure of information by Lord Advocate and Scottish Ministers), for “the Data Protection Act 1998 (c. 29)” substitute “ the data…

Sch. 19 para. 85

After section 442 insert— Data protection legislation 442A In this Part, “the data protection legislation” has the same meaning as in the Data Protection Act…

Sch. 19 para. 86

(1) Section 237 of the Enterprise Act 2002 (general restriction on disclosure) is amended as follows. (2) In subsection (4), for “the Data Protection Act 1998…

Sch. 19 para. 87

(1) In Schedule 5 to the Scottish Public Services Ombudsman Act 2002 (disclosure of information by the Ombudsman), the entry for the Information Commissioner…

Sch. 19 para. 88

The Freedom of Information (Scotland) Act 2002 is amended as follows.

Sch. 19 para. 89

In section 2(2)(e)(ii) (absolute exemptions), omit “by virtue of subsection (2)(a)(i) or (b) of that section”.

Sch. 19 para. 90

(1) Section 38 (personal information) is amended as follows. (2) In subsection (1), for paragraph (b) substitute— (b) personal data and the first, second or…

Sch. 19 para. 91

Schedule 5 to the Courts Act 2003 (collection of fines) is amended as follows.

Sch. 19 para. 92

(1) Paragraph 9C (disclosure of information in connection with making of attachment of earnings orders or applications for benefit deductions: supplementary)…

Sch. 19 para. 93

(1) Paragraph 10A (attachment of earnings orders (Justice Act (Northern Ireland) 2016): disclosure of information) is amended as follows. (2) In sub-paragraph…

Sch. 19 para. 94

(1) Section 94 of the Sexual Offences Act 2003 (Part 2: supply of information to the Secretary of State etc for verification) is amended as follows. (2) In…

Sch. 19 para. 95

The Criminal Justice Act 2003 is amended as follows.

Sch. 19 para. 96

In section 327A(9) (disclosure of information about convictions etc of child sex offenders to members of the public), for “the Data Protection Act 1998”…

Sch. 19 para. 97

In section 327B (disclosure of information about convictions etc of child sex offenders to members of the public: interpretation), after subsection (4) insert—…

Sch. 19 para. 98

(1) Section 279 of the Mental Health (Care and Treatment) (Scotland) Act 2003 (information for research) is amended as follows. (2) In subsection (2), for…

Sch. 19 para. 99

(1) Section 64C of the Public Audit (Wales) Act 2004 (voluntary provision of data) is amended as follows. (2) In subsection (3)(a), for “the Data Protection…

Sch. 19 para. 100

The Companies (Audit, Investigations and Community Enterprise) Act 2004 is amended as follows.

Sch. 19 para. 101

(1) Section 15A (disclosure of information by tax authorities) is amended as follows. (2) In subsection (2)— (a) omit “within the meaning of the Data…

Sch. 19 para. 102

(1) Section 15D (permitted disclosure of information obtained under compulsory powers) is amended as follows. (2) In subsection (7), for “the Data Protection…

Sch. 19 para. 103

(1) Section 54 of the Domestic Violence, Crime and Victims Act 2004 (disclosure of information) is amended as follows. (2) In subsection (7), for “the Data…

Sch. 19 para. 104

The Children Act 2004 is amended as follows.

Sch. 19 para. 105

(1) Section 12 (information databases) is amended as follows. (2) In subsection (13)(e) for “the Data Protection Act 1998 (c. 29)” substitute “ the data…

Sch. 19 para. 106

(1) Section 29 (information databases: Wales) is amended as follows. (2) In subsection (14)(e) for “the Data Protection Act 1998 (c. 29)” substitute “ the data…

Sch. 19 para. 107

(1) Section 107 of the Constitutional Reform Act 2005 (disclosure of information to the Commission) is amended as follows. (2) In subsection (3)(a), for “the…

Sch. 19 para. 108

In section 64 of the Mental Capacity Act 2005 (interpretation), for the definition of “health record” substitute— “health record” has the same meaning as in…

Sch. 19 para. 109

(1) Section 34X of the Public Services Ombudsman (Wales) Act 2005 (disclosure of information) is amended as follows. (2) In subsection (4), for paragraph (a)…

Sch. 19 para. 110

(1) Section 22 of the Commissioners for Revenue and Customs Act 2005 (data protection, etc) is amended as follows. (2) The existing text becomes subsection…

Sch. 19 para. 111

(1) Section 352 of the Gambling Act 2005 (data protection) is amended as follows. (2) The existing text becomes subsection (1). (3) In that subsection, for…

Sch. 19 para. 112

(1) Section 18 of the Commissioner for Older People (Wales) Act 2006 (power to disclose information) is amended as follows. (2) In subsection (7), for…

Sch. 19 para. 113

The National Health Service Act 2006 is amended as follows.

