# Data Protection Act 2018

URL: https://consilena.com/coverage/laws/stat_uk_ukpga_2018_12

- Jurisdiction: United Kingdom
- Type: Act
- Identifier: ukpga/2018/12
- Current as of: 30 September 2026
- Provisions: 1,025
- Official text: https://www.legislation.gov.uk/ukpga/2018/12
- Licence: [Open Government Licence v3.0](https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/)
- Attribution: Contains public sector information licensed under the Open Government Licence v3.0.

> The library is a research copy. Check the official source before relying on a provision: the text published there, not the copy in Consilena, is the law.

## Provisions

### PART 1 – Preliminary

- **s. 1 Overview**: (1) This Act makes provision about the processing of personal data. (2) Most processing of personal data is subject to the UK GDPR. (3) Part 2 supplements the…
- **s. 2 Protection of personal data**: (1) The UK GDPR and this Act protect individuals with regard to the processing of personal data, in particular by— (a) requiring personal data to be processed…
- **s. 3 Terms relating to the processing of personal data**: (1) This section defines some terms used in this Act. (2) “Personal data” means any information relating to an identified or identifiable living individual…

### PART 2 – General processing

- **s. 4 Processing to which this Part applies**: (1) This Part is relevant to most processing of personal data. (2) This Part— (a) applies to the types of processing of personal data to which the UK GDPR…
- **s. 5 Definitions**: (1) Terms used in ... this Part and in the UK GDPR have the same meaning in this Part as they have in the UK GDPR. (2) In subsection (1), the reference to a…
- **s. 6 Meaning of “controller”**: (1) The definition of “controller” in Article 4(1)(7) of the UK GDPR has effect subject to— (a) subsection (2), (b) section 209, and (c) section 210. (2) For…
- **s. 7 Meaning of “public authority” and “public body”**: (1) For the purposes of the UK GDPR, the following (and only the following) are “public authorities” and “public bodies” ...— (a) a public authority as defined…
- **s. 8 Lawfulness of processing: public interest etc**: In Article 6(1) of the UK GDPR (lawfulness of processing), the reference in point (e) to processing of personal data that is necessary for the performance of a…
- **s. 9A Processing in reliance on relevant international law**: (1) Processing of personal data meets the requirement in Article 6(3), 8A(3)(e), 9(2)(g) or 10(1) of the UK GDPR for a basis in, or authorisation by, relevant…
- **s. 10 Special categories of personal data and criminal convictions etc data**: (1) Subsections (2) and (3) make provision about the processing of personal data described in Article 9(1) of the UK GDPR (prohibition on processing of special…
- **s. 11 Special categories of personal data etc: supplementary**: (1) For the purposes of Article 9(2)(h) of the UK GDPR (processing for health or social care purposes etc), the circumstances in which the processing of…
- **s. 12 Limits on fees that may be charged by controllers**: (1) The Secretary of State may by regulations specify limits on the fees that a controller may charge in reliance on— (a) Article 12(5) of the UK GDPR…
- **s. 13 Obligations of credit reference agencies**: (1) This section applies where a controller is a credit reference agency (within the meaning of section 145(8) of the Consumer Credit Act 1974). (2) The…
- **s. 13A Meaning of “relevant offence” for purpose of right to erasure**: (1) The Secretary of State may by regulations amend the table in Article 17(5) of the UK GDPR. (2) Regulations under this section are subject to the…
- **s. 15 Exemptions etc**: — s. 15 — Exemptions etc (1) Schedules 2, 3 and 4 make provision for exemptions from, and restrictions and adaptations of the application of, rules of the UK…
- **s. 16 Power to make further exemptions etc by regulations**: (1) The following powers to make provision altering the application of the UK GDPR may be exercised by way of regulations made by the Secretary of State under…
- **s. 17 Accreditation of certification providers**: (1) Accreditation of a person as a certification provider is only valid when carried out by— (a) the Commission, or (b) the UK national accreditation body. (2)…
- **s. 21 Definitions**: — s. 21 — Definitions (1) … (2) … (3) … (4) … (5) In this Chapter, “FOI public authority” means— (a) a public authority as defined in the Freedom of…
- **s. 24 Manual unstructured data held by FOI public authorities**: (1) The provisions of the UK GDPR and this Act listed in subsection (2) do not apply to personal data to which the UK GDPR applies by virtue of Article 2(1A)…
- **s. 25 Manual unstructured data used in longstanding historical research**: (1) The provisions of the UK GDPR listed in subsection (2) do not apply to personal data to which the UK GDPR applies by virtue of Article 2(1A) (manual…
- **s. 26 National security and defence exemption**: (1) A provision of the UK GDPR or this Act mentioned in subsection (2) does not apply to personal data to which the UK GDPR applies if exemption from the…
- **s. 27 National security: certificate**: (1) Subject to subsection (3), a certificate signed by a Minister of the Crown certifying that exemption from all or any of the provisions listed in section…
- **s. 28 National security and defence: modifications to Articles 9 and 32 of the UK GDPR**: (1) Article 9(1) of the UK GDPR (prohibition on processing of special categories of personal data) does not prohibit the processing of personal data to which…

### PART 3 – Law enforcement processing

- **s. 29 Processing to which this Part applies**: (1) This Part applies to— (a) the processing by a competent authority of personal data wholly or partly by automated means, and (b) the processing by a…
- **s. 30 Meaning of “competent authority”**: (1) In this Part, “competent authority” means— (a) a person specified or described in Schedule 7, and (b) any other person if and to the extent that the person…
- **s. 31 “The law enforcement purposes”**: For the purposes of this Part, “the law enforcement purposes” are the purposes of the prevention, investigation, detection or prosecution of criminal offences…
- **s. 32 Meaning of “controller” and “processor”**: (1) In this Part, “controller” means the competent authority which, alone or jointly with others— (a) determines the purposes and means of the processing of…
- **s. 33 Other definitions**: (1) This section defines certain other expressions used in this Part. (1A) “Consent” of the data subject to the processing of personal data means a freely…
- **s. 34 Overview and general duty of controller**: (1) This Chapter sets out the six data protection principles as follows— (a) section 35(1) sets out the first data protection principle (requirement that…
- **s. 35 The first data protection principle**: (1) The first data protection principle is that the processing of personal data for any of the law enforcement purposes must be lawful and fair. (2) The…
- **s. 36 The second data protection principle**: (1) The second data protection principle is that— (a) the law enforcement purpose for which personal data is collected (whether from the data subject or…
- **s. 37 The third data protection principle**: The third data protection principle is that personal data processed for any of the law enforcement purposes must be adequate, relevant and not excessive in…
- **s. 38 The fourth data protection principle**: (1) The fourth data protection principle is that— (a) personal data processed for any of the law enforcement purposes must be accurate and, where necessary…
- **s. 39 The fifth data protection principle**: (1) The fifth data protection principle is that personal data processed for any of the law enforcement purposes must be kept for no longer than is necessary…
- **s. 40 The sixth data protection principle**: The sixth data protection principle is that personal data processed for any of the law enforcement purposes must be so processed in a manner that ensures…
- **s. 40A Conditions for consent**: (1) This section is about processing of personal data that is carried out in reliance on the consent of the data subject. (2) The controller must be able to…
- **s. 41 Safeguards: archiving**: (1) This section applies in relation to the processing of personal data for a law enforcement purpose where the processing is carried out— (a) for archiving…
- **s. 42 Safeguards: sensitive processing**: (1) This section applies for the purposes of section 35(4) and (5) (which require a controller to have an appropriate policy document in place when carrying…
- **s. 42A Further provision about sensitive processing**: (1) The Secretary of State may by regulations— (a) make provision so that an additional description of processing of personal data is sensitive processing for…
- **s. 43 Overview and scope**: — s. 43 — Overview and scope (1) This Chapter— (a) imposes general duties on the controller to make information available (see sections 44 and 45A); (b)…
- **s. 44 ... Controller's general duties**: (1) The controller must make available to data subjects the following information (whether by making the information generally available to the public or in…
- **s. 45 Right of access by the data subject**: (1) A data subject is entitled to obtain from the controller— (a) confirmation as to whether or not personal data concerning him or her is being processed, and…
- **s. 45A Exemption from sections 44 and 45: legal professional privilege**: (1) Sections 44(2) and 45(1) do not require the controller to give the data subject— (a) information in respect of which a claim to legal professional…
- **s. 46 Right to rectification**: (1) The controller must, if so requested by a data subject, rectify without undue delay inaccurate personal data relating to the data subject. (2) Where…
- **s. 47 Right to erasure or restriction of processing**: (1) The controller must erase personal data without undue delay where— (a) the processing of the personal data would infringe section 35, 36(1) to (3), 37…
- **s. 48 Rights under section 46 or 47: supplementary**: (1) Where a data subject requests the rectification or erasure of personal data or the restriction of its processing, the controller must inform the data…
- **s. 50A Automated processing and significant decisions**: (1) For the purposes of sections 50B and 50C— (a) a decision is based solely on automated processing if there is no meaningful human involvement in the taking…
- **s. 50B Restrictions on automated decision-making based on sensitive processing**: (1) A significant decision based entirely or partly on sensitive processing may not be taken based solely on automated processing, unless one of the following…
- **s. 50C Safeguards for automated decision-making**: (1) Subject to subsection (3), where a significant decision taken by or on behalf of a controller in relation to a data subject is— (a) based entirely or…
- **s. 50D Further provision about automated decision-making**: (1) The Secretary of State may by regulations provide that, for the purposes of sections 50A(1)(a) and 50C(3)(c), there is, or is not, to be taken to be…
- **s. 51 Exercise of rights through the Commission**: (1) This section applies where a controller— (a) restricts under section 44(4) the information provided to the data subject under section 44(2) (duty of the…
- **s. 52 Form of provision of information etc**: (1) The controller must take reasonable steps to ensure that any information that is required by or under this Chapter to be provided to the data subject is…
- **s. 53 Manifestly unfounded or excessive requests by the data subject**: (1) Where a request made by a data subject under or by virtue of any of sections 45, 46, 47, 50C or 50D is manifestly unfounded or excessive, the controller…
- **s. 54 Meaning of “applicable time period”**: (1) This section defines “the applicable time period” for the purposes of sections 45(3)(b) and (5), 48(2)(b) and 53(7). (2) “The applicable time period” means…
- **s. 55 Overview and scope**: — s. 55 — Overview and scope (1) This Chapter— (a) sets out the general obligations of controllers and processors (see sections 56 to 65); (b) sets out…
- **s. 56 General obligations of the controller**: (1) Each controller must implement appropriate technical and organisational measures to ensure, and to be able to demonstrate, that the processing of personal…
- **s. 57 Data protection by design and default**: (1) Each controller must implement appropriate technical and organisational measures which are designed— (a) to implement the data protection principles in an…
- **s. 58 Joint controllers**: (1) Where two or more competent authorities jointly determine the purposes and means of processing personal data, they are joint controllers for the purposes…
- **s. 59 Processors**: (1) This section applies to the use by a controller of a processor to carry out processing of personal data on behalf of the controller. (2) The controller may…
- **s. 60 Processing under the authority of the controller or processor**: A processor, and any person acting under the authority of a controller or processor, who has access to personal data may not process the data except— (a) on…
- **s. 61 Records of processing activities**: (1) Each controller must maintain a record of all categories of processing activities for which the controller is responsible. (2) The controller's record must…
- **s. 62 Logging**: (1) A controller (or, where personal data is processed on behalf of the controller by a processor, the processor) must keep logs for at least the following…
- **s. 63 Co-operation with the Commission**: Each controller and each processor must co-operate, on request, with the Commission in the performance of the Commission's tasks.
- **s. 64 Data protection impact assessment**: (1) Where a type of processing is likely to result in a high risk to the rights and freedoms of individuals, the controller must, prior to the processing…
- **s. 65 Prior consultation with the Commission**: (1) This section applies where a controller intends to create a filing system and process personal data forming part of it. (2) The controller must consult the…
- **s. 66 Security of processing**: (1) Each controller and each processor must implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks…
- **s. 67 Notification of a personal data breach to the Commission**: (1) If a controller becomes aware of a personal data breach in relation to personal data for which the controller is responsible, the controller must notify…
- **s. 68 Communication of a personal data breach to the data subject**: (1) Where a personal data breach is likely to result in a high risk to the rights and freedoms of individuals, the controller must inform the data subject of…
- **s. 69 Designation of a data protection officer**: (1) The controller must designate a data protection officer, unless the controller is a court, or other judicial authority, acting in its judicial capacity…
- **s. 70 Position of data protection officer**: (1) The controller must ensure that the data protection officer is involved, properly and in a timely manner, in all issues which relate to the protection of…
- **s. 71 Tasks of data protection officer**: (1) The controller must entrust the data protection officer with at least the following tasks— (a) informing and advising the controller, any processor engaged…
- **s. 71A Codes of conduct**: — s. 71A — Codes of conduct (1) The Commission must encourage expert public bodies to produce codes of conduct intended to contribute to compliance with this…
- **s. 72 Overview and interpretation**: — s. 72 — Overview and interpretation (1) This Chapter deals with the transfer of personal data to third countries or international organisations, as follows—…
- **s. 73 General principles for transfers of personal data**: (A1) This section applies in relation to a transfer of personal data to a third country or international organisation for a law enforcement purpose. (1) The…
- **s. 74AA Transfers approved by regulations**: (1) For the purposes of section 73, the Secretary of State may by regulations approve transfers of personal data to— (a) a third country, or (b) an…
- **s. 74AB The data protection test**: (1) For the purposes of section 74AA, the data protection test is met in relation to transfers to a third country or international organisation if the standard…
- **s. 74B Transfers approved by regulations: monitoring**: (1) … (2) … (3) The Secretary of State must, on an ongoing basis, monitor developments in third countries and international organisations that could affect…
- **s. 75 Transfers subject to appropriate safeguards**: (1) … (1A) A transfer of personal data to a third country or an international organisation is made subject to appropriate safeguards only if— (a) an…
- **s. 76 Transfers based on special circumstances**: (A1) A transfer of personal data to a third country or international organisation is based on special circumstances where— (a) it is made in the absence of…
- **s. 77 Additional conditions for transfers in reliance on section 73(4)(b)**: (1) The additional conditions referred to in section 73(4)(b)(ii) are the following four conditions. (2) Condition 1 is that the transfer is strictly necessary…
- **s. 78 Subsequent transfers**: — s. 78 — Subsequent transfers (A1) Subsections (1) to (6) apply where a transfer to which section 73 applies takes place otherwise than in reliance on section…
- **s. 78A National security exemption**: (1) A provision mentioned in subsection (2) does not apply to personal data processed for law enforcement purposes if exemption from the provision is required…
- **s. 79 National security: certificate**: (1) … (2) … (3) … (3A) Subject to subsection (5), a certificate signed by a Minister of the Crown certifying that exemption from all or any of the provisions…
- **s. 80 Special processing restrictions**: (1) Subsections (3) and (4) apply where, for a law enforcement purpose, a controller transmits or otherwise makes available personal data to a non-UK…
- **s. 81 Reporting of infringements**: (1) Each controller must implement effective mechanisms to encourage the reporting of an infringement of this Part. (2) The mechanisms implemented under…