Sch. 19 para. 114

(1) Section 251 (control of patient information) is amended as follows. (2) In subsection (7), for “made by or under the Data Protection Act 1998 (c 29)”…

Sch. 19 para. 115

(1) Section 264C (provision and disclosure of information about health service products: supplementary) is amended as follows. (2) In subsection (2), for “the…

Sch. 19 para. 116

In paragraph 7B(3) of Schedule 1 (further provision about the Secretary of State and services under the Act), for “has the same meaning as in the Data…

Sch. 19 para. 117

The National Health Service (Wales) Act 2006 is amended as follows.

Sch. 19 para. 118

(1) Section 201C (provision of information about medical supplies: supplementary) is amended as follows. (2) In subsection (2), for “the Data Protection Act…

Sch. 19 para. 119

In paragraph 7B(3) of Schedule 1 (further provision about the Welsh Ministers and services under the Act), for “has the same meaning as in the Data Protection…

Sch. 19 para. 120

The Companies Act 2006 is amended as follows.

Sch. 19 para. 121

In section 458(2) (disclosure of information by tax authorities)— (a) for “within the meaning of the Data Protection Act 1998 (c. 29)” substitute “ within the…

Sch. 19 para. 122

In section 461(7) (permitted disclosure of information obtained under compulsory powers), for “the Data Protection Act 1998 (c. 29)” substitute “ the data…

Sch. 19 para. 123

In section 948(9) (restrictions on disclosure) for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

Sch. 19 para. 124

In section 1173(1) (minor definitions: general), at the appropriate place insert— “the data protection legislation” has the same meaning as in the Data…

Sch. 19 para. 125

In section 1224A(7) (restrictions on disclosure), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

Sch. 19 para. 126

In section 1253D(3) (restriction on transfer of audit working papers to third countries), for “the Data Protection Act 1998” substitute “ the data protection…

Sch. 19 para. 127

In section 1261(1) (minor definitions: Part 42), at the appropriate place insert— “the data protection legislation” has the same meaning as in the Data…

Sch. 19 para. 128

In section 1262 (index of defined expressions: Part 42), at the appropriate place insert— the data protection legislation section 1261(1) .

Sch. 19 para. 129

In Schedule 8 (index of defined expressions: general), at the appropriate place insert— the data protection legislation section 1173(1) .

Sch. 19 para. 130

The Tribunals, Courts and Enforcement Act 2007 is amended as follows.

Sch. 19 para. 131

In section 11(5)(b) (right to appeal to Upper Tribunal), for “section 28(4) or (6) of the Data Protection Act 1998 (c. 29)” substitute “ section 27(3) or (5)…

Sch. 19 para. 132

In section 13(8)(a) (right to appeal to the Court of Appeal), for “section 28(4) or (6) of the Data Protection Act 1998 (c. 29)” substitute “ section 27(3) or…

Sch. 19 para. 133

The Statistics and Registration Service Act 2007 is amended as follows.

Sch. 19 para. 134

(1) Section 45 (information held by HMRC) is amended as follows. (2) In subsection (4A), for “section 51(3) of the Data Protection Act 1998” substitute “…

Sch. 19 para. 135

(1) Section 45A (information held by other public authorities) is amended as follows. (2) In subsection (8), for “section 51(3) of the Data Protection Act…

Sch. 19 para. 136

(1) Section 45B(3) (access to information held by Crown bodies etc) is amended as follows. (2) In paragraph (a), for “the Data Protection Act 1998” substitute…

Sch. 19 para. 137

(1) Section 45C(13) (power to require disclosures by other public authorities) is amended as follows. (2) In paragraph (b), for “the Data Protection Act 1998”…

Sch. 19 para. 138

In section 45D(9)(b) (power to require disclosure by undertakings), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

Sch. 19 para. 139

(1) Section 45E (further provision about powers in sections 45B, 45C and 45D) is amended as follows. (2) In subsection (6), for “issued under section 52B…

Sch. 19 para. 140

(1) Section 53A (disclosure by the Statistics Board to devolved administrations) is amended as follows. (2) In subsection (9), for “section 51(3) of the Data…

Sch. 19 para. 141

(1) Section 54 (Data Protection Act 1998 and Human Rights Act 1998) is amended as follows. (2) In the heading, omit “Data Protection Act 1998 and”. (3) Omit…

Sch. 19 para. 142

In section 67 (general interpretation: Part 1), at the appropriate place insert— “the data protection legislation” has the same meaning as in the Data…

Sch. 19 para. 143

The Serious Crime Act 2007 is amended as follows.

Sch. 19 para. 144

(1) Section 5A (verification and disclosure of information) is amended as follows. (2) In subsection (6)— (a) for “the Data Protection Act 1998” substitute “…

Sch. 19 para. 145

(1) Section 68 (disclosure of information to prevent fraud) is amended as follows. (2) In subsection (4)(a), for “the Data Protection Act 1998 (c. 29)”…

Sch. 19 para. 146

(1) Section 85 (disclosure of information by Revenue and Customs) is amended as follows. (2) In subsection (8)(a), for “the Data Protection Act 1998 (c. 29)”…

Sch. 19 para. 147

(1) Section 169 of the Legal Services Act 2007 (disclosure of information to the Legal Services Board) is amended as follows. (2) In subsection (3)(a), for…

Sch. 19 para. 148

In section 74 of the Adoption and Children (Scotland) Act 2007 (disclosure of medical information about parents), for subsection (5) substitute— (5) In…

Sch. 19 para. 149

The Criminal Justice and Immigration Act 2008 is amended as follows.

Sch. 19 para. 150

Omit— (a) section 77 (power to alter penalty for unlawfully obtaining etc personal data), and (b) section 78 (new defence for obtaining etc for journalism and…

Sch. 19 para. 151

(1) Section 114 (supply of information to Secretary of State etc) is amended as follows. (2) In subsection (5), for “the Data Protection Act 1998 (c. 29)”…

Sch. 19 para. 152

(1) Section 70 of the Regulatory Enforcement and Sanctions Act 2008 (disclosure of information) is amended as follows. (2) In subsection (4)(a), for “the Data…

Sch. 19 para. 153

In section 20A(5) of the Health and Social Care Act 2008 (functions relating to processing of information by registered persons), in the definition of…

Sch. 19 para. 154

(1) Section 20 of the Counter-Terrorism Act 2008 (disclosure and the intelligence services: supplementary provisions) is amended as follows. (2) In subsection…

Sch. 19 para. 155

(1) Section 117 of the Public Health etc. (Scotland) Act 2008 (disclosure of information) is amended as follows. (2) In subsection (6), for “the Data…

Sch. 19 para. 156

(1) Section 83ZY of the Banking Act 2009 (special resolution regime: publication of notices etc) is amended as follows. (2) In subsection (10), for “the Data…

Sch. 19 para. 157

(1) Section 19 of the Borders, Citizenship and Immigration Act 2009 (use and disclosure of customs information: application of statutory provisions) is amended…

Sch. 19 para. 158

The Marine and Coastal Access Act 2009 is amended as follows.

Sch. 19 para. 159

(1) Paragraph 13 of Schedule 7 (further provision about civil sanctions under Part 4: disclosure of information) is amended as follows. (2) In sub-paragraph…

Sch. 19 para. 160

(1) Paragraph 9 of Schedule 10 (further provision about fixed monetary penalties: disclosure of information) is amended as follows. (2) In sub-paragraph…

Sch. 19 para. 161

In Schedule 21 to the Coroners and Justice Act 2009 (minor and consequential amendments), omit paragraph 29(3).

Sch. 19 para. 162

(1) Section 38 of the Broads Authority Act 2009 (provision of information) is amended as follows. (2) In subsection (3), for “the Data Protection Act 1998 (c…

Sch. 19 para. 163

(1) Section 13 of the Health and Social Care (Reform) Act (Northern Ireland) 2009 (functions of the Regional Agency) is amended as follows. (2) In subsection…

Sch. 19 para. 164

(1) Section 25 of the Terrorist Asset-Freezing etc. Act 2010 (application of provisions) is amended as follows. (2) In subsection (2)(a), for “the Data…

Sch. 19 para. 165

(1) Paragraph 12 of Schedule 2 to the Marine (Scotland) Act 2010 (further provision about civil sanctions under Part 4: disclosure of information) is amended…

Sch. 19 para. 166

(1) Section 59 of the Charities Act 2011 (disclosure: supplementary) is amended as follows. (2) The existing text becomes subsection (1). (3) In that…

Sch. 19 para. 167

The Welsh Language (Wales) Measure 2011 is amended as follows.