### PART 4 – Intelligence services processing

- **s. 82 Processing to which this Part applies**: (A1) This Part— (a) applies to processing of personal data by an intelligence service, and (b) applies to processing of personal data by a qualifying competent…
- **s. 82A Designation of processing by a qualifying competent authority**: (1) For the purposes of this Part, the Secretary of State may give a notice designating processing of personal data by a qualifying competent authority (a…
- **s. 82B Duration of designation notice**: (1) A designation notice must state when it comes into force. (2) A designation notice ceases to be in force at the earliest of the following times— (a) at the…
- **s. 82C Review and withdrawal of designation notice**: (1) Subsections (2) to (4) apply where processing is the subject of a designation notice for the time being in force. (2) A person who applied for the…
- **s. 82D Records of designation notices**: (1) Where the Secretary of State gives a designation notice— (a) the Secretary of State must send a copy of the notice to the Commission, and (b) the…
- **s. 82E Appeal against designation notice**: (1) A person directly affected by a designation notice may appeal to the Tribunal against the notice. (2) If, on an appeal under this section, the Tribunal…
- **s. 83 Meaning of “controller” and “processor”**: (A1) For the purposes of this Part— (a) an intelligence service is the “controller” in relation to the processing of personal data if it satisfies subsection…
- **s. 84 Other definitions**: (1) This section defines other expressions used in this Part. (2) “Consent”, in relation to the processing of personal data relating to an individual, means a…
- **s. 85 Overview**: — s. 85 — Overview (1) This Chapter sets out the six data protection principles as follows— (a) section 86 sets out the first data protection principle…
- **s. 86 The first data protection principle**: (1) The first data protection principle is that the processing of personal data must be— (a) lawful, and (b) fair and transparent. (2) The processing of…
- **s. 87 The second data protection principle**: (1) The second data protection principle is that— (a) the purpose for which personal data is collected (whether from the data subject or otherwise) must be…
- **s. 88 The third data protection principle**: The third data protection principle is that personal data must be adequate, relevant and not excessive in relation to the purpose for which it is processed.
- **s. 89 The fourth data protection principle**: The fourth data protection principle is that personal data undergoing processing must be accurate and, where necessary, kept up to date.
- **s. 90 The fifth data protection principle**: The fifth data protection principle is that personal data must be kept for no longer than is necessary for the purpose for which it is processed.
- **s. 91 The sixth data protection principle**: (1) The sixth data protection principle is that personal data must be processed in a manner that includes taking appropriate security measures as regards risks…
- **s. 91A Further provision about sensitive processing**: (1) The Secretary of State may by regulations— (a) make provision so that an additional description of processing of personal data is sensitive processing for…
- **s. 92 Overview**: — s. 92 — Overview (1) This Chapter sets out the rights of the data subject as follows— (a) section 93 deals with the information to be made available to the…
- **s. 93 Right to information**: (1) The controller must give a data subject the following information— (a) the identity and the contact details of the controller; (b) the legal basis on…
- **s. 94 Right of access**: (1) An individual is entitled to obtain from a controller— (a) confirmation as to whether or not personal data concerning the individual is being processed…
- **s. 95 Right of access: supplementary**: (1) The controller must comply with the obligation imposed by section 94(1)(b)(i) by supplying the data subject with a copy of the information in writing…
- **s. 96 Right not to be subject to automated decision-making**: (1) The controller may not take a decision significantly affecting a data subject that is based on entirely automated processing of personal data relating to…
- **s. 97 Right to intervene in automated decision-making**: (1) This section applies where— (a) the controller takes a decision significantly affecting a data subject that is based on entirely automated processing of…
- **s. 98 Right to information about decision-making**: (1) Where— (a) the controller processes personal data relating to a data subject, and (b) results produced by the processing are applied to the data subject…
- **s. 99 Right to object to processing**: (1) A data subject is entitled at any time, by notice given to the controller, to require the controller— (a) not to process personal data relating to the data…
- **s. 100 Rights to rectification and erasure**: (1) If a court is satisfied on the application of a data subject that personal data relating to the data subject is inaccurate, the court may order the…
- **s. 101 Overview**: — s. 101 — Overview This Chapter sets out— (a) the general obligations of controllers and processors (see sections 102 to 106); (b) specific obligations of…
- **s. 102 General obligations of the controller**: Each controller must implement appropriate measures— (a) to ensure, and (b) to be able to demonstrate, in particular to the Commission, that the processing of…
- **s. 103 Data protection by design**: (1) Where a controller proposes that a particular type of processing of personal data be carried out by or on behalf of the controller, the controller must…
- **s. 104 Joint controllers**: (1) Where two or more controllers jointly determine the purposes and means of processing personal data, they are joint controllers for the purposes of this…
- **s. 105 Processors**: (1) This section applies to the use by a controller of a processor to carry out processing of personal data on behalf of the controller. (2) The controller may…
- **s. 106 Processing under the authority of the controller or processor**: A processor, and any person acting under the authority of a controller or processor, who has access to personal data may not process the data except— (a) on…
- **s. 107 Security of processing**: (1) Each controller and each processor must implement security measures appropriate to the risks arising from the processing of personal data. (2) In the case…
- **s. 108 Communication of a personal data breach**: (1) If a controller becomes aware of a serious personal data breach in relation to personal data for which the controller is responsible, the controller must…
- **s. 109 Transfers of personal data outside the United Kingdom**: — s. 109 — Transfers of personal data outside the United Kingdom (1) A controller may not transfer personal data to— (a) a country or territory outside the…
- **s. 110 National security**: (1) A provision mentioned in subsection (2) does not apply to personal data to which this Part applies if exemption from the provision is required for the…
- **s. 111 National security: certificate**: (1) Subject to subsection (3), a certificate signed by a Minister of the Crown certifying that exemption from all or any of the provisions mentioned in section…
- **s. 112 Other exemptions**: Schedule 11 provides for further exemptions.
- **s. 113 Power to make further exemptions**: (1) The Secretary of State may by regulations amend Schedule 11— (a) by adding exemptions from any provision of this Part; (b) by omitting exemptions added by…

### PART 5 – The Information Commission

- **s. 114A The Information Commission**: — The Information Commission — s. 114A — The Information Commission (1) A body corporate called the Information Commission is established. (2) Schedule 12A…
- **s. 115 General functions under the UK GDPR and safeguards**: (1) … (2) General functions are conferred on the Commission by— (a) Article 57 of the UK GDPR (tasks), and (b) Article 58 of the UK GDPR (powers), (and see…
- **s. 116 Other general functions**: (A1) The Commission is responsible for monitoring the application of Part 3 of this Act, in order to protect the fundamental rights and freedoms of individuals…
- **s. 117 Competence in relation to courts etc**: Nothing in this Act or the UK GDPR permits or requires the Commission to exercise functions in relation to the processing of personal data by— (a) an…
- **s. 118 Co-operation between parties to the Data Protection Convention**: (1) … (2) … (3) … (4) … (5) Part 2 of Schedule 14 makes provision as to the functions to be carried out by the Commission for the purposes of Article 13 of the…
- **s. 119 Inspection of personal data in accordance with international obligations**: (1) The Commission may inspect personal data where the inspection is necessary in order to discharge an international obligation of the United Kingdom, subject…
- **s. 119A Standard clauses for transfers to third countries etc**: (1) The Commission may issue a document specifying standard data protection clauses which the Commission considers are capable of securing that the data…
- **s. 120 Further international role**: (1) The Commission must, in relation to third countries and international organisations, take appropriate steps to— (a) develop international co-operation…
- **s. 120A Principal objective**: It is the principal objective of the Commission, in carrying out functions under the data protection legislation— (a) to secure an appropriate level of…
- **s. 120B Duties in relation to functions under the data protection legislation**: In carrying out functions under the data protection legislation, the Commission must have regard to such of the following as appear to the Commission to be…
- **s. 120C Strategy**: (1) The Commission must prepare a strategy for carrying out the Commission's functions under the data protection legislation in accordance with the…
- **s. 120D Duty to consult other regulators**: (1) The Commission must, at such times as the Commission considers appropriate, consult the persons mentioned in subsection (2) about how the manner in which…
- **s. 121 Data-sharing code**: (1) The Commission must prepare a code of practice which contains— (a) practical guidance in relation to the sharing of personal data in accordance with the…
- **s. 122 Direct marketing code**: (1) The Commission must prepare a code of practice which contains— (a) practical guidance in relation to the carrying out of direct marketing in accordance…
- **s. 123 Age-appropriate design code**: (1) The Commission must prepare a code of practice which contains such guidance as the Commission considers appropriate on standards of age-appropriate design…
- **s. 124 Data protection and journalism code**: (1) The Commission must prepare a code of practice which contains— (a) practical guidance in relation to the processing of personal data for the purposes of…
- **s. 124A Other codes of practice**: (1) The Commission must prepare appropriate codes of practice giving guidance as to good practice in the processing of personal data if required to do so by…
- **s. 124B Panels to consider codes of practice**: (1) This section applies where a code is prepared under section 121, 122, 123, 124 or 124A, subject to subsection (11). (2) The Commission must establish a…
- **s. 124C Impact assessments for codes of practice**: (1) Where a code is prepared under section 121, 122, 123, 124 or 124A, the Commission must carry out and publish an assessment of— (a) who would be likely to…
- **s. 125 Approval of codes prepared under sections 121 to 124A**: (1) When a code is prepared under section 121, 122, 123, 124 or 124A— (a) the Commission must submit the final version to the Secretary of State, and (b) the…
- **s. 126 Publication and review of codes issued under section 125(4)**: (1) The Commission must publish a code issued under section 125(4). (2) Where an amendment of a code is issued under section 125(4), the Commission must…
- **s. 127 Effect of codes issued under section 125(4)**: (1) A failure by a person to act in accordance with a provision of a code issued under section 125(4) does not of itself make that person liable to legal…
- **s. 129 Consensual audits**: — s. 129 — Consensual audits (1) The Commission's functions under Article 58(1) of the UK GDPR and paragraph 1 of Schedule 13 include power, with the consent…
- **s. 130 Records of national security certificates**: — s. 130 — Records of national security certificates (1) A Minister of the Crown who issues a certificate under section 27, 79 or 111 must send a copy of the…
- **s. 131 Disclosure of information to the Commission**: (1) No enactment or rule of law prohibiting or restricting the disclosure of information precludes a person from providing the Commission with information…
- **s. 132 Confidentiality of information**: (1) A person who is or has been a member of the Commission or a member of its staff, or an agent of the Commission, must not disclose information which— (a)…
- **s. 133 Guidance about privileged communications**: (1) The Commission must produce and publish guidance about— (a) how the Commission proposes to secure that privileged communications which the Commission…
- **s. 134 Fees for services**: The Commission may require a person other than a data subject or a data protection officer to pay a reasonable fee for a service provided to the person, or at…
- **s. 135 Manifestly unfounded or excessive requests by data subjects etc**: (A1) This section makes provision about cases in which a request made to the Commission, to which the Commission is required or authorised to respond under the…
- **s. 136 Guidance about fees**: (1) The Commission must produce and publish guidance about the fees the Commission proposes to charge in accordance with— (a) section 134 or 135, ... (b) … (2)…
- **s. 137 Charges payable to the Commission by controllers**: (1) The Secretary of State may by regulations require controllers to pay charges of an amount specified in the regulations to the Commission. (2) Regulations…
- **s. 138 Regulations under section 137: supplementary**: (1) Before making regulations under section 137(1) or (6), the Secretary of State must consult such representatives of persons likely to be affected by the…
- **s. 139 Reporting to Parliament**: (1) The Commission must— (a) produce a general report on the carrying out of the Commission's functions annually, (b) arrange for it to be laid before…
- **s. 139A Analysis of performance**: (1) The Commission must prepare and publish an analysis of the Commissioner’s performance using key performance indicators. (2) The analysis must be prepared…
- **s. 140 Publication by the Commission**: A duty under this Act for the Commission to publish a document is a duty for the Commission to publish it, or to arrange for it to be published, in such form…
- **s. 141A Notices from the Commission**: (1) This section applies in relation to a notice authorised or required by this Act to be given to a person by the Commission. (2) The notice may be given to…

### PART 6 – Enforcement

- **s. 142 Information notices**: — s. 142 — Information notices (1) The Commission may, by written notice (an “information notice”)— (a) require a controller or processor to provide the…
- **s. 143 Information notices: restrictions**: (1) The Commission may not give an information notice with respect to the processing of personal data for the special purposes unless— (a) a determination…
- **s. 144 False statements made in response to information notices**: It is an offence for a person, in response to an information notice— (a) to make a statement which the person knows to be false in a material respect, or (b)…
- **s. 145 Information orders**: (1) This section applies if, on an application by the Commission, a court is satisfied that a person has failed to comply with a requirement of an information…
- **s. 146 Assessment notices**: — s. 146 — Assessment notices (1) The Commission may by written notice (an “assessment notice”) require a controller or processor to permit the Commission to…
- **s. 146A Assessment notices: approval of person to prepare report etc**: (1) This section applies where an assessment notice requires a controller or processor to make arrangements for an approved person to prepare a report. (2) The…
- **s. 147 Assessment notices: restrictions**: (1) An assessment notice does not require a person to do something to the extent that requiring the person to do it would involve an infringement of the…
- **s. 148 Destroying or falsifying information and documents etc**: (1) This section applies where a person— (a) has been given an information notice requiring the person to provide the Commission with information or a…
- **s. 148A Interview notices**: — s. 148A — Interview notices (1) This section applies where the Commission suspects that a controller or processor— (a) has failed or is failing as described…
- **s. 148B Interview notices: restrictions**: (1) An interview notice does not require an individual to answer questions to the extent that requiring the person to do so would involve an infringement of…
- **s. 148C False statements made in response to interview notices**: It is an offence for an individual, in response to an interview notice— (a) to make a statement which the individual knows to be false in a material respect…
- **s. 149 Enforcement notices**: — s. 149 — Enforcement notices (1) Where the Commission is satisfied that a person has failed, or is failing, as described in subsection (2), (3), (4), (5) or…
- **s. 150 Enforcement notices: supplementary**: (1) An enforcement notice must— (a) state what the person has failed or is failing to do, and (b) give the Commission's reasons for reaching that opinion. (2)…
- **s. 151 Enforcement notices: rectification and erasure of personal data etc**: (1) Subsections (2) and (3) apply where an enforcement notice is given in respect of a failure by a controller or processor— (a) to comply with a data…
- **s. 152 Enforcement notices: restrictions**: (1) The Commission may not give a controller or processor an enforcement notice in reliance on section 149(2) with respect to the processing of personal data…
- **s. 153 Enforcement notices: cancellation and variation**: (1) The Commission may cancel or vary an enforcement notice by giving written notice to the person to whom it was given. (2) A person to whom an enforcement…
- **s. 154 Powers of entry and inspection**: — s. 154 — Powers of entry and inspection Schedule 15 makes provision about powers of entry and inspection.
- **s. 155 Penalty notices**: (1) If the Commission is satisfied that a person— (a) has failed or is failing as described in section 149(2), (3), (4), (5) or (5A), ... (b) has failed to…
- **s. 156 Penalty notices: restrictions**: (1) The Commission may not give a controller or processor a penalty notice in reliance on section 149(2) with respect to the processing of personal data for…
- **s. 157 Maximum amount of penalty**: (1) In relation to an infringement of a provision of the UK GDPR, the maximum amount of the penalty that may be imposed by a penalty notice is— (a) the amount…
- **s. 158 Fixed penalties for non-compliance with charges regulations**: (1) The Commission must produce and publish a document specifying the amount of the penalty for a failure to comply with regulations made under section 137…
- **s. 159 Amount of penalties: supplementary**: (1) For the purposes of Article 83 of the UK GDPR and section 157, the Secretary of State may by regulations— (a) provide that a person of a description…
- **s. 160 Guidance about regulatory action**: (1) The Commission must produce and publish guidance about how the Commission proposes to exercise the Commission's functions in connection with— (a)…
- **s. 161 Approval of first guidance about regulatory action**: (1) When the first guidance is produced under section 160(1)— (a) the Commission must submit the final version to the Secretary of State, and (b) the Secretary…
- **s. 161A Annual report on regulatory action**: (1) The Commission must produce and publish an annual report containing the information described in subsections (2) to (5). (2) The report must include the…
- **s. 162 Rights of appeal**: (1) A person who is given any of the following notices may appeal to the Tribunal— (a) an information notice; (b) an assessment notice; (ba) an interview…
- **s. 163 Determination of appeals**: (1) Subsections (2) to (4) apply where a person appeals to the Tribunal under section 162(1) or (3). (2) The Tribunal may review any determination of fact on…
- **s. 164 Applications in respect of urgent notices**: (1) This section applies where an information notice, an assessment notice, an interview notice or an enforcement notice given to a person contains an urgency…
- **s. 164A Complaints by data subjects to controllers**: (1) A data subject may make a complaint to the controller if the data subject considers that, in connection with personal data relating to the data subject…
- **s. 164B Controllers to notify the Commission of the number of complaints**: (1) The Secretary of State may by regulations require a controller to notify the Commission of the number of complaints made to the controller under section…
- **s. 165 Complaints by data subjects to the Commission**: (1) … (2) A data subject may make a complaint to the Commission if the data subject considers that, in connection with personal data relating to him or her…
- **s. 166 Orders to progress complaints to the Commission**: (1) This section applies where, after a data subject makes a complaint under section 165 ..., the Commission— (a) fails to take appropriate steps to respond to…
- **s. 167 Compliance orders**: (1) This section applies if, on an application by a data subject, a court is satisfied that there has been an infringement of the data subject's rights under…
- **s. 168 Compensation for contravention of the UK GDPR**: (1) In Article 82 of the UK GDPR (right to compensation for material or non-material damage), “non-material damage” includes distress. (2) Subsection (3)…
- **s. 169 Compensation for contravention of other data protection legislation**: (1) A person who suffers damage by reason of a contravention of a requirement of the data protection legislation, other than the UK GDPR, is entitled to…
- **s. 170 Unlawful obtaining etc of personal data**: (1) It is an offence for a person knowingly or recklessly— (a) to obtain or disclose personal data without the consent of the controller, (b) to procure the…
- **s. 171 Re-identification of de-identified personal data**: (1) It is an offence for a person knowingly or recklessly to re-identify information that is de-identified personal data without the consent of the controller…
- **s. 172 Re-identification: effectiveness testing conditions**: (1) For the purposes of section 171, in relation to a person who re-identifies information that is de-identified personal data, “the effectiveness testing…
- **s. 173 Alteration etc of personal data to prevent disclosure to data subject**: (1) Subsection (3) applies where— (a) a request has been made in exercise of a data subject access right, and (b) the person making the request would have been…
- **s. 174 The special purposes**: — s. 174 — The special purposes (1) In this Part, “the special purposes” means one or more of the following— (a) the purposes of journalism; (b) academic…
- **s. 175 Provision of assistance in special purposes proceedings**: (1) An individual who is a party, or prospective party, to special purposes proceedings may apply to the Commission for assistance in those proceedings. (2) As…
- **s. 176 Staying special purposes proceedings**: (1) In any special purposes proceedings before a court, if the controller or processor claims, or it appears to the court, that any personal data to which the…
- **s. 177 Guidance about how to seek redress against media organisations**: (1) The Commission must produce and publish guidance about the steps that may be taken where an individual considers that a media organisation is failing or…
- **s. 178 Review of processing of personal data for the purposes of journalism**: (1) The Commission must— (a) review the extent to which, during each review period, the processing of personal data for the purposes of journalism complied…
- **s. 179 Effectiveness of the media's dispute resolution procedures**: (1) The Secretary of State must, before the end of each review period, lay before Parliament a report produced by the Secretary of State or an appropriate…
- **s. 180 Jurisdiction**: and court procedure — s. 180 — Jurisdiction (1) The jurisdiction conferred on a court by the provisions listed in subsection (2) is exercisable— (a) in England…
- **s. 180A Procedure in connection with subject access requests**: (1) This section applies where a court is required to determine whether a data subject is entitled to information by virtue of a right under— (a) Article 15 of…
- **s. 181 Interpretation of Part 6**: In this Part— “assessment notice” has the meaning given in section 146; “certification provider” has the meaning given in section 17; “enforcement notice” has…

### PART 7 – Supplementary and final provision

- **s. 182 Regulations and consultation**: (1) Regulations under this Act are to be made by statutory instrument. (2) Before making regulations under this Act, the Secretary of State must consult— (a)…
- **s. 183 Power to reflect changes to the Data Protection Convention**: (1) The Secretary of State may by regulations make such provision as the Secretary of State considers necessary or appropriate in connection with an amendment…
- **s. 183A Protection of prohibitions and restrictions etc on processing: relevant enactments**: (1) A relevant enactment or rule of law which imposes a duty, or confers a power, to process personal data does not override a requirement under the main data…
- **s. 183B Protection of prohibitions and restrictions etc on processing: other enactments**: (1) This section is about the relationship between— (a) a pre-commencement enactment which imposes a duty, or confers a power, to process personal data, and…
- **s. 184 Prohibition of requirement to produce relevant records**: (1) It is an offence for a person (“P1”) to require another person to provide P1 with, or give P1 access to, a relevant record in connection with— (a) the…
- **s. 185 Avoidance of certain contractual terms relating to health records**: (1) A term or condition of a contract is void in so far as it purports to require an individual to supply another person with a record which— (a) consists of…
- **s. 186 Protection of data subject’s rights**: (1) An enactment or rule of law prohibiting or restricting the disclosure of information, or authorising the withholding of information, does not remove or…
- **s. 186A Protection of data subject’s rights: further provision**: (1) This section is about the relationship between— (a) a pre-commencement enactment which prohibits or restricts the disclosure of information or authorises…
- **s. 187 Representation of data subjects with their authority**: (1) In relation to the processing of personal data to which the UK GDPR applies, Article 80(1) of the UK GDPR (representation of data subjects)— (a)…
- **s. 188 Representation of data subjects with their authority: collective proceedings**: (1) The Secretary of State may by regulations make provision for representative bodies to bring proceedings before a court or tribunal in England and Wales or…
- **s. 189 Duty to review provision for representation of data subjects**: (1) Before the end of the review period, the Secretary of State must— (a) review the matters listed in subsection (2) in relation to England and Wales and…
- **s. 190 Post-review powers to make provision about representation of data subjects**: (1) After the report under section 189(1) is laid before Parliament, the Secretary of State may by regulations— (a) exercise the powers under Article 80(2) of…
- **s. 191 Framework for Data Processing by Government**: — s. 191 — Framework for Data Processing by Government (1) The Secretary of State may prepare a document, called the Framework for Data Processing by…
- **s. 192 Approval of the Framework**: (1) Before issuing a document prepared under section 191, the Secretary of State must lay it before Parliament. (2) If, within the 40-day period, either House…
- **s. 193 Publication and review of the Framework**: (1) The Secretary of State must publish a document issued under section 192(3). (2) Where an amendment of a document is issued under section 192(3), the…
- **s. 194 Effect of the Framework**: (1) When carrying out processing of personal data which is the subject of a document issued under section 192(3) which is for the time being in force, a person…
- **s. 195 Reserve forces: data-sharing by HMRC**: (1) The Reserve Forces Act 1996 is amended as follows. (2) After section 125 insert— Supply of contact details by HMRC 125A (1) This subsection applies to…
- **s. 196 Penalties for offences**: (1) A person who commits an offence under section 119 or 173 or paragraph 15 of Schedule 15 is liable— (a) on summary conviction in England and Wales, to a…
- **s. 197 Prosecution**: (1) In England and Wales, proceedings for an offence under this Act may be instituted only— (a) by the Commission, or (b) by or with the consent of the…
- **s. 198 Liability of directors etc**: (1) Subsection (2) applies where— (a) an offence under this Act has been committed by a body corporate, and (b) it is proved to have been committed with the…
- **s. 199 Recordable offences**: (1) … (2) Regulations under section 27(4) of the Police and Criminal Evidence Act 1984 (recordable offences) may repeal subsection (1).
- **s. 200 Guidance about PACE codes of practice**: (1) The Commission must produce and publish guidance about how the Commission proposes to perform the duty under section 67(9) of the Police and Criminal…
- **s. 201 Disclosure of information to the Tribunal**: (1) No enactment or rule of law prohibiting or restricting the disclosure of information precludes a person from providing the First-tier Tribunal or the Upper…
- **s. 202 Proceedings in the First-tier Tribunal: contempt**: (1) This section applies where— (a) a person does something, or fails to do something, in relation to proceedings before the First-tier Tribunal— (i) on an…
- **s. 203 Tribunal Procedure Rules**: (1) Tribunal Procedure Rules may make provision for regulating— (a) the exercise of the rights of appeal conferred by section 27, 79, 82E, 111 or 162, and (b)…
- **s. 204 Meaning of “health professional” and “social work professional”**: (1) In this Act, “health professional” means any of the following— (a) a registered medical practitioner; (b) a registered nurse or midwife; (c) a registered…
- **s. 205 General interpretation**: (1) In this Act— “biometric data” means personal data resulting from specific technical processing relating to the physical, physiological or behavioural…
- **s. 206 Index of defined expressions**: The Table below lists provisions which define or otherwise explain terms defined for this Act, for a Part of this Act or for Chapter 2 or 3 of Part 2 of this…
- **s. 207 Territorial application of this Act**: (1) This Act applies only to processing of personal data described in subsections (1A) and (2). (1A) In the case of the processing of personal data to which…
- **s. 208 Children in Scotland**: (1) Subsections (2) and (3) apply where a question falls to be determined in Scotland as to the legal capacity of a person aged under 16 to— (a) exercise a…
- **s. 209 Application to the Crown**: (1) This Act binds the Crown. (2) For the purposes of the UK GDPR and this Act, each government department is to be treated as a person separate from the other…
- **s. 210 Application to Parliament**: (1) Parts 1, 2 and 5 to 7 of this Act apply to the processing of personal data by or on behalf of either House of Parliament. (2) Where the purposes for which…
- **s. 211 Minor and consequential provision**: (1) In Schedule 19— (a) Part 1 contains minor and consequential amendments of primary legislation; (b) Part 2 contains minor and consequential amendments of…
- **s. 212 Commencement**: (1) Except as provided by subsections (2) and (3), this Act comes into force on such day as the Secretary of State may by regulations appoint. (2) This section…
- **s. 213 Transitional provision**: (1) Schedule 20 contains transitional, transitory and saving provision. (2) The Secretary of State may by regulations make transitional, transitory or saving…
- **s. 214 Extent**: (1) This Act extends to England and Wales, Scotland and Northern Ireland, subject to— (a) subsections (2) to (5), ... (b) … (2) Section 199 extends to England…
- **s. 215 Short title**: This Act may be cited as the Data Protection Act 2018.

### SCHEDULE 1

- **Sch. 1 para. 1**: (1) This condition is met if— (a) the processing is necessary for the purposes of performing or exercising obligations or rights which are imposed or conferred…
- **Sch. 1 para. 2**: (1) This condition is met if the processing is necessary for health or social care purposes. (2) In this paragraph “health or social care purposes” means the…
- **Sch. 1 para. 3**: This condition is met if the processing— (a) is necessary for reasons of public interest in the area of public health, and (b) is carried out— (i) by or under…
- **Sch. 1 para. 4**: This condition is met if the processing— (a) is necessary for archiving purposes, scientific or historical research purposes or statistical purposes, (b) is…
- **Sch. 1 para. 5**: (1) Except as otherwise provided, a condition in this Part of this Schedule is met only if, when the processing is carried out, the controller has an…
- **Sch. 1 para. 6**: (1) This condition is met if the processing— (a) is necessary for a purpose listed in sub-paragraph (2), and (b) is necessary for reasons of substantial public…
- **Sch. 1 para. 7**: This condition is met if the processing is necessary— (a) for the administration of justice, or (b) for the exercise of a function of either House of…
- **Sch. 1 para. 8**: (1) This condition is met if the processing— (a) is of a specified category of personal data, and (b) is necessary for the purposes of identifying or keeping…
- **Sch. 1 para. 9**: (1) This condition is met if the processing— (a) is of personal data revealing racial or ethnic origin, (b) is carried out as part of a process of identifying…
- **Sch. 1 para. 10**: (1) This condition is met if the processing— (a) is necessary for the purposes of the prevention, investigation or detection of an unlawful act, (b) must be…
- **Sch. 1 para. 11**: (1) This condition is met if the processing— (a) is necessary for the exercise of a protective function, (b) must be carried out without the consent of the…
- **Sch. 1 para. 12**: (1) This condition is met if— (a) the processing is necessary for the purposes of complying with, or assisting other persons to comply with, a regulatory…
- **Sch. 1 para. 13**: (1) This condition is met if— (a) the processing consists of, or is carried out in preparation for, the disclosure of personal data for the special purposes…
- **Sch. 1 para. 14**: (1) This condition is met if the processing— (a) is necessary for the purposes of preventing fraud or a particular kind of fraud, and (b) consists of— (i) the…
- **Sch. 1 para. 15**: This condition is met if the processing is necessary for the purposes of making a disclosure in good faith under either of the following— (a) section 21CA of…
- **Sch. 1 para. 16**: (1) This condition is met if the processing— (a) is carried out by a not-for-profit body which provides support to individuals with a particular disability or…
- **Sch. 1 para. 17**: (1) This condition is met if the processing— (a) is necessary for the provision of confidential counselling, advice or support or of another similar service…
- **Sch. 1 para. 18**: (1) This condition is met if— (a) the processing is necessary for the purposes of— (i) protecting an individual from neglect or physical, mental or emotional…
- **Sch. 1 para. 19**: (1) This condition is met if the processing— (a) is necessary for the purposes of protecting the economic well-being of an individual at economic risk who is…
- **Sch. 1 para. 20**: (1) This condition is met if the processing— (a) is necessary for an insurance purpose, (b) is of personal data revealing racial or ethnic origin, religious or…
- **Sch. 1 para. 21**: (1) This condition is met if the processing— (a) is necessary for the purpose of making a determination in connection with eligibility for, or benefits payable…
- **Sch. 1 para. 22**: (1) This condition is met if the processing— (a) is of personal data revealing political opinions, (b) is carried out by a person or organisation included in…
- **Sch. 1 para. 23**: (1) This condition is met if— (a) the processing is carried out— (i) by an elected representative or a person acting with the authority of such a…
- **Sch. 1 para. 24**: (1) This condition is met if— (a) the processing consists of, or is carried out in preparation for, the disclosure of personal data— (i) to an elected…
- **Sch. 1 para. 25**: (1) This condition is met if— (a) the processing consists of the processing of personal data about a prisoner for the purpose of informing a member of the…
- **Sch. 1 para. 26**: This condition is met if the processing— (a) consists of the publication of a judgment or other decision of a court or tribunal, or (b) is necessary for the…
- **Sch. 1 para. 27**: (1) This condition is met if the processing is necessary— (a) for the purposes of measures designed to eliminate doping which are undertaken by or under the…
- **Sch. 1 para. 28**: (1) This condition is met if the processing— (a) is necessary for the purposes of measures designed to protect the integrity of a sport or a sporting event…
- **Sch. 1 para. 29**: This condition is met if the data subject has given consent to the processing.
- **Sch. 1 para. 30**: This condition is met if— (a) the processing is necessary to protect the vital interests of an individual, and (b) the data subject is physically or legally…
- **Sch. 1 para. 31**: This condition is met if the processing is carried out— (a) in the course of its legitimate activities with appropriate safeguards by a foundation, association…
- **Sch. 1 para. 32**: This condition is met if the processing relates to personal data which is manifestly made public by the data subject.
- **Sch. 1 para. 33**: This condition is met if the processing— (a) is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal…
- **Sch. 1 para. 34**: This condition is met if the processing is necessary when a court or tribunal is acting in its judicial capacity.
- **Sch. 1 para. 35**: (1) This condition is met if— (a) the processing is of personal data about a conviction or caution for an offence listed in sub-paragraph (2), (b) the…
- **Sch. 1 para. 36**: This condition is met if the processing would meet a condition in Part 2 of this Schedule but for an express requirement for the processing to be necessary for…
- **Sch. 1 para. 37**: This condition is met if the processing— (a) would meet the condition in paragraph 20 in Part 2 of this Schedule (the “insurance condition”), or (b) would meet…
- **Sch. 1 para. 38**: This Part of this Schedule makes provision about the processing of personal data carried out in reliance on a condition in Part 1, 2 or 3 of this Schedule…
- **Sch. 1 para. 39**: The controller has an appropriate policy document in place in relation to the processing of personal data in reliance on a condition described in paragraph 38…
- **Sch. 1 para. 40**: (1) Where personal data is processed in reliance on a condition described in paragraph 38, the controller must during the relevant period— (a) retain the…
- **Sch. 1 para. 41**: A record maintained by the controller, or the controller's representative, under Article 30 of the UK GDPR in respect of the processing of personal data in…