Sch. 19 para. 168

(1) Section 22 (power to disclose information) is amended as follows. (2) In subsection (4)— (a) in the English language text, for paragraph (a) substitute—…

Sch. 19 para. 169

(1) Paragraph 8 of Schedule 2 (inquiries by the Commissioner: reports) is amended as follows. (2) In sub-paragraph (7)— (a) in the English language text, for…

Sch. 19 para. 170

(1) Section 10 of the Safeguarding Board Act (Northern Ireland) 2011 (duty to co-operate) is amended as follows. (2) In subsection (3), for “the Data…

Sch. 19 para. 171

The Health and Social Care Act 2012 is amended as follows.

Sch. 19 para. 172

In section 250(7) (power to publish information standards), for the definition of “processing” substitute— “processing” has the same meaning as in Parts 5 to 7…

Sch. 19 para. 173

(1) Section 251A (consistent identifiers) is amended as follows. (2) In subsection (7)(a), for “made by or under the Data Protection Act 1998” substitute “ of…

Sch. 19 para. 174

(1) Section 251B (duty to share information) is amended as follows. (2) In subsection (5)(a), for “made by or under the Data Protection Act 1998” substitute “…

Sch. 19 para. 175

The Protection of Freedoms Act 2012 is amended as follows.

Sch. 19 para. 176

(1) Section 27 (exceptions and further provision about consent and notification) is amended as follows. (2) In subsection (5), for “the Data Protection Act…

Sch. 19 para. 177

In section 28(1) (interpretation: Chapter 2), for the definition of “processing” substitute— “processing” has the same meaning as in Parts 5 to 7 of the Data…

Sch. 19 para. 178

In section 29(7) (code of practice for surveillance camera systems), for the definition of “processing” substitute— “processing” has the same meaning as in…

Sch. 19 para. 179

(1) Section 14A of the HGV Road User Levy Act 2013 (disclosure of information by Revenue and Customs) is amended as follows. (2) In subsection (5), for “the…

Sch. 19 para. 180

The Crime and Courts Act 2013 is amended as follows.

Sch. 19 para. 181

(1) Section 42 (other interpretive provisions) is amended as follows. (2) In subsection (5)(a), for “section 13 of the Data Protection Act 1998 (damage or…

Sch. 19 para. 182

(1) Paragraph 1 of Schedule 7 (statutory restrictions on disclosure) is amended as follows. (2) The existing text becomes sub-paragraph (1). (3) In that…

Sch. 19 para. 183

(1) Paragraph 8 of Schedule 2 to the Marine Act (Northern Ireland) 2013 (further provision about fixed monetary penalties under section 35: disclosure of…

Sch. 19 para. 184

(1) Paragraph 3 of Schedule 9 to the Local Audit and Accountability Act 2014 (data matching: voluntary provision of data) is amended as follows. (2) In…

Sch. 19 para. 185

(1) Paragraph 7 of Schedule 4 to the Anti-social Behaviour, Crime and Policing Act 2014 (anti-social behaviour case reviews: information) is amended as…

Sch. 19 para. 186

(1) Paragraph 6 of Schedule 6 to the Immigration Act 2014 (information: limitation on powers) is amended as follows. (2) The existing text becomes…

Sch. 19 para. 187

In section 67(9) of the Care Act 2014 (involvement in assessment, plans etc), for paragraph (a) substitute— (a) a health record (within the meaning given in…

Sch. 19 para. 188

In section 18(10)(b) of the Social Services and Well-being (Wales) Act 2014 (registers of sight-impaired, hearing-impaired and other disabled people)— (a) in…

Sch. 19 para. 189

(1) Section 38 of the Counter-Terrorism and Security Act 2015 (support etc for people vulnerable to being drawn into terrorism: co-operation) is amended as…

Sch. 19 para. 190

(1) Section 6 of the Small Business, Enterprise and Employment Act 2015 (application of listed provisions to designated credit reference agencies) is amended…

Sch. 19 para. 192

The Human Trafficking and Exploitation (Criminal Justice and Support for Victims) Act (Northern Ireland) 2015 is amended as follows.

Sch. 19 para. 193

In section 13(5) (duty to notify National Crime Agency about suspected victims of certain offences) for “the Data Protection Act 1998” substitute “ the data…

Sch. 19 para. 194

In section 25(1) (interpretation of this Act), at the appropriate place insert— “the data protection legislation” has the same meaning as in the Data…

Sch. 19 para. 195

In paragraph 18(5) of Schedule 3 (supply of information to relevant Northern Ireland departments, Secretary of State, etc) for “the Data Protection Act 1998”…

Sch. 19 para. 196

(1) Section 72 of the Justice Act (Northern Ireland) 2015 (supply of information to relevant Northern Ireland departments or Secretary of State) is amended as…

Sch. 19 para. 198

The Investigatory Powers Act 2016 is amended as follows.

Sch. 19 para. 199

In section 1(5)(b), for sub-paragraph (ii) substitute— (ii) in section 170 of the Data Protection Act 2018 (unlawful obtaining etc of personal data), .

Sch. 19 para. 200

In section 199 (bulk personal datasets: interpretation), for subsection (2) substitute— (2) In this Part, “personal data” means— (a) personal data within the…

Sch. 19 para. 202

In section 206 (additional safeguards for health records), for subsection (7) substitute— (7) In subsection (6)— “health professional” has the same meaning as…

Sch. 19 para. 203

(1) Section 237 (information gateway) is amended as follows. (2) In subsection (2), for “the Data Protection Act 1998” substitute “ the data protection…

Sch. 19 para. 204

(1) Section 49 of the Police Services Ombudsman Act (Northern Ireland) 2016 (disclosure of information) is amended as follows. (2) In subsection (4), for…

Sch. 19 para. 205

(1) Section 1 of the Health and Social Care (Control of Data Processing) Act (Northern Ireland) 2016 (control of information of a relevant person) is amended…

Sch. 19 para. 206

In section 306(1) of the Mental Capacity Act (Northern Ireland) 2016 (definitions for purposes of Act), for the definition of “health record” substitute—…

Sch. 19 para. 207

The Justice Act (Northern Ireland) 2016 is amended as follows.

Sch. 19 para. 208

(1) Section 17 (disclosure of information) is amended as follows. (2) In subsection (7), for “the Data Protection Act 1998” substitute “ the data protection…

Sch. 19 para. 209

In section 44(3) (disclosure of information)— (a) in paragraph (a), for “Part 5 of the Data Protection Act 1998” substitute “ sections 142 to 154, 160 to 164…

Sch. 19 para. 210

(1) Section 50 of the Policing and Crime Act 2017 (Freedom of Information Act etc: Police Federation for England and Wales) is amended as follows. (2) The…

Sch. 19 para. 211

In Schedule 5 to the Children and Social Work Act 2017— (a) in Part 1 (general amendments to do with social workers etc in England), omit paragraph 6, and (b)…

Sch. 19 para. 212

The Higher Education and Research Act 2017 is amended as follows.

Sch. 19 para. 213

(1) Section 63 (cooperation and information sharing by the Office for Students) is amended as follows. (2) In subsection (6), for “the Data Protection Act…

Sch. 19 para. 214

(1) Section 112 (cooperation and information sharing between the Office for Students and UKRI) is amended as follows. (2) In subsection (6), for “the Data…

Sch. 19 para. 215

The Digital Economy Act 2017 is amended as follows.

Sch. 19 para. 216

(1) Section 40 (further provisions about disclosures under sections 35 to 39) is amended as follows. (2) In subsection (8)(a), for “the Data Protection Act…

Sch. 19 para. 217

(1) Section 43 (codes of practice) is amended as follows. (2) In subsection (2), for “issued under section 52B (data-sharing code) of the Data Protection Act…

Sch. 19 para. 218

(1) Section 49 (further provision about disclosures under section 48) is amended as follows. (2) In subsection (8)(a), for “the Data Protection Act 1998”…

Sch. 19 para. 219

(1) Section 52 (code of practice) is amended as follows. (2) In subsection (2), for “issued under section 52B (data-sharing code) of the Data Protection Act…

Sch. 19 para. 220

(1) Section 57 (further provision about disclosures under section 56) is amended as follows. (2) In subsection (8)(a), for “the Data Protection Act 1998”…

Sch. 19 para. 221

(1) Section 60 (code of practice) is amended as follows. (2) In subsection (2), for “issued under section 52B (data-sharing code) of the Data Protection Act…

Sch. 19 para. 222

(1) Section 65 (supplementary provision about disclosures under section 64) is amended as follows. (2) In subsection (2)(a), for “the Data Protection Act 1998”…

Sch. 19 para. 223

(1) Section 70 (code of practice) is amended as follows. (2) In subsection (2), for “issued under section 52B (data-sharing code) of the Data Protection Act…

Sch. 19 para. 224

Omit sections 108 to 110 (charges payable to the Information Commissioner).