### SCHEDULE 2

- **Sch. 2 para. 1**: In this Part of this Schedule, “the listed GDPR provisions” means— (a) the following provisions of the UK GDPR (the rights and obligations in which may be…
- **Sch. 2 para. 2**: (1) The listed GDPR provisions and Article 34(1) and (4) of the UK GDPR (communication of personal data breach to the data subject) do not apply to personal…
- **Sch. 2 para. 3**: (1) The UK GDPR provisions listed in sub-paragraph (3) do not apply to personal data which consists of a classification applied to the data subject as part of…
- **Sch. 2 para. 4**: (1) The relevant UK GDPR provisions do not apply to personal data processed by the Secretary of State for any of the following purposes— (a) the maintenance of…
- **Sch. 2 para. 4A**: (1) A decision under paragraph 4(1) as to whether, and the extent to which, the application of the relevant UK GDPR provisions would be likely to prejudice any…
- **Sch. 2 para. 4B**: (1) Where the Secretary of State makes a decision mentioned in paragraph 4A(4), the Secretary of State must keep a record of it and the reasons for it. (2)…
- **Sch. 2 para. 5**: (1) The listed GDPR provisions do not apply to personal data consisting of information that the controller is obliged by an enactment to make available to the…
- **Sch. 2 para. 6**: In this Part of this Schedule, “the listed GDPR provisions” means the following provisions of the UK GDPR (the rights and obligations in which may be…
- **Sch. 2 para. 7**: The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a function that— (a) is designed as described in column 1 of…
- **Sch. 2 para. 8**: (1) The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a function listed in sub-paragraph (2) to the extent…
- **Sch. 2 para. 9**: (1) The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a relevant function of the Bank of England to the extent…
- **Sch. 2 para. 10**: (1) The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a function listed in sub-paragraph (2) to the extent…
- **Sch. 2 para. 11**: The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a function that— (a) is a function of a person described in…
- **Sch. 2 para. 12**: In the Table in paragraph 11— ... ... the “Financial Ombudsman” means the scheme operator within the meaning of Part 16 of the Financial Services and Markets…
- **Sch. 2 para. 13**: The listed GDPR provisions and Article 34(1) and (4) of the UK GDPR (communication of personal data breach to the data subject) do not apply to personal data…
- **Sch. 2 para. 14**: (1) The listed GDPR provisions do not apply to personal data processed for the purposes of assessing a person's suitability for judicial office or the office…
- **Sch. 2 para. 15**: (1) The listed GDPR provisions do not apply to personal data processed for the purposes of the conferring by the Crown of any honour or dignity. (2) The listed…
- **Sch. 2 para. 16**: (1) Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers), and Article 5 of the UK GDPR…
- **Sch. 2 para. 17**: (1) For the purposes of paragraph 16(2)(b), it is to be considered reasonable for a controller to disclose information to a data subject without the consent of…
- **Sch. 2 para. 18**: In this Part of this Schedule, “the listed GDPR provisions” means the following provisions of the UK GDPR (the rights and obligations in which may be…
- **Sch. 2 para. 19**: The listed GDPR provisions do not apply to personal data that consists of— (a) information in respect of which a claim to legal professional privilege or, in…
- **Sch. 2 para. 20**: (1) A person need not comply with the listed GDPR provisions to the extent that compliance would, by revealing evidence of the commission of an offence, expose…
- **Sch. 2 para. 21**: (1) The listed GDPR provisions do not apply to personal data processed for the purposes of or in connection with a corporate finance service provided by a…
- **Sch. 2 para. 22**: The listed GDPR provisions do not apply to personal data processed for the purposes of management forecasting or management planning in relation to a business…
- **Sch. 2 para. 23**: The listed GDPR provisions do not apply to personal data that consists of records of the intentions of the controller in relation to any negotiations with the…
- **Sch. 2 para. 24**: The listed GDPR provisions do not apply to personal data consisting of a reference given (or to be given) in confidence for the purposes of— (a) the education…
- **Sch. 2 para. 25**: (1) The listed GDPR provisions do not apply to personal data consisting of information recorded by candidates during an exam. (2) Where personal data consists…
- **Sch. 2 para. 26**: (1) In this paragraph, “the special purposes” means one or more of the following— (a) the purposes of journalism; (b) academic purposes; (c) artistic purposes…
- **Sch. 2 para. 27**: (1) The listed GDPR provisions do not apply to personal data processed for— (a) scientific or historical research purposes, or (b) statistical purposes, to the…
- **Sch. 2 para. 28**: (1) The listed GDPR provisions do not apply to personal data processed for archiving purposes in the public interest to the extent that the application of…

### SCHEDULE 3

- **Sch. 3 para. 1**: In this Schedule “the listed GDPR provisions” means the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of…
- **Sch. 3 para. 2**: (1) In this Part of this Schedule— “the appropriate health professional”, in relation to a question as to whether the serious harm test is met with respect to…
- **Sch. 3 para. 3**: (1) The listed GDPR provisions do not apply to data concerning health if— (a) it is processed by a court, (b) it consists of information supplied in a report…
- **Sch. 3 para. 4**: (1) This paragraph applies where a request for data concerning health is made in exercise of a power conferred by an enactment or rule of law and— (a) in…
- **Sch. 3 para. 5**: (1) Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not apply to data concerning…
- **Sch. 3 para. 6**: (1) Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not permit the disclosure of…
- **Sch. 3 para. 7**: (1) In this Part of this Schedule— “education data” has the meaning given by paragraph 17 of this Schedule; “Health and Social Care trust” means a Health and…
- **Sch. 3 para. 8**: (1) This paragraph applies to personal data falling within any of the following descriptions— (a) data processed by a local authority— (i) in connection with…
- **Sch. 3 para. 9**: (1) The listed GDPR provisions do not apply to data that is not education data or data concerning health if— (a) it is processed by a court, (b) it consists of…
- **Sch. 3 para. 10**: (1) This paragraph applies where a request for social work data is made in exercise of a power conferred by an enactment or rule of law and— (a) in relation to…
- **Sch. 3 para. 11**: Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not apply to social work data to…
- **Sch. 3 para. 12**: (1) This paragraph applies where— (a) a question arises as to whether a controller who is a social work authority is obliged by Article 15(1) to (3) of the UK…
- **Sch. 3 para. 13**: In this Part of this Schedule “educational record” means a record to which paragraph 14, 15 or 16 applies.
- **Sch. 3 para. 14**: (1) This paragraph applies to a record of information which— (a) is processed by or on behalf of the proprietor of, or a teacher at, a school in England and…
- **Sch. 3 para. 15**: (1) This paragraph applies to a record of information which is processed— (a) by an education authority in Scotland, and (b) for the purpose of the relevant…
- **Sch. 3 para. 16**: (1) This paragraph applies to a record of information which— (a) is processed by or on behalf of the Board of Governors, proprietor or trustees of, or a…
- **Sch. 3 para. 17**: (1) In this Part of this Schedule— “education authority” and “further education” have the same meaning as in the Education (Scotland) Act 1980; “education…
- **Sch. 3 para. 18**: (1) The listed GDPR provisions do not apply to education data if— (a) it is processed by a court, (b) it consists of information supplied in a report or other…
- **Sch. 3 para. 19**: Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not apply to education data to…
- **Sch. 3 para. 20**: (1) This paragraph applies where— (a) a question arises as to whether a controller who is an education authority is obliged by Article 15(1) to (3) of the UK…
- **Sch. 3 para. 21**: (1) This paragraph applies where a request for child abuse data is made in exercise of a power conferred by an enactment or rule of law and— (a) the data…

### SCHEDULE 4

- **Sch. 4 para. 1**: In this Schedule “the listed GDPR provisions” means the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of…
- **Sch. 4 para. 2**: The listed GDPR provisions do not apply to personal data consisting of information the disclosure of which is prohibited or restricted by any of sections 31…
- **Sch. 4 para. 3**: (1) The listed GDPR provisions do not apply to personal data consisting of information the disclosure of which is prohibited or restricted by an enactment…
- **Sch. 4 para. 4**: (1) The listed GDPR provisions do not apply to personal data consisting of information the disclosure of which is prohibited or restricted by an enactment…
- **Sch. 4 para. 5**: (1) The listed GDPR provisions do not apply to personal data consisting of information the disclosure of which is prohibited or restricted by an enactment…
- **Sch. 4 para. 6**: The listed GDPR provisions do not apply to personal data consisting of information the disclosure of which is prohibited or restricted by any of the following…

### SCHEDULE 5

- **Sch. 5 para. 1**: (1) This Schedule applies where— (a) a person (“the applicant”) applies to an accreditation authority for accreditation as a certification provider, and (b) is…
- **Sch. 5 para. 2**: (1) The applicant may ask the accreditation authority to review the decision. (2) The request must be made in writing before the end of the period of 28 days…
- **Sch. 5 para. 3**: (1) If the applicant is dissatisfied with the decision on the review under paragraph 2, the applicant may ask the accreditation authority to refer the decision…
- **Sch. 5 para. 4**: (1) If the applicant makes a request in accordance with paragraph 3, an appeal panel must be established in accordance with this paragraph. (2) An appeal panel…
- **Sch. 5 para. 5**: (1) If the appeal panel considers it necessary, a hearing must be held at which both the applicant and the accreditation authority may be represented. (2) Any…
- **Sch. 5 para. 6**: (1) The appeal panel must, before the end of the period of 28 days beginning with the day on which the appeal panel is established in accordance with paragraph…
- **Sch. 5 para. 7**: In this Schedule, “working day” means any day other than— (a) Saturday or Sunday, (b) Christmas Day or Good Friday, or (c) a day which is a bank holiday under…

### SCHEDULE 7

- **Sch. 7 para. 1**: Any United Kingdom government department other than a non-ministerial government department.
- **Sch. 7 para. 2**: The Scottish Ministers.
- **Sch. 7 para. 3**: Any Northern Ireland department.
- **Sch. 7 para. 4**: The Welsh Ministers.
- **Sch. 7 para. 5**: The chief constable of a police force maintained under section 2 of the Police Act 1996.
- **Sch. 7 para. 6**: The Commissioner of Police of the Metropolis.
- **Sch. 7 para. 7**: The Commissioner of Police for the City of London.
- **Sch. 7 para. 8**: The Chief Constable of the Police Service of Northern Ireland.
- **Sch. 7 para. 9**: The chief constable of the Police Service of Scotland.
- **Sch. 7 para. 10**: The chief constable of the British Transport Police.
- **Sch. 7 para. 11**: The chief constable of the Civil Nuclear Constabulary.
- **Sch. 7 para. 12**: The chief constable of the Ministry of Defence Police.
- **Sch. 7 para. 13**: The Provost Marshal of the Royal Navy Police.
- **Sch. 7 para. 14**: The Provost Marshal of the Royal Military Police.
- **Sch. 7 para. 15**: The Provost Marshal of the Royal Air Force Police.
- **Sch. 7 para. 15A**: The Provost Marshal for serious crime.
- **Sch. 7 para. 16**: The chief officer of— (a) a body of constables appointed under provision incorporating section 79 of the Harbours, Docks, and Piers Clauses Act 1847; (b) a…
- **Sch. 7 para. 17**: A body established in accordance with a collaboration agreement under section 22A of the Police Act 1996.
- **Sch. 7 para. 18**: The Director General of the Independent Office for Police Conduct.
- **Sch. 7 para. 18A**: The Service Police Complaints Commissioner.
- **Sch. 7 para. 19**: The Police Investigations and Review Commissioner.
- **Sch. 7 para. 20**: The Police Ombudsman for Northern Ireland.
- **Sch. 7 para. 21**: The Commissioners for Her Majesty's Revenue and Customs.
- **Sch. 7 para. 22**: The Welsh Revenue Authority.
- **Sch. 7 para. 23**: Revenue Scotland.
- **Sch. 7 para. 24**: The Director General of the National Crime Agency.
- **Sch. 7 para. 25**: The Director of the Serious Fraud Office.
- **Sch. 7 para. 26**: The Director of Border Revenue.
- **Sch. 7 para. 27**: The Financial Conduct Authority.
- **Sch. 7 para. 28**: The Health and Safety Executive.
- **Sch. 7 para. 29**: The Competition and Markets Authority.
- **Sch. 7 para. 30**: The Gas and Electricity Markets Authority.
- **Sch. 7 para. 31**: The Food Standards Agency.
- **Sch. 7 para. 32**: Food Standards Scotland.
- **Sch. 7 para. 33**: Her Majesty's Land Registry.
- **Sch. 7 para. 34**: The Criminal Cases Review Commission.
- **Sch. 7 para. 35**: The Scottish Criminal Cases Review Commission.
- **Sch. 7 para. 36**: A provider of probation services (other than the Secretary of State), acting in pursuance of arrangements made under section 3(2) of the Offender Management…
- **Sch. 7 para. 37**: The Youth Justice Board for England and Wales.
- **Sch. 7 para. 38**: The Parole Board for England and Wales.
- **Sch. 7 para. 39**: The Parole Board for Scotland.
- **Sch. 7 para. 40**: The Parole Commissioners for Northern Ireland.
- **Sch. 7 para. 41**: The Probation Board for Northern Ireland.
- **Sch. 7 para. 42**: The Prisoner Ombudsman for Northern Ireland.
- **Sch. 7 para. 43**: A person who has entered into a contract for the running of, or part of— (a) a prison or young offender institution under section 84 of the Criminal Justice…
- **Sch. 7 para. 44**: A person who has entered into a contract with the Secretary of State— (a) under section 80 of the Criminal Justice Act 1991 for the purposes of prisoner escort…
- **Sch. 7 para. 45**: A person who is, under or by virtue of any enactment, responsible for securing the electronic monitoring of an individual.
- **Sch. 7 para. 46**: A youth offending team established under section 39 of the Crime and Disorder Act 1998.
- **Sch. 7 para. 47**: The Director of Public Prosecutions.
- **Sch. 7 para. 48**: The Director of Public Prosecutions for Northern Ireland.
- **Sch. 7 para. 49**: The Lord Advocate.
- **Sch. 7 para. 50**: A Procurator Fiscal.
- **Sch. 7 para. 51**: The Director of Service Prosecutions.
- **Sch. 7 para. 51A**: The Information Commission.
- **Sch. 7 para. 53**: The Scottish Information Commissioner.
- **Sch. 7 para. 54**: The Scottish Courts and Tribunal Service.
- **Sch. 7 para. 55**: The Crown agent.
- **Sch. 7 para. 56**: A court or tribunal.
- **Sch. 7 para. 57**: The Border Security Commander.