Sch. 19 para. 225

(1) Section 60 of the Landfill Disposals Tax (Wales) Act 2017 (disclosure of information to the Welsh Revenue Authority) is amended as follows. (2) In…

Sch. 19 para. 226

(1) Section 4 of the Additional Learning Needs and Educational Tribunal (Wales) Act 2018 (additional learning needs code) is amended as follows. (2) In the…

Sch. 19 para. 227

(1) Section 204 of this Act (meaning of “health professional” and “social work professional”) is amended as follows (to reflect the arrangements for the…

Sch. 19 para. 228

In the table in the Schedule to the Estate Agents (Specified Offences) (No. 2) Order 1991 (specified offences), at the end insert— Data Protection Act 2018…

Sch. 19 para. 229

(1) Article 4 of the Channel Tunnel (International Arrangements) Order 1993 (application of enactments) is amended as follows. (2) In paragraph (2)— (a) for…

Sch. 19 para. 230

The Access to Health Records (Northern Ireland) Order 1993 is amended as follows.

Sch. 19 para. 231

In Article 4 (health professionals), for paragraph (1) substitute— (1) In this Order, “health professional” has the same meaning as in the Data Protection Act…

Sch. 19 para. 232

In Article 5(4)(a) (fees for access to health records), for “under section 7 of the Data Protection Act 1998” substitute “ made by the Department ”.

Sch. 19 para. 233

In article 4 of the Channel Tunnel (Miscellaneous Provisions) Order 1994 (application of enactments), for paragraphs (2) and (3) substitute— (2) For the…

Sch. 19 para. 234

The European Primary and Specialist Dental Qualifications Regulations 1998 are amended as follows.

Sch. 19 para. 235

(1) Regulation 2(1) (interpretation) is amended as follows. (2) Omit the definition of “Directive 95/46/EC”. (3) At the appropriate place insert— “the GDPR”…

Sch. 19 para. 236

(1) The table in Schedule A1 (functions of the GDC under Directive 2005/36) is amended as follows. (2) In the entry for Article 56(2), in the second column…

Sch. 19 para. 237

For article 7 of the Scottish Parliamentary Corporate Body (Crown Status) Order 1999 substitute— Data Protection Act 2018 7 (1) The Parliamentary corporation…

Sch. 19 para. 238

For article 9 of the Northern Ireland Assembly Commission (Crown Status) Order 1999 substitute— Data Protection Act 2018 9 (1) The Commission is to be treated…

Sch. 19 para. 239

The Data Protection (Corporate Finance Exemption) Order 2000 is revoked.

Sch. 19 para. 240

The Data Protection (Conditions under Paragraph 3 of Part II of Schedule 1) Order 2000 is revoked.

Sch. 19 para. 241

The Data Protection (Functions of Designated Authority) Order 2000 is revoked.

Sch. 19 para. 242

The Data Protection (International Co-operation) Order 2000 is revoked.

Sch. 19 para. 243

The Data Protection (Subject Access) (Fees and Miscellaneous Provisions) Regulations 2000 are revoked.

Sch. 19 para. 244

In the Consumer Credit (Credit Reference Agency) Regulations 2000, regulation 4(1) and Schedule 1 (statement of rights under section 9(3) of the Data…

Sch. 19 para. 245

The Data Protection (Subject Access Modification) (Health) Order 2000 is revoked.

Sch. 19 para. 246

The Data Protection (Subject Access Modification) (Education) Order 2000 is revoked.

Sch. 19 para. 247

The Data Protection (Subject Access Modification) (Social Work) Order 2000 is revoked.

Sch. 19 para. 248

The Data Protection (Crown Appointments) Order 2000 is revoked.

Sch. 19 para. 249

The Data Protection (Processing of Sensitive Personal Data) Order 2000 is revoked.

Sch. 19 para. 250

The Data Protection (Miscellaneous Subject Access Exemptions) Order 2000 is revoked.

Sch. 19 para. 251

The Data Protection (Designated Codes of Practice) (No. 2) Order 2000 is revoked.

Sch. 19 para. 252

The Representation of the People (England and Wales) Regulations 2001 are amended as follows.