### SCHEDULE 8

- **Sch. 8 para. 1**: This condition is met if the processing— (a) is necessary for the exercise of a function conferred on a person by an enactment or rule of law, and (b) is…
- **Sch. 8 para. 2**: This condition is met if the processing is necessary for the administration of justice.
- **Sch. 8 para. 3**: This condition is met if the processing is necessary to protect the vital interests of the data subject or of another individual.
- **Sch. 8 para. 4**: (1) This condition is met if— (a) the processing is necessary for the purposes of— (i) protecting an individual from neglect or physical, mental or emotional…
- **Sch. 8 para. 5**: This condition is met if the processing relates to personal data which is manifestly made public by the data subject.
- **Sch. 8 para. 6**: This condition is met if the processing— (a) is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal…
- **Sch. 8 para. 7**: This condition is met if the processing is necessary when a court or other judicial authority is acting in its judicial capacity.
- **Sch. 8 para. 8**: (1) This condition is met if the processing— (a) is necessary for the purposes of preventing fraud or a particular kind of fraud, and (b) consists of— (i) the…
- **Sch. 8 para. 9**: This condition is met if the processing is necessary— (a) for archiving purposes in the public interest, (b) for scientific or historical research purposes, or…

### SCHEDULE 9

- **Sch. 9 para. 1**: The data subject has given consent to the processing.
- **Sch. 9 para. 2**: The processing is necessary— (a) for the performance of a contract to which the data subject is a party, or (b) in order to take steps at the request of the…
- **Sch. 9 para. 3**: The processing is necessary for compliance with a legal obligation to which the controller is subject, other than an obligation imposed by contract.
- **Sch. 9 para. 4**: The processing is necessary in order to protect the vital interests of the data subject or of another individual.
- **Sch. 9 para. 5**: The processing is necessary— (a) for the administration of justice, (b) for the exercise of any functions of either House of Parliament, (c) for the exercise…
- **Sch. 9 para. 6**: (1) The processing is necessary for the purposes of legitimate interests pursued by— (a) the controller, or (b) the third party or parties to whom the data is…

### SCHEDULE 10

- **Sch. 10 para. 1**: The data subject has given consent to the processing.
- **Sch. 10 para. 2**: The processing is necessary for the purposes of exercising or performing any right or obligation which is conferred or imposed by an enactment or rule of law…
- **Sch. 10 para. 3**: The processing is necessary— (a) in order to protect the vital interests of the data subject or of another person, in a case where— (i) consent cannot be given…
- **Sch. 10 para. 4**: (1) This condition is met if— (a) the processing is necessary for the purposes of— (i) protecting an individual from neglect or physical, mental or emotional…
- **Sch. 10 para. 5**: The information contained in the personal data has been made public as a result of steps deliberately taken by the data subject.
- **Sch. 10 para. 6**: The processing— (a) is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings), (b) is necessary…
- **Sch. 10 para. 7**: The processing is necessary— (a) for the administration of justice, (b) for the exercise of any functions of either House of Parliament, (c) for the exercise…
- **Sch. 10 para. 8**: (1) The processing is necessary for medical purposes and is undertaken by— (a) a health professional, or (b) a person who in the circumstances owes a duty of…
- **Sch. 10 para. 9**: (1) The processing— (a) is of sensitive personal data consisting of information as to racial or ethnic origin, (b) is necessary for the purpose of identifying…

### SCHEDULE 11

- **Sch. 11 para. 1**: In this Schedule, “the listed provisions” means— (a) Chapter 2 of Part 4 (the data protection principles), except section 86(1)(a) and (2) and Schedules 9 and…
- **Sch. 11 para. 2**: The listed provisions do not apply to personal data processed for any of the following purposes— (a) the prevention, investigation and detection of crime, or…
- **Sch. 11 para. 3**: (1) The listed provisions do not apply to personal data consisting of information that the controller is obliged by an enactment to make available to the…
- **Sch. 11 para. 4**: The listed provisions do not apply to personal data where this is required for the purpose of avoiding an infringement of the privileges of either House of…
- **Sch. 11 para. 5**: The listed provisions do not apply to personal data to the extent that the application of the listed provisions would be likely to prejudice judicial…
- **Sch. 11 para. 6**: The listed provisions do not apply to personal data processed for the purposes of the conferring by the Crown of any honour or dignity.
- **Sch. 11 para. 7**: The listed provisions do not apply to personal data to the extent that the application of the listed provisions would be likely to prejudice the combat…
- **Sch. 11 para. 8**: The listed provisions do not apply to personal data to the extent that the application of the listed provisions would be likely to prejudice the economic…
- **Sch. 11 para. 9**: The listed provisions do not apply to personal data that consists of— (a) information in respect of which a claim to legal professional privilege or, in…
- **Sch. 11 para. 10**: The listed provisions do not apply to personal data that consists of records of the intentions of the controller in relation to any negotiations with the data…
- **Sch. 11 para. 11**: The listed provisions do not apply to personal data consisting of a reference given (or to be given) in confidence by the controller for the purposes of— (a)…
- **Sch. 11 para. 12**: (1) The listed provisions do not apply to personal data consisting of information recorded by candidates during an exam. (2) Where personal data consists of…
- **Sch. 11 para. 13**: (1) The listed provisions do not apply to personal data processed for— (a) scientific or historical research purposes, or (b) statistical purposes, to the…
- **Sch. 11 para. 14**: (1) The listed provisions do not apply to personal data processed for archiving purposes in the public interest to the extent that the application of those…

### Schedule 12A

- **Sch. 12A para. 1 Status**: (1) The Commission is not to be regarded— (a) as a servant or agent of the Crown, or (b) as enjoying any status, immunity or privilege of the Crown. (2) The…
- **Sch. 12A para. 2 Number of members**: (1) The number of members of the Commission is to be determined by the Secretary of State. (2) That number must not be— (a) less than 3, or (b) more than 14…
- **Sch. 12A para. 3 Membership: general**: (1) The Commission is to consist of— (a) the non-executive members, and (b) the executive members. (2) The non-executive members are— (a) a chair appointed by…
- **Sch. 12A para. 4 Membership: non-executive members to outnumber executive members**: The Secretary of State must exercise the powers conferred on the Secretary of State by paragraphs 2 and 3 so as to secure that the number of non-executive…
- **Sch. 12A para. 5 Membership: selection on merit etc**: (1) The Secretary of State may not recommend a person for appointment as the chair of the Commission unless the person has been selected on merit on the basis…
- **Sch. 12A para. 6 Membership: conflicts of interests**: (1) Before— (a) recommending a person for appointment as the chair of the Commission, or (b) appointing a person as a non-executive member of the Commission…
- **Sch. 12A para. 7 Tenure of the chair**: (1) The chair of the Commission holds and vacates office in accordance with the terms of the chair’s appointment, subject to the provisions of this paragraph…
- **Sch. 12A para. 8 Tenure of deputy chair**: (1) A deputy chair of the Commission may resign that office by giving written notice to the Commission. (2) A deputy chair of the Commission ceases to hold…
- **Sch. 12A para. 9 Tenure of the other non-executive members**: (1) This paragraph applies to a non-executive member of the Commission appointed by the Secretary of State. (2) The member holds and vacates office in…
- **Sch. 12A para. 10 Remuneration and pensions of non-executive members**: (1) The Commission may pay to the non-executive members of the Commission such remuneration and allowances as the Secretary of State may determine. (2) The…
- **Sch. 12A para. 11 Executive members: terms and conditions**: (1) The executive members of the Commission are to be employees of the Commission. (2) The executive members are to be employed by the Commission on such terms…
- **Sch. 12A para. 12 Other staff: appointment, terms and conditions**: (1) The Commission may— (a) appoint other employees, and (b) make such other arrangements for the staffing of the Commission as it considers appropriate. (2)…
- **Sch. 12A para. 13 Committees**: (1) The Commission may establish committees. (2) A committee of the Commission may consist of or include persons who are neither members nor employees of the…
- **Sch. 12A para. 14 Delegation of functions**: (1) The Commission may delegate any of its functions to— (a) a member of the Commission, (b) an employee of the Commission, or (c) a committee of the…
- **Sch. 12A para. 15 Advice from committees**: The Commission may require a committee of the Commission to give the Commission advice about matters relating to the discharge of the Commission’s functions.
- **Sch. 12A para. 16 Proceedings**: (1) The Commission may make arrangements for regulating— (a) its own procedure, and (b) the procedure of a committee of the Commission. (2) The non-executive…
- **Sch. 12A para. 17 Records of proceedings**: The Commission must make arrangements for the keeping of proper records of— (a) its proceedings, (b) the proceedings of a committee of the Commission, (c) the…
- **Sch. 12A para. 18 Disqualification for acting in relation to certain matters**: (1) This paragraph applies if— (a) a member of the Commission has a direct or indirect interest in a matter falling to be considered at a meeting of the…
- **Sch. 12A para. 19 Validity of proceedings**: (1) The validity of proceedings of the Commission, of the non-executive members of the Commission or of a committee of the Commission is not affected by— (a) a…
- **Sch. 12A para. 20 Money**: The Secretary of State may make payments to the Commission.
- **Sch. 12A para. 21 Fees etc and other sums**: (1) All fees, charges, penalties and other sums received by the Commission in carrying out its functions are to be paid to the Secretary of State. (2)…
- **Sch. 12A para. 22 Accounts**: (1) The Commission must keep proper accounts and proper records in relation to them. (2) The Commission must prepare a statement of accounts in respect of each…
- **Sch. 12A para. 23 Authentication of seal and presumption of authenticity of documents**: (1) The application of the Commission’s seal must be authenticated by the signature of— (a) the chair of the Commission, or (b) another person authorised for…
- **Sch. 12A para. 24 Supplementary powers**: The Commission may do anything it thinks appropriate for the purposes of, or in connection with, its functions.
- **Sch. 12A para. 25 Transitional provision: interim chief executive**: (1) The first chief executive of the Commission is to be appointed by the chair of the Commission. (2) Before making the appointment the chair must consult the…
- **Sch. 12A para. 26 Interpretation**: In this Schedule— (a) references to pensions, allowances or gratuities include references to any similar benefits provided on death or retirement, and (b)…

### SCHEDULE 13

- **Sch. 13 para. 1**: (1) The Commission must— (a) monitor and enforce Parts 3 and 4 of this Act; (b) promote public awareness and understanding of the risks, rules, safeguards and…
- **Sch. 13 para. 2**: The Commission has the following investigative, corrective, authorisation and advisory powers in relation to processing of personal data to which Part 3 or 4…
- **Sch. 13 para. 3**: In this Schedule— “foreign designated authority” means an authority designated for the purposes of Article 13 of the Data Protection Convention by a party…

### SCHEDULE 14

- **Sch. 14 para. 6**: (1) The Commission must, at the request of a foreign designated authority— (a) provide that authority with such information referred to in Article 13(3)(a) of…
- **Sch. 14 para. 7**: (1) This paragraph applies where a request for assistance in exercising any of the rights referred to in Article 8 of the Data Protection Convention in the…
- **Sch. 14 para. 8**: (1) This paragraph applies where a request for assistance in exercising any of the rights referred to in Article 8 of the Data Protection Convention in a…
- **Sch. 14 para. 9**: Where the Commission receives information from a foreign designated authority as a result of— (a) a request made by the Commission under paragraph 6(2), or (b)…
- **Sch. 14 para. 10**: In this Part of this Schedule, “foreign designated authority” means an authority designated for the purposes of Article 13 of the Data Protection Convention by…

### SCHEDULE 15

- **Sch. 15 para. 1**: (1) This paragraph applies if a judge of the High Court, a circuit judge or a District Judge (Magistrates' Courts) is satisfied by information on oath supplied…
- **Sch. 15 para. 2**: (1) This paragraph applies if a judge of the High Court, a circuit judge or a District Judge (Magistrates' Courts) is satisfied by information on oath supplied…
- **Sch. 15 para. 3**: A judge must not issue a warrant under this Schedule in respect of personal data processed for the special purposes unless a determination under section 174…
- **Sch. 15 para. 4**: (1) A judge must not issue a warrant under this Schedule unless satisfied that— (a) the conditions in sub-paragraphs (2) to (4) are met, (b) compliance with…
- **Sch. 15 para. 5**: (1) A warrant issued under this Schedule must authorise any of the Commission’s officers or staff— (a) to enter the premises, (b) to search the premises, and…
- **Sch. 15 para. 6**: A judge who issues a warrant under this Schedule must— (a) issue two copies of it, and (b) certify them clearly as copies.
- **Sch. 15 para. 7**: A person executing a warrant issued under this Schedule may use such reasonable force as may be necessary.
- **Sch. 15 para. 8**: A warrant issued under this Schedule may be executed only at a reasonable hour, unless it appears to the person executing it that there are grounds for…
- **Sch. 15 para. 9**: (1) If an occupier of the premises in respect of which a warrant is issued under this Schedule is present when the warrant is executed, the person executing…
- **Sch. 15 para. 10**: (1) This paragraph applies where a person executing a warrant under this Schedule seizes something. (2) The person must, on request— (a) give a receipt for it…
- **Sch. 15 para. 11**: (1) The powers of inspection and seizure conferred by a warrant issued under this Schedule are not exercisable in respect of a communication which is made— (a)…
- **Sch. 15 para. 12**: The powers of inspection and seizure conferred by a warrant issued under this Schedule are not exercisable where their exercise would involve an infringement…
- **Sch. 15 para. 13**: (1) This paragraph applies if a person in occupation of premises in respect of which a warrant is issued under this Schedule objects to the inspection or…
- **Sch. 15 para. 14**: (1) Where a warrant issued under this Schedule is executed— (a) it must be returned to the court from which it was issued after being executed, and (b) the…
- **Sch. 15 para. 15**: (1) It is an offence for a person— (a) intentionally to obstruct a person in the execution of a warrant issued under this Schedule, or (b) to fail without…
- **Sch. 15 para. 16**: (1) An explanation given, or information provided, by a person in response to a requirement under paragraph 5(2)(c) or (d) or (3)(c) or (d) may only be used in…
- **Sch. 15 para. 17**: In this Schedule— (a) “premises” includes a vehicle, vessel or other means of transport, and (b) references to the occupier of premises include the person in…
- **Sch. 15 para. 18**: In the application of this Schedule to Scotland— (a) references to a judge of the High Court have effect as if they were references to a judge of the Court of…
- **Sch. 15 para. 19**: In the application of this Schedule to Northern Ireland— (a) references to a circuit judge have effect as if they were references to a county court judge, and…

### SCHEDULE 16

- **Sch. 16 para. 1**: In this Schedule, “penalty” means a penalty imposed by a penalty notice.
- **Sch. 16 para. 2**: (1) Before giving a person a penalty notice, the Commission must, by written notice (a “notice of intent”) inform the person that the Commission intends to…
- **Sch. 16 para. 3**: (1) A notice of intent must contain the following information— (a) the name and address of the person to whom the Commission proposes to give a penalty notice…
- **Sch. 16 para. 4**: (A1) This paragraph applies where the Commission gives a notice of intent to a person. (A2) Within the period of 6 months beginning when the notice is given…
- **Sch. 16 para. 5**: (1) A penalty notice must contain the following information— (a) the name and address of the person to whom it is addressed; (b) details of the notice of…
- **Sch. 16 para. 6**: (1) A penalty must be paid to the Commission within the period specified in the penalty notice. (2) The period specified must be a period of not less than 28…
- **Sch. 16 para. 7**: (1) The Commission may vary a penalty notice by giving written notice (a “penalty variation notice”) to the person to whom it was given. (2) A penalty…
- **Sch. 16 para. 8**: (1) The Commission may cancel a penalty notice by giving written notice to the person to whom it was given. (2) If a penalty notice is cancelled, the…
- **Sch. 16 para. 9**: (1) The Commission must not take action to recover a penalty unless— (a) the period specified in accordance with paragraph 6 has ended, (b) any appeals against…

### SCHEDULE 17

- **Sch. 17 para. 1**: In this Schedule— “relevant period” means— ... the period of 12 months beginning when the Commission starts a ... review under section 178; “the relevant…
- **Sch. 17 para. 2**: (1) This paragraph applies where the Commission gives an information notice during a relevant period. (2) If the information notice— (a) states that, in the…
- **Sch. 17 para. 3**: (1) Sub-paragraph (2) applies where the Commission gives an assessment notice to a person during a relevant period. (2) If the assessment notice— (a) states…
- **Sch. 17 para. 3A**: (1) Sub-paragraph (2) applies where the Commission gives an interview notice to an individual during a relevant period. (2) If the interview notice— (a) states…
- **Sch. 17 para. 4**: Section 164 applies where an information notice, assessment notice or interview notice contains a statement under paragraph 2(2)(a), 3(2)(a) or 3A(2)(a) as it…

### SCHEDULE 18

- **Sch. 18 para. 1**: (1) In section 184, “relevant record” means— (a) a relevant health record (see paragraph 2), (b) a relevant record relating to a conviction or caution (see…
- **Sch. 18 para. 2**: “Relevant health record” means a health record which has been or is to be obtained by a data subject in the exercise of a data subject access right.
- **Sch. 18 para. 3**: (1) “Relevant record relating to a conviction or caution” means a record which— (a) has been or is to be obtained by a data subject in the exercise of a data…
- **Sch. 18 para. 4**: (1) “Relevant record relating to statutory functions” means a record which— (a) has been or is to be obtained by a data subject in the exercise of a data…
- **Sch. 18 para. 5**: In this Schedule, “data subject access right” means a right under— (a) Article 15 of the UK GDPR (right of access by the data subject); (b) Article 20 of the…
- **Sch. 18 para. 6**: For the purposes of this Schedule, a record which states that a controller is not processing personal data relating to a particular matter is to be taken to be…
- **Sch. 18 para. 7**: (1) The Secretary of State may by regulations amend this Schedule. (2) Regulations under this paragraph are subject to the affirmative resolution procedure.