Sch. 19 para. 253

In regulation 3(1) (interpretation), at the appropriate places insert— “Article 89 GDPR purposes” means the purposes mentioned in Article 89(1) of the GDPR…

Sch. 19 para. 254

In regulation 26(3)(a) (applications for registration), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

Sch. 19 para. 255

In regulation 26A(2)(a) (application for alteration of register in respect of name under section 10ZD), for “the Data Protection Act 1998” substitute “ the…

Sch. 19 para. 256

In regulation 32ZA(3)(f) (annual canvass), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

Sch. 19 para. 257

In regulation 61A (conditions on the use, supply and inspection of absent voter records or lists), for paragraph (a) (but not the final “or”) substitute— (a)…

Sch. 19 para. 258

(1) Regulation 92(2) (interpretation and application of Part VI etc) is amended as follows. (2) After sub-paragraph (b) insert— (ba) “relevant requirement”…

Sch. 19 para. 259

In regulation 96(2A)(b)(i) (restriction on use of the full register), for “section 11(3) of the Data Protection Act 1998” substitute “ section 122(5) of the…

Sch. 19 para. 260

In regulation 97(5) and (6) (supply of free copy of full register to the British Library and restrictions on use), for “research purposes in compliance with…

Sch. 19 para. 261

In regulation 97A(7) and (8) (supply of free copy of full register to the National Library of Wales and restrictions on use), for “research purposes in…

Sch. 19 para. 262

In regulation 99(6) and (7) (supply of free copy of full register etc to Statistics Board and restrictions on use), for “research purposes in compliance with…

Sch. 19 para. 263

In regulation 109A(9) and (10) (supply of free copy of full register to public libraries and local authority archives services and restrictions on use), for…

Sch. 19 para. 264

In regulation 119(2) (conditions on the use, supply and disclosure of documents open to public inspection), for sub-paragraph (i) (but not the final “or”)…

Sch. 19 para. 265

The Representation of the People (Scotland) Regulations 2001 are amended as follows.

Sch. 19 para. 266

In regulation 3(1) (interpretation), at the appropriate places, insert— “Article 89 GDPR purposes” means the purposes mentioned in Article 89(1) of the GDPR…

Sch. 19 para. 267

In regulation 26(3)(a) (applications for registration), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

Sch. 19 para. 268

In regulation 26A(2)(a) (application for alteration of register in respect of name under section 10ZD), for “the Data Protection Act 1998” substitute “ the…

Sch. 19 para. 269

In regulation 32ZA(3)(f) (annual canvass), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

Sch. 19 para. 270

In regulation 61(3) (records and lists kept under Schedule 4), for paragraph (a) (but not the final “or”) substitute— (a) Article 89 GDPR purposes; .

Sch. 19 para. 271

In regulation 61A (conditions on the use, supply and inspection of absent voter records or lists), for paragraph (a) (but not the final “or”) substitute— (a)…

Sch. 19 para. 272

(1) Regulation 92(2) (interpretation of Part VI etc) is amended as follows. (2) After sub-paragraph (b) insert— (ba) “relevant requirement” means the…

Sch. 19 para. 273

In regulation 95(3)(b)(i) (restriction on use of the full register), for “section 11(3) of the Data Protection Act 1998” substitute “ section 122(5) of the…

Sch. 19 para. 274

In regulation 96(5) and (6) (supply of free copy of full register to the National Library of Scotland and the British Library and restrictions on use), for…

Sch. 19 para. 275

In regulation 98(6) and (7) (supply of free copy of full register etc to Statistics Board and restrictions on use), for “research purposes in compliance with…

Sch. 19 para. 276

In regulation 108A(9) and (10) (supply of full register to statutory library authorities and local authority archives services and restrictions on use), for…

Sch. 19 para. 277

In regulation 119(2) (conditions on the use, supply and disclosure of documents open to public inspection), for sub-paragraph (i) (but not the final “or”)…

Sch. 19 para. 278

(1) Article 9 of the Financial Services and Markets 2000 (Disclosure of Confidential Information) Regulations 2001 (disclosure by regulators or regulator…

Sch. 19 para. 279

The Nursing and Midwifery Order 2001 is amended as follows.

Sch. 19 para. 280

(1) Article 3 (the Nursing and Midwifery Council and its Committees) is amended as follows. (2) In paragraph (18), after “enactment” insert “ or the GDPR ”…

Sch. 19 para. 281

(1) Article 25 (the Council's power to require disclosure of information) is amended as follows. (2) In paragraph (3), after “enactment” insert “ or the GDPR…

Sch. 19 para. 282

In article 39B (European professional card), after paragraph (2) insert— (3) For the purposes of Schedule 2B, “the GDPR” means Regulation (EU) 2016/679 of the…

Sch. 19 para. 283

In article 40(6) (Directive 2005/36/EC: designation of competent authority etc), at the appropriate place insert— “the GDPR” means Regulation (EU) 2016/679 of…

Sch. 19 para. 284

(1) Schedule 2B (Directive 2005/36/EC: European professional card) is amended as follows. (2) In paragraph 8(1) (access to data) for “Directive 95/46/EC”…

Sch. 19 para. 285

(1) The table in Schedule 3 (functions of the Council under Directive 2005/36) is amended as follows. (2) In the entry for Article 56(2), in the second column…

Sch. 19 para. 286

In Schedule 4 (interpretation), omit the definition of “Directive 95/46/EC”.