### SCHEDULE 19

- **Sch. 19 para. 1**: (1) Section 19AC of the Registration Service Act 1953 (codes of practice) is amended as follows. (2) In subsection (2), for “issued under section 52B…
- **Sch. 19 para. 2**: (1) Section 1A of the Veterinary Surgeons Act 1966 (functions of the Royal College of Veterinary Surgeons as competent authority) is amended as follows. (2) In…
- **Sch. 19 para. 3**: In section 11AA(1) of the Parliamentary Commissioner Act 1967 (disclosure of information by Parliamentary Commissioner to Information Commissioner)— (a) in…
- **Sch. 19 para. 4**: The Local Government Act 1974 is amended as follows.
- **Sch. 19 para. 5**: In section 33A(1) (disclosure of information by Local Commissioner to Information Commissioner)— (a) in paragraph (a), for sub-paragraph (i) substitute— (i)…
- **Sch. 19 para. 6**: In section 34O(1) (disclosure of information by Local Commissioner to Information Commissioner)— (a) in paragraph (a), for sub-paragraph (i) substitute— (i)…
- **Sch. 19 para. 7**: The Consumer Credit Act 1974 is amended as follows.
- **Sch. 19 para. 8**: In section 157(2A) (duty to disclose name etc of agency)— (a) in paragraph (a), for “the Data Protection Act 1998” substitute “ the GDPR ”, and (b) in…
- **Sch. 19 para. 9**: In section 159(1)(a) (correction of wrong information) for “section 7 of the Data Protection Act 1998” substitute “ Article 15(1) to (3) of the GDPR…
- **Sch. 19 para. 10**: In section 189(1) (definitions), at the appropriate place insert— “the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see…
- **Sch. 19 para. 11**: The Pharmacy (Northern Ireland) Order 1976 is amended as follows.
- **Sch. 19 para. 12**: In article 2(2) (interpretation), omit the definition of “Directive 95/46/EC”.
- **Sch. 19 para. 13**: In article 8D (European professional card), after paragraph (3) insert— (4) In Schedule 2C, “the GDPR” means Regulation (EU) 2016/679 of the European…
- **Sch. 19 para. 14**: In article 22A(6) (Directive 2005/36/EC: functions of competent authority etc.), before sub-paragraph (a) insert— (za) “the GDPR” means Regulation (EU)…
- **Sch. 19 para. 15**: (1) Schedule 2C (Directive 2005/36/EC: European professional card) is amended as follows. (2) In paragraph 8(1) (access to data), for “Directive 95/46/EC”…
- **Sch. 19 para. 16**: (1) The table in Schedule 2D (functions of the Society under Directive 2005/36/EC) is amended as follows. (2) In the entry for Article 56(2), in the second…
- **Sch. 19 para. 17**: (1) Paragraph 2 of Schedule 3 (fitness to practice: disclosure of information) is amended as follows. (2) In sub-paragraph (2)(a), after “provision” insert “…
- **Sch. 19 para. 18**: (1) Schedule 2 to the Representation of the People Act 1983 (provisions which may be contained in regulations as to registration etc) is amended as follows…
- **Sch. 19 para. 19**: The Medical Act 1983 is amended as follows.
- **Sch. 19 para. 20**: (1) Section 29E (evidence) is amended as follows. (2) In subsection (5), after “enactment” insert “ or the GDPR ”. (3) For subsection (7) substitute— (7) In…
- **Sch. 19 para. 21**: (1) Section 35A (General Medical Council's power to require disclosure of information) is amended as follows. (2) In subsection (4), after “enactment” insert “…
- **Sch. 19 para. 22**: In section 49B(7) (Directive 2005/36: designation of competent authority etc.), after “Schedule 4A” insert — “the GDPR” means Regulation (EU) 2016/679 of the…
- **Sch. 19 para. 23**: In section 55(1) (interpretation), omit the definition of “Directive 95/46/EC”.
- **Sch. 19 para. 24**: (1) Paragraph 9B of Schedule 1 (incidental powers of the General Medical Council) is amended as follows. (2) In sub-paragraph (2)(a), after “enactment” insert…
- **Sch. 19 para. 25**: (1) Paragraph 5A of Schedule 4 (professional performance assessments and health assessments) is amended as follows. (2) In sub-paragraph (8), after “enactment”…
- **Sch. 19 para. 26**: (1) The table in Schedule 4A (functions of the General Medical Council as competent authority under Directive 2005/36) is amended as follows. (2) In the entry…
- **Sch. 19 para. 27**: The Dentists Act 1984 is amended as follows.
- **Sch. 19 para. 28**: (1) Section 33B (the General Dental Council's power to require disclosure of information: the dental profession) is amended as follows. (2) In subsection (3)…
- **Sch. 19 para. 29**: In section 36ZA(6) (Directive 2005/36: designation of competent authority etc), after “Schedule 4ZA—” insert— “the GDPR” means Regulation (EU) 2016/679 of the…
- **Sch. 19 para. 30**: (1) Section 36Y (the General Dental Council's power to require disclosure of information: professions complementary to dentistry) is amended as follows. (2) In…
- **Sch. 19 para. 31**: In section 53(1) (interpretation), omit the definition of “Directive 95/46/EC”.
- **Sch. 19 para. 32**: (1) The table in Schedule 4ZA (Directive 2005/36: functions of the General Dental Council under section 36ZA(3)) is amended as follows. (2) In the entry for…
- **Sch. 19 para. 33**: In section 449(11) of the Companies Act 1985 (provision for security of information obtained), for “the Data Protection Act 1998” substitute “ the data…
- **Sch. 19 para. 34**: In section 2(1) of the Access to Medical Reports Act 1988 (interpretation), for the definition of “health professional” substitute— “health professional” has…
- **Sch. 19 para. 35**: (1) Section 13B of the Opticians Act 1989 (the Council's power to require disclosure of information) is amended as follows. (2) In subsection (3), after…
- **Sch. 19 para. 36**: The Access to Health Records Act 1990 is amended as follows.
- **Sch. 19 para. 37**: For section 2 substitute— Health professionals 2 In this Act, “health professional” has the same meaning as in the Data Protection Act 2018 (see section 204 of…
- **Sch. 19 para. 38**: (1) Section 3 (right of access to health records) is amended as follows. (2) In subsection (2), omit “Subject to subsection (4) below,”. (3) In subsection (4)…
- **Sch. 19 para. 39**: (1) Section 33D of the Human Fertilisation and Embryology Act 1990 (disclosure for the purposes of medical or other research) is amended as follows. (2) In…
- **Sch. 19 para. 40**: (1) Section 251B of the Trade Union and Labour Relations (Consolidation) Act 1992 (prohibition on disclosure of information) is amended as follows. (2) In…
- **Sch. 19 para. 41**: In the table in Part 1 of Schedule 1 to the Tribunals and Inquiries Act 1992 (tribunals to which the Act applies), in the second column, in paragraph 14(a)…
- **Sch. 19 para. 42**: (1) Article 90B of the Industrial Relations (Northern Ireland) Order 1992 (prohibition on disclosure of information held by the Labour Relations Agency) is…
- **Sch. 19 para. 43**: In section 18A(1) of the Health Service Commissioners Act 1993 (power to disclose information)— (a) in paragraph (a), for sub-paragraph (i) substitute— (i)…
- **Sch. 19 para. 44**: The Data Protection Act 1998 is repealed, with the exception of section 62 and paragraphs 13, 15, 16, 18 and 19 of Schedule 15 (which amend other enactments).
- **Sch. 19 para. 45**: In section 17A(4) of the Crime and Disorder Act 1998 (sharing of information), for “(within the meaning of the Data Protection Act 1998)” substitute “ (within…
- **Sch. 19 para. 46**: (1) Section 19 of the Food Standards Act 1999 (publication etc by the Food Standards Agency of advice and information) is amended as follows. (2) In subsection…
- **Sch. 19 para. 47**: (1) Section 13 of the Immigration and Asylum Act 1999 (proof of identity of persons to be removed or deported) is amended as follows. (2) For subsection (4)…
- **Sch. 19 para. 48**: The Financial Services and Markets Act 2000 is amended as follows.
- **Sch. 19 para. 50**: In section 391A(6)(b) (publication: special provisions relating to the capital requirements directive), for “the Data Protection Act 1998” substitute “ the…
- **Sch. 19 para. 51**: In section 391C(7)(a) (publication: special provisions relating to the UCITS directive), for “the Data Protection Act 1998” substitute “ the data protection…
- **Sch. 19 para. 52**: In section 391D(9)(a) (publication: special provisions relating to the markets in financial instruments directive), for “the Data Protection Act 1998”…
- **Sch. 19 para. 53**: In section 417 (definitions), at the appropriate place insert— “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see…
- **Sch. 19 para. 54**: In section 21F(2)(d) of the Terrorism Act 2000 (other permitted disclosures between institutions etc) for “(within the meaning of section 1 of the Data…
- **Sch. 19 para. 55**: The Freedom of Information Act 2000 is amended as follows.
- **Sch. 19 para. 56**: In section 2(3) (absolute exemptions), for paragraph (f) substitute— (f) section 40(1), (fa) section 40(2) so far as relating to cases where the first…
- **Sch. 19 para. 57**: In section 18 (the Information Commissioner), omit subsection (1).
- **Sch. 19 para. 58**: (1) Section 40 (personal information) is amended as follows. (2) In subsection (2)— (a) in paragraph (a), for “do” substitute “ does ”, and (b) in paragraph…
- **Sch. 19 para. 59**: Omit section 49 (reports to be laid before Parliament).
- **Sch. 19 para. 60**: For section 61 (appeal proceedings) substitute— Appeal proceedings 61 (1) Tribunal Procedure Rules may make provision for regulating the exercise of rights of…
- **Sch. 19 para. 61**: In section 76(1) (disclosure of information between Commissioner and ombudsmen), for “the Data Protection Act 1998” substitute “ the data protection…
- **Sch. 19 para. 62**: After section 76A insert— Disclosure of information to Tribunal 76B (1) No enactment or rule of law prohibiting or restricting the disclosure of information…
- **Sch. 19 para. 63**: In section 77(1)(b) (offence of altering etc records with intent to prevent disclosure), omit “or section 7 of the Data Protection Act 1998,”.
- **Sch. 19 para. 64**: In section 84 (interpretation), at the appropriate place insert— “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see…
- **Sch. 19 para. 65**: (1) Paragraph 28 of Schedule 19C to the Political Parties, Elections and Referendums Act 2000 (civil sanctions: disclosure of information) is amended as…
- **Sch. 19 para. 66**: The Public Finance and Accountability (Scotland) Act 2000 is amended as follows.
- **Sch. 19 para. 67**: In section 26B(3)(a) (voluntary disclosure of data to Audit Scotland), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation…
- **Sch. 19 para. 68**: In section 26C(3)(a) (power to require disclosure of data), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.
- **Sch. 19 para. 69**: In section 29(1) (interpretation), at the appropriate place insert— “the data protection legislation” has the same meaning as in the Data Protection Act 2018…
- **Sch. 19 para. 70**: The Criminal Justice and Police Act 2001 is amended as follows.
- **Sch. 19 para. 71**: In section 57(1) (retention of seized items)— (a) omit paragraph (m), and (b) after paragraph (s) insert— (t) paragraph 10 of Schedule 15 to the Data…
- **Sch. 19 para. 72**: In section 65(7) (meaning of “legal privilege”)— (a) for “paragraph 1 of Schedule 9 to the Data Protection Act 1998 (c. 29)” substitute “ paragraphs 1 and 2 of…
- **Sch. 19 para. 73**: In Schedule 1 (powers of seizure)— (a) omit paragraph 65, and (b) after paragraph 73T insert— Data Protection Act 2018 73T The power of seizure conferred by…
- **Sch. 19 para. 74**: The Anti-terrorism, Crime and Security Act 2001 is amended as follows.
- **Sch. 19 para. 75**: (1) Section 19 (disclosure of information held by revenue departments) is amended as follows. (2) In subsection (7), for “the Data Protection Act 1998 (c. 29)”…
- **Sch. 19 para. 77**: (1) Section 7A of the Health and Personal Social Services Act (Northern Ireland) 2001 (power to obtain information etc) is amended as follows. (2) In…
- **Sch. 19 para. 78**: (1) Section 5A of the Justice (Northern Ireland) Act 2002 (disclosure of information to the Commission) is amended as follows. (2) In subsection (3)(a), for…
- **Sch. 19 para. 79**: The Proceeds of Crime Act 2002 is amended as follows.
- **Sch. 19 para. 80**: In section 333C(2)(d) (other permitted disclosures between institutions etc), for “(within the meaning of section 1 of the Data Protection Act 1998)”…
- **Sch. 19 para. 81**: In section 436(3)(a) (disclosure of information to certain Directors), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation…
- **Sch. 19 para. 82**: In section 438(8)(a) (disclosure of information by certain Directors), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation…
- **Sch. 19 para. 83**: In section 439(3)(a) (disclosure of information to Lord Advocate and to Scottish Ministers), for “the Data Protection Act 1998 (c. 29)” substitute “ the data…
- **Sch. 19 para. 84**: In section 441(7)(a) (disclosure of information by Lord Advocate and Scottish Ministers), for “the Data Protection Act 1998 (c. 29)” substitute “ the data…
- **Sch. 19 para. 85**: After section 442 insert— Data protection legislation 442A In this Part, “the data protection legislation” has the same meaning as in the Data Protection Act…
- **Sch. 19 para. 86**: (1) Section 237 of the Enterprise Act 2002 (general restriction on disclosure) is amended as follows. (2) In subsection (4), for “the Data Protection Act 1998…
- **Sch. 19 para. 87**: (1) In Schedule 5 to the Scottish Public Services Ombudsman Act 2002 (disclosure of information by the Ombudsman), the entry for the Information Commissioner…
- **Sch. 19 para. 88**: The Freedom of Information (Scotland) Act 2002 is amended as follows.
- **Sch. 19 para. 89**: In section 2(2)(e)(ii) (absolute exemptions), omit “by virtue of subsection (2)(a)(i) or (b) of that section”.
- **Sch. 19 para. 90**: (1) Section 38 (personal information) is amended as follows. (2) In subsection (1), for paragraph (b) substitute— (b) personal data and the first, second or…
- **Sch. 19 para. 91**: Schedule 5 to the Courts Act 2003 (collection of fines) is amended as follows.
- **Sch. 19 para. 92**: (1) Paragraph 9C (disclosure of information in connection with making of attachment of earnings orders or applications for benefit deductions: supplementary)…
- **Sch. 19 para. 93**: (1) Paragraph 10A (attachment of earnings orders (Justice Act (Northern Ireland) 2016): disclosure of information) is amended as follows. (2) In sub-paragraph…
- **Sch. 19 para. 94**: (1) Section 94 of the Sexual Offences Act 2003 (Part 2: supply of information to the Secretary of State etc for verification) is amended as follows. (2) In…
- **Sch. 19 para. 95**: The Criminal Justice Act 2003 is amended as follows.
- **Sch. 19 para. 96**: In section 327A(9) (disclosure of information about convictions etc of child sex offenders to members of the public), for “the Data Protection Act 1998”…
- **Sch. 19 para. 97**: In section 327B (disclosure of information about convictions etc of child sex offenders to members of the public: interpretation), after subsection (4) insert—…
- **Sch. 19 para. 98**: (1) Section 279 of the Mental Health (Care and Treatment) (Scotland) Act 2003 (information for research) is amended as follows. (2) In subsection (2), for…
- **Sch. 19 para. 99**: (1) Section 64C of the Public Audit (Wales) Act 2004 (voluntary provision of data) is amended as follows. (2) In subsection (3)(a), for “the Data Protection…
- **Sch. 19 para. 100**: The Companies (Audit, Investigations and Community Enterprise) Act 2004 is amended as follows.
- **Sch. 19 para. 101**: (1) Section 15A (disclosure of information by tax authorities) is amended as follows. (2) In subsection (2)— (a) omit “within the meaning of the Data…
- **Sch. 19 para. 102**: (1) Section 15D (permitted disclosure of information obtained under compulsory powers) is amended as follows. (2) In subsection (7), for “the Data Protection…
- **Sch. 19 para. 103**: (1) Section 54 of the Domestic Violence, Crime and Victims Act 2004 (disclosure of information) is amended as follows. (2) In subsection (7), for “the Data…
- **Sch. 19 para. 104**: The Children Act 2004 is amended as follows.
- **Sch. 19 para. 105**: (1) Section 12 (information databases) is amended as follows. (2) In subsection (13)(e) for “the Data Protection Act 1998 (c. 29)” substitute “ the data…
- **Sch. 19 para. 106**: (1) Section 29 (information databases: Wales) is amended as follows. (2) In subsection (14)(e) for “the Data Protection Act 1998 (c. 29)” substitute “ the data…
- **Sch. 19 para. 107**: (1) Section 107 of the Constitutional Reform Act 2005 (disclosure of information to the Commission) is amended as follows. (2) In subsection (3)(a), for “the…
- **Sch. 19 para. 108**: In section 64 of the Mental Capacity Act 2005 (interpretation), for the definition of “health record” substitute— “health record” has the same meaning as in…
- **Sch. 19 para. 109**: (1) Section 34X of the Public Services Ombudsman (Wales) Act 2005 (disclosure of information) is amended as follows. (2) In subsection (4), for paragraph (a)…
- **Sch. 19 para. 110**: (1) Section 22 of the Commissioners for Revenue and Customs Act 2005 (data protection, etc) is amended as follows. (2) The existing text becomes subsection…
- **Sch. 19 para. 111**: (1) Section 352 of the Gambling Act 2005 (data protection) is amended as follows. (2) The existing text becomes subsection (1). (3) In that subsection, for…
- **Sch. 19 para. 112**: (1) Section 18 of the Commissioner for Older People (Wales) Act 2006 (power to disclose information) is amended as follows. (2) In subsection (7), for…
- **Sch. 19 para. 113**: The National Health Service Act 2006 is amended as follows.
- **Sch. 19 para. 114**: (1) Section 251 (control of patient information) is amended as follows. (2) In subsection (7), for “made by or under the Data Protection Act 1998 (c 29)”…
- **Sch. 19 para. 115**: (1) Section 264C (provision and disclosure of information about health service products: supplementary) is amended as follows. (2) In subsection (2), for “the…
- **Sch. 19 para. 116**: In paragraph 7B(3) of Schedule 1 (further provision about the Secretary of State and services under the Act), for “has the same meaning as in the Data…
- **Sch. 19 para. 117**: The National Health Service (Wales) Act 2006 is amended as follows.
- **Sch. 19 para. 118**: (1) Section 201C (provision of information about medical supplies: supplementary) is amended as follows. (2) In subsection (2), for “the Data Protection Act…
- **Sch. 19 para. 119**: In paragraph 7B(3) of Schedule 1 (further provision about the Welsh Ministers and services under the Act), for “has the same meaning as in the Data Protection…
- **Sch. 19 para. 120**: The Companies Act 2006 is amended as follows.
- **Sch. 19 para. 121**: In section 458(2) (disclosure of information by tax authorities)— (a) for “within the meaning of the Data Protection Act 1998 (c. 29)” substitute “ within the…
- **Sch. 19 para. 122**: In section 461(7) (permitted disclosure of information obtained under compulsory powers), for “the Data Protection Act 1998 (c. 29)” substitute “ the data…
- **Sch. 19 para. 123**: In section 948(9) (restrictions on disclosure) for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.
- **Sch. 19 para. 124**: In section 1173(1) (minor definitions: general), at the appropriate place insert— “the data protection legislation” has the same meaning as in the Data…
- **Sch. 19 para. 125**: In section 1224A(7) (restrictions on disclosure), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
- **Sch. 19 para. 126**: In section 1253D(3) (restriction on transfer of audit working papers to third countries), for “the Data Protection Act 1998” substitute “ the data protection…
- **Sch. 19 para. 127**: In section 1261(1) (minor definitions: Part 42), at the appropriate place insert— “the data protection legislation” has the same meaning as in the Data…
- **Sch. 19 para. 128**: In section 1262 (index of defined expressions: Part 42), at the appropriate place insert— the data protection legislation section 1261(1) .
- **Sch. 19 para. 129**: In Schedule 8 (index of defined expressions: general), at the appropriate place insert— the data protection legislation section 1173(1) .
- **Sch. 19 para. 130**: The Tribunals, Courts and Enforcement Act 2007 is amended as follows.
- **Sch. 19 para. 131**: In section 11(5)(b) (right to appeal to Upper Tribunal), for “section 28(4) or (6) of the Data Protection Act 1998 (c. 29)” substitute “ section 27(3) or (5)…
- **Sch. 19 para. 132**: In section 13(8)(a) (right to appeal to the Court of Appeal), for “section 28(4) or (6) of the Data Protection Act 1998 (c. 29)” substitute “ section 27(3) or…
- **Sch. 19 para. 133**: The Statistics and Registration Service Act 2007 is amended as follows.
- **Sch. 19 para. 134**: (1) Section 45 (information held by HMRC) is amended as follows. (2) In subsection (4A), for “section 51(3) of the Data Protection Act 1998” substitute “…
- **Sch. 19 para. 135**: (1) Section 45A (information held by other public authorities) is amended as follows. (2) In subsection (8), for “section 51(3) of the Data Protection Act…
- **Sch. 19 para. 136**: (1) Section 45B(3) (access to information held by Crown bodies etc) is amended as follows. (2) In paragraph (a), for “the Data Protection Act 1998” substitute…
- **Sch. 19 para. 137**: (1) Section 45C(13) (power to require disclosures by other public authorities) is amended as follows. (2) In paragraph (b), for “the Data Protection Act 1998”…
- **Sch. 19 para. 138**: In section 45D(9)(b) (power to require disclosure by undertakings), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
- **Sch. 19 para. 139**: (1) Section 45E (further provision about powers in sections 45B, 45C and 45D) is amended as follows. (2) In subsection (6), for “issued under section 52B…
- **Sch. 19 para. 140**: (1) Section 53A (disclosure by the Statistics Board to devolved administrations) is amended as follows. (2) In subsection (9), for “section 51(3) of the Data…