Sch. 19 para. 287

Regulation 3 of the Electronic Commerce (EC Directive) Regulations 2002 (exclusions) is amended as follows.

Sch. 19 para. 288

In paragraph (1)(b) for “the Data Protection Directive and the Telecommunications Data Protection Directive” substitute “ the GDPR ”.

Sch. 19 para. 289

In paragraph (3)— (a) omit the definitions of “Data Protection Directive” and “Telecommunications Data Protection Directive”, and (b) at the appropriate place…

Sch. 19 para. 290

The Data Protection (Processing of Sensitive Personal Data) (Elected Representatives) Order 2002 is revoked.

Sch. 19 para. 291

The Privacy and Electronic Communications (EC Directive) Regulations 2003 are amended as follows.

Sch. 19 para. 292

In regulation 2(1) (interpretation), in the definition of “the Information Commissioner” and “the Commissioner”, for “section 6 of the Data Protection Act…

Sch. 19 para. 293

(1) Regulation 4 (relationship between these Regulations and the Data Protection Act 1998) is amended as follows. (2) The existing text becomes sub-paragraph…

Sch. 19 para. 294

The Nationality, Immigration and Asylum Act 2002 (Juxtaposed Controls) Order 2003 is amended as follows.

Sch. 19 para. 295

In article 8(2) (exercise of powers by French officers in a control zone in the United Kingdom: disapplication of law of England and Wales)— (a) for “The Data…

Sch. 19 para. 296

In article 11(4) (exercise of powers by UK immigration officers and constables in a control zone in France: enactments having effect)— (a) for “The Data…

Sch. 19 para. 297

The Pupils' Educational Records (Scotland) Regulations 2003 are amended as follows.

Sch. 19 para. 298

(1) Regulation 2 (interpretation) is amended as follows. (2) Omit the definition of “the 1998 Act”. (3) At the appropriate place insert— “the GDPR” means…

Sch. 19 para. 299

(1) Regulation 6 (circumstances where information should not be disclosed) is amended as follows. (2) After “any information” insert “ to the extent that any…

Sch. 19 para. 300

In regulation 9 (fees), for paragraph (1) substitute— (1A) In complying with a request made under regulation 5(2), the responsible body may only charge a fee…

Sch. 19 para. 301

Schedule 1 to the European Parliamentary Elections (Northern Ireland) Regulations 2004 (European Parliamentary elections rules) is amended as follows.

Sch. 19 para. 302

(1) Paragraph 74(1) (interpretation) is amended as follows. (2) Omit the definitions of “relevant conditions” and “research purposes”. (3) At the appropriate…

Sch. 19 para. 303

In paragraph 77(2)(b) (conditions on the use, supply and disclosure of documents open to public inspection), for “research purposes” substitute “ Article 89…

Sch. 19 para. 304

In regulation 3(1) of the Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004, omit “the appropriate limit referred to in…

Sch. 19 para. 305

The Environmental Information Regulations 2004 are amended as follows.

Sch. 19 para. 306

(1) Regulation 2 (interpretation) is amended as follows. (2) In paragraph (1), at the appropriate places, insert— “the data protection principles” means the…

Sch. 19 para. 307

(1) Regulation 13 (personal data) is amended as follows. (2) For paragraph (1) substitute— (1) To the extent that the information requested includes personal…

Sch. 19 para. 308

In regulation 14 (refusal to disclose information), in paragraph (3)(b), for “regulations 13(2)(a)(ii) or 13(3)” substitute “ regulation 13(1)(b) or (5A) ”.

Sch. 19 para. 309

In regulation 18 (enforcement and appeal provisions), in paragraph (5), for “regulation 13(5)” substitute “ regulation 13(5A) ”.

Sch. 19 para. 310

The Environmental Information (Scotland) Regulations 2004 are amended as follows.

Sch. 19 para. 311

(1) Regulation 2 (interpretation) is amended as follows. (2) In paragraph (1), at the appropriate places, insert— “the data protection principles” means the…