- **Sch. 19 para. 141**: (1) Section 54 (Data Protection Act 1998 and Human Rights Act 1998) is amended as follows. (2) In the heading, omit “Data Protection Act 1998 and”. (3) Omit…
- **Sch. 19 para. 142**: In section 67 (general interpretation: Part 1), at the appropriate place insert— “the data protection legislation” has the same meaning as in the Data…
- **Sch. 19 para. 143**: The Serious Crime Act 2007 is amended as follows.
- **Sch. 19 para. 144**: (1) Section 5A (verification and disclosure of information) is amended as follows. (2) In subsection (6)— (a) for “the Data Protection Act 1998” substitute “…
- **Sch. 19 para. 145**: (1) Section 68 (disclosure of information to prevent fraud) is amended as follows. (2) In subsection (4)(a), for “the Data Protection Act 1998 (c. 29)”…
- **Sch. 19 para. 146**: (1) Section 85 (disclosure of information by Revenue and Customs) is amended as follows. (2) In subsection (8)(a), for “the Data Protection Act 1998 (c. 29)”…
- **Sch. 19 para. 147**: (1) Section 169 of the Legal Services Act 2007 (disclosure of information to the Legal Services Board) is amended as follows. (2) In subsection (3)(a), for…
- **Sch. 19 para. 148**: In section 74 of the Adoption and Children (Scotland) Act 2007 (disclosure of medical information about parents), for subsection (5) substitute— (5) In…
- **Sch. 19 para. 149**: The Criminal Justice and Immigration Act 2008 is amended as follows.
- **Sch. 19 para. 150**: Omit— (a) section 77 (power to alter penalty for unlawfully obtaining etc personal data), and (b) section 78 (new defence for obtaining etc for journalism and…
- **Sch. 19 para. 151**: (1) Section 114 (supply of information to Secretary of State etc) is amended as follows. (2) In subsection (5), for “the Data Protection Act 1998 (c. 29)”…
- **Sch. 19 para. 152**: (1) Section 70 of the Regulatory Enforcement and Sanctions Act 2008 (disclosure of information) is amended as follows. (2) In subsection (4)(a), for “the Data…
- **Sch. 19 para. 153**: In section 20A(5) of the Health and Social Care Act 2008 (functions relating to processing of information by registered persons), in the definition of…
- **Sch. 19 para. 154**: (1) Section 20 of the Counter-Terrorism Act 2008 (disclosure and the intelligence services: supplementary provisions) is amended as follows. (2) In subsection…
- **Sch. 19 para. 155**: (1) Section 117 of the Public Health etc. (Scotland) Act 2008 (disclosure of information) is amended as follows. (2) In subsection (6), for “the Data…
- **Sch. 19 para. 156**: (1) Section 83ZY of the Banking Act 2009 (special resolution regime: publication of notices etc) is amended as follows. (2) In subsection (10), for “the Data…
- **Sch. 19 para. 157**: (1) Section 19 of the Borders, Citizenship and Immigration Act 2009 (use and disclosure of customs information: application of statutory provisions) is amended…
- **Sch. 19 para. 158**: The Marine and Coastal Access Act 2009 is amended as follows.
- **Sch. 19 para. 159**: (1) Paragraph 13 of Schedule 7 (further provision about civil sanctions under Part 4: disclosure of information) is amended as follows. (2) In sub-paragraph…
- **Sch. 19 para. 160**: (1) Paragraph 9 of Schedule 10 (further provision about fixed monetary penalties: disclosure of information) is amended as follows. (2) In sub-paragraph…
- **Sch. 19 para. 161**: In Schedule 21 to the Coroners and Justice Act 2009 (minor and consequential amendments), omit paragraph 29(3).
- **Sch. 19 para. 162**: (1) Section 38 of the Broads Authority Act 2009 (provision of information) is amended as follows. (2) In subsection (3), for “the Data Protection Act 1998 (c…
- **Sch. 19 para. 163**: (1) Section 13 of the Health and Social Care (Reform) Act (Northern Ireland) 2009 (functions of the Regional Agency) is amended as follows. (2) In subsection…
- **Sch. 19 para. 164**: (1) Section 25 of the Terrorist Asset-Freezing etc. Act 2010 (application of provisions) is amended as follows. (2) In subsection (2)(a), for “the Data…
- **Sch. 19 para. 165**: (1) Paragraph 12 of Schedule 2 to the Marine (Scotland) Act 2010 (further provision about civil sanctions under Part 4: disclosure of information) is amended…
- **Sch. 19 para. 166**: (1) Section 59 of the Charities Act 2011 (disclosure: supplementary) is amended as follows. (2) The existing text becomes subsection (1). (3) In that…
- **Sch. 19 para. 167**: The Welsh Language (Wales) Measure 2011 is amended as follows.
- **Sch. 19 para. 168**: (1) Section 22 (power to disclose information) is amended as follows. (2) In subsection (4)— (a) in the English language text, for paragraph (a) substitute—…
- **Sch. 19 para. 169**: (1) Paragraph 8 of Schedule 2 (inquiries by the Commissioner: reports) is amended as follows. (2) In sub-paragraph (7)— (a) in the English language text, for…
- **Sch. 19 para. 170**: (1) Section 10 of the Safeguarding Board Act (Northern Ireland) 2011 (duty to co-operate) is amended as follows. (2) In subsection (3), for “the Data…
- **Sch. 19 para. 171**: The Health and Social Care Act 2012 is amended as follows.
- **Sch. 19 para. 172**: In section 250(7) (power to publish information standards), for the definition of “processing” substitute— “processing” has the same meaning as in Parts 5 to 7…
- **Sch. 19 para. 173**: (1) Section 251A (consistent identifiers) is amended as follows. (2) In subsection (7)(a), for “made by or under the Data Protection Act 1998” substitute “ of…
- **Sch. 19 para. 174**: (1) Section 251B (duty to share information) is amended as follows. (2) In subsection (5)(a), for “made by or under the Data Protection Act 1998” substitute “…
- **Sch. 19 para. 175**: The Protection of Freedoms Act 2012 is amended as follows.
- **Sch. 19 para. 176**: (1) Section 27 (exceptions and further provision about consent and notification) is amended as follows. (2) In subsection (5), for “the Data Protection Act…
- **Sch. 19 para. 177**: In section 28(1) (interpretation: Chapter 2), for the definition of “processing” substitute— “processing” has the same meaning as in Parts 5 to 7 of the Data…
- **Sch. 19 para. 178**: In section 29(7) (code of practice for surveillance camera systems), for the definition of “processing” substitute— “processing” has the same meaning as in…
- **Sch. 19 para. 179**: (1) Section 14A of the HGV Road User Levy Act 2013 (disclosure of information by Revenue and Customs) is amended as follows. (2) In subsection (5), for “the…
- **Sch. 19 para. 180**: The Crime and Courts Act 2013 is amended as follows.
- **Sch. 19 para. 181**: (1) Section 42 (other interpretive provisions) is amended as follows. (2) In subsection (5)(a), for “section 13 of the Data Protection Act 1998 (damage or…
- **Sch. 19 para. 182**: (1) Paragraph 1 of Schedule 7 (statutory restrictions on disclosure) is amended as follows. (2) The existing text becomes sub-paragraph (1). (3) In that…
- **Sch. 19 para. 183**: (1) Paragraph 8 of Schedule 2 to the Marine Act (Northern Ireland) 2013 (further provision about fixed monetary penalties under section 35: disclosure of…
- **Sch. 19 para. 184**: (1) Paragraph 3 of Schedule 9 to the Local Audit and Accountability Act 2014 (data matching: voluntary provision of data) is amended as follows. (2) In…
- **Sch. 19 para. 185**: (1) Paragraph 7 of Schedule 4 to the Anti-social Behaviour, Crime and Policing Act 2014 (anti-social behaviour case reviews: information) is amended as…
- **Sch. 19 para. 186**: (1) Paragraph 6 of Schedule 6 to the Immigration Act 2014 (information: limitation on powers) is amended as follows. (2) The existing text becomes…
- **Sch. 19 para. 187**: In section 67(9) of the Care Act 2014 (involvement in assessment, plans etc), for paragraph (a) substitute— (a) a health record (within the meaning given in…
- **Sch. 19 para. 188**: In section 18(10)(b) of the Social Services and Well-being (Wales) Act 2014 (registers of sight-impaired, hearing-impaired and other disabled people)— (a) in…
- **Sch. 19 para. 189**: (1) Section 38 of the Counter-Terrorism and Security Act 2015 (support etc for people vulnerable to being drawn into terrorism: co-operation) is amended as…
- **Sch. 19 para. 190**: (1) Section 6 of the Small Business, Enterprise and Employment Act 2015 (application of listed provisions to designated credit reference agencies) is amended…
- **Sch. 19 para. 192**: The Human Trafficking and Exploitation (Criminal Justice and Support for Victims) Act (Northern Ireland) 2015 is amended as follows.
- **Sch. 19 para. 193**: In section 13(5) (duty to notify National Crime Agency about suspected victims of certain offences) for “the Data Protection Act 1998” substitute “ the data…
- **Sch. 19 para. 194**: In section 25(1) (interpretation of this Act), at the appropriate place insert— “the data protection legislation” has the same meaning as in the Data…
- **Sch. 19 para. 195**: In paragraph 18(5) of Schedule 3 (supply of information to relevant Northern Ireland departments, Secretary of State, etc) for “the Data Protection Act 1998”…
- **Sch. 19 para. 196**: (1) Section 72 of the Justice Act (Northern Ireland) 2015 (supply of information to relevant Northern Ireland departments or Secretary of State) is amended as…
- **Sch. 19 para. 198**: The Investigatory Powers Act 2016 is amended as follows.
- **Sch. 19 para. 199**: In section 1(5)(b), for sub-paragraph (ii) substitute— (ii) in section 170 of the Data Protection Act 2018 (unlawful obtaining etc of personal data), .
- **Sch. 19 para. 200**: In section 199 (bulk personal datasets: interpretation), for subsection (2) substitute— (2) In this Part, “personal data” means— (a) personal data within the…
- **Sch. 19 para. 202**: In section 206 (additional safeguards for health records), for subsection (7) substitute— (7) In subsection (6)— “health professional” has the same meaning as…
- **Sch. 19 para. 203**: (1) Section 237 (information gateway) is amended as follows. (2) In subsection (2), for “the Data Protection Act 1998” substitute “ the data protection…
- **Sch. 19 para. 204**: (1) Section 49 of the Police Services Ombudsman Act (Northern Ireland) 2016 (disclosure of information) is amended as follows. (2) In subsection (4), for…
- **Sch. 19 para. 205**: (1) Section 1 of the Health and Social Care (Control of Data Processing) Act (Northern Ireland) 2016 (control of information of a relevant person) is amended…
- **Sch. 19 para. 206**: In section 306(1) of the Mental Capacity Act (Northern Ireland) 2016 (definitions for purposes of Act), for the definition of “health record” substitute—…
- **Sch. 19 para. 207**: The Justice Act (Northern Ireland) 2016 is amended as follows.
- **Sch. 19 para. 208**: (1) Section 17 (disclosure of information) is amended as follows. (2) In subsection (7), for “the Data Protection Act 1998” substitute “ the data protection…
- **Sch. 19 para. 209**: In section 44(3) (disclosure of information)— (a) in paragraph (a), for “Part 5 of the Data Protection Act 1998” substitute “ sections 142 to 154, 160 to 164…
- **Sch. 19 para. 210**: (1) Section 50 of the Policing and Crime Act 2017 (Freedom of Information Act etc: Police Federation for England and Wales) is amended as follows. (2) The…
- **Sch. 19 para. 211**: In Schedule 5 to the Children and Social Work Act 2017— (a) in Part 1 (general amendments to do with social workers etc in England), omit paragraph 6, and (b)…
- **Sch. 19 para. 212**: The Higher Education and Research Act 2017 is amended as follows.
- **Sch. 19 para. 213**: (1) Section 63 (cooperation and information sharing by the Office for Students) is amended as follows. (2) In subsection (6), for “the Data Protection Act…
- **Sch. 19 para. 214**: (1) Section 112 (cooperation and information sharing between the Office for Students and UKRI) is amended as follows. (2) In subsection (6), for “the Data…
- **Sch. 19 para. 215**: The Digital Economy Act 2017 is amended as follows.
- **Sch. 19 para. 216**: (1) Section 40 (further provisions about disclosures under sections 35 to 39) is amended as follows. (2) In subsection (8)(a), for “the Data Protection Act…
- **Sch. 19 para. 217**: (1) Section 43 (codes of practice) is amended as follows. (2) In subsection (2), for “issued under section 52B (data-sharing code) of the Data Protection Act…
- **Sch. 19 para. 218**: (1) Section 49 (further provision about disclosures under section 48) is amended as follows. (2) In subsection (8)(a), for “the Data Protection Act 1998”…
- **Sch. 19 para. 219**: (1) Section 52 (code of practice) is amended as follows. (2) In subsection (2), for “issued under section 52B (data-sharing code) of the Data Protection Act…
- **Sch. 19 para. 220**: (1) Section 57 (further provision about disclosures under section 56) is amended as follows. (2) In subsection (8)(a), for “the Data Protection Act 1998”…
- **Sch. 19 para. 221**: (1) Section 60 (code of practice) is amended as follows. (2) In subsection (2), for “issued under section 52B (data-sharing code) of the Data Protection Act…
- **Sch. 19 para. 222**: (1) Section 65 (supplementary provision about disclosures under section 64) is amended as follows. (2) In subsection (2)(a), for “the Data Protection Act 1998”…
- **Sch. 19 para. 223**: (1) Section 70 (code of practice) is amended as follows. (2) In subsection (2), for “issued under section 52B (data-sharing code) of the Data Protection Act…
- **Sch. 19 para. 224**: Omit sections 108 to 110 (charges payable to the Information Commissioner).
- **Sch. 19 para. 225**: (1) Section 60 of the Landfill Disposals Tax (Wales) Act 2017 (disclosure of information to the Welsh Revenue Authority) is amended as follows. (2) In…
- **Sch. 19 para. 226**: (1) Section 4 of the Additional Learning Needs and Educational Tribunal (Wales) Act 2018 (additional learning needs code) is amended as follows. (2) In the…
- **Sch. 19 para. 227**: (1) Section 204 of this Act (meaning of “health professional” and “social work professional”) is amended as follows (to reflect the arrangements for the…
- **Sch. 19 para. 228**: In the table in the Schedule to the Estate Agents (Specified Offences) (No. 2) Order 1991 (specified offences), at the end insert— Data Protection Act 2018…
- **Sch. 19 para. 229**: (1) Article 4 of the Channel Tunnel (International Arrangements) Order 1993 (application of enactments) is amended as follows. (2) In paragraph (2)— (a) for…
- **Sch. 19 para. 230**: The Access to Health Records (Northern Ireland) Order 1993 is amended as follows.
- **Sch. 19 para. 231**: In Article 4 (health professionals), for paragraph (1) substitute— (1) In this Order, “health professional” has the same meaning as in the Data Protection Act…
- **Sch. 19 para. 232**: In Article 5(4)(a) (fees for access to health records), for “under section 7 of the Data Protection Act 1998” substitute “ made by the Department ”.
- **Sch. 19 para. 233**: In article 4 of the Channel Tunnel (Miscellaneous Provisions) Order 1994 (application of enactments), for paragraphs (2) and (3) substitute— (2) For the…
- **Sch. 19 para. 234**: The European Primary and Specialist Dental Qualifications Regulations 1998 are amended as follows.
- **Sch. 19 para. 235**: (1) Regulation 2(1) (interpretation) is amended as follows. (2) Omit the definition of “Directive 95/46/EC”. (3) At the appropriate place insert— “the GDPR”…
- **Sch. 19 para. 236**: (1) The table in Schedule A1 (functions of the GDC under Directive 2005/36) is amended as follows. (2) In the entry for Article 56(2), in the second column…
- **Sch. 19 para. 237**: For article 7 of the Scottish Parliamentary Corporate Body (Crown Status) Order 1999 substitute— Data Protection Act 2018 7 (1) The Parliamentary corporation…
- **Sch. 19 para. 238**: For article 9 of the Northern Ireland Assembly Commission (Crown Status) Order 1999 substitute— Data Protection Act 2018 9 (1) The Commission is to be treated…
- **Sch. 19 para. 239**: The Data Protection (Corporate Finance Exemption) Order 2000 is revoked.
- **Sch. 19 para. 240**: The Data Protection (Conditions under Paragraph 3 of Part II of Schedule 1) Order 2000 is revoked.
- **Sch. 19 para. 241**: The Data Protection (Functions of Designated Authority) Order 2000 is revoked.
- **Sch. 19 para. 242**: The Data Protection (International Co-operation) Order 2000 is revoked.
- **Sch. 19 para. 243**: The Data Protection (Subject Access) (Fees and Miscellaneous Provisions) Regulations 2000 are revoked.
- **Sch. 19 para. 244**: In the Consumer Credit (Credit Reference Agency) Regulations 2000, regulation 4(1) and Schedule 1 (statement of rights under section 9(3) of the Data…
- **Sch. 19 para. 245**: The Data Protection (Subject Access Modification) (Health) Order 2000 is revoked.
- **Sch. 19 para. 246**: The Data Protection (Subject Access Modification) (Education) Order 2000 is revoked.
- **Sch. 19 para. 247**: The Data Protection (Subject Access Modification) (Social Work) Order 2000 is revoked.
- **Sch. 19 para. 248**: The Data Protection (Crown Appointments) Order 2000 is revoked.
- **Sch. 19 para. 249**: The Data Protection (Processing of Sensitive Personal Data) Order 2000 is revoked.
- **Sch. 19 para. 250**: The Data Protection (Miscellaneous Subject Access Exemptions) Order 2000 is revoked.
- **Sch. 19 para. 251**: The Data Protection (Designated Codes of Practice) (No. 2) Order 2000 is revoked.
- **Sch. 19 para. 252**: The Representation of the People (England and Wales) Regulations 2001 are amended as follows.
- **Sch. 19 para. 253**: In regulation 3(1) (interpretation), at the appropriate places insert— “Article 89 GDPR purposes” means the purposes mentioned in Article 89(1) of the GDPR…
- **Sch. 19 para. 254**: In regulation 26(3)(a) (applications for registration), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
- **Sch. 19 para. 255**: In regulation 26A(2)(a) (application for alteration of register in respect of name under section 10ZD), for “the Data Protection Act 1998” substitute “ the…
- **Sch. 19 para. 256**: In regulation 32ZA(3)(f) (annual canvass), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
- **Sch. 19 para. 257**: In regulation 61A (conditions on the use, supply and inspection of absent voter records or lists), for paragraph (a) (but not the final “or”) substitute— (a)…
- **Sch. 19 para. 258**: (1) Regulation 92(2) (interpretation and application of Part VI etc) is amended as follows. (2) After sub-paragraph (b) insert— (ba) “relevant requirement”…
- **Sch. 19 para. 259**: In regulation 96(2A)(b)(i) (restriction on use of the full register), for “section 11(3) of the Data Protection Act 1998” substitute “ section 122(5) of the…
- **Sch. 19 para. 260**: In regulation 97(5) and (6) (supply of free copy of full register to the British Library and restrictions on use), for “research purposes in compliance with…
- **Sch. 19 para. 261**: In regulation 97A(7) and (8) (supply of free copy of full register to the National Library of Wales and restrictions on use), for “research purposes in…
- **Sch. 19 para. 262**: In regulation 99(6) and (7) (supply of free copy of full register etc to Statistics Board and restrictions on use), for “research purposes in compliance with…
- **Sch. 19 para. 263**: In regulation 109A(9) and (10) (supply of free copy of full register to public libraries and local authority archives services and restrictions on use), for…
- **Sch. 19 para. 264**: In regulation 119(2) (conditions on the use, supply and disclosure of documents open to public inspection), for sub-paragraph (i) (but not the final “or”)…
- **Sch. 19 para. 265**: The Representation of the People (Scotland) Regulations 2001 are amended as follows.
- **Sch. 19 para. 266**: In regulation 3(1) (interpretation), at the appropriate places, insert— “Article 89 GDPR purposes” means the purposes mentioned in Article 89(1) of the GDPR…
- **Sch. 19 para. 267**: In regulation 26(3)(a) (applications for registration), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
- **Sch. 19 para. 268**: In regulation 26A(2)(a) (application for alteration of register in respect of name under section 10ZD), for “the Data Protection Act 1998” substitute “ the…
- **Sch. 19 para. 269**: In regulation 32ZA(3)(f) (annual canvass), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
- **Sch. 19 para. 270**: In regulation 61(3) (records and lists kept under Schedule 4), for paragraph (a) (but not the final “or”) substitute— (a) Article 89 GDPR purposes; .
- **Sch. 19 para. 271**: In regulation 61A (conditions on the use, supply and inspection of absent voter records or lists), for paragraph (a) (but not the final “or”) substitute— (a)…
- **Sch. 19 para. 272**: (1) Regulation 92(2) (interpretation of Part VI etc) is amended as follows. (2) After sub-paragraph (b) insert— (ba) “relevant requirement” means the…
- **Sch. 19 para. 273**: In regulation 95(3)(b)(i) (restriction on use of the full register), for “section 11(3) of the Data Protection Act 1998” substitute “ section 122(5) of the…
- **Sch. 19 para. 274**: In regulation 96(5) and (6) (supply of free copy of full register to the National Library of Scotland and the British Library and restrictions on use), for…
- **Sch. 19 para. 275**: In regulation 98(6) and (7) (supply of free copy of full register etc to Statistics Board and restrictions on use), for “research purposes in compliance with…
- **Sch. 19 para. 276**: In regulation 108A(9) and (10) (supply of full register to statutory library authorities and local authority archives services and restrictions on use), for…
- **Sch. 19 para. 277**: In regulation 119(2) (conditions on the use, supply and disclosure of documents open to public inspection), for sub-paragraph (i) (but not the final “or”)…
- **Sch. 19 para. 278**: (1) Article 9 of the Financial Services and Markets 2000 (Disclosure of Confidential Information) Regulations 2001 (disclosure by regulators or regulator…
- **Sch. 19 para. 279**: The Nursing and Midwifery Order 2001 is amended as follows.
- **Sch. 19 para. 280**: (1) Article 3 (the Nursing and Midwifery Council and its Committees) is amended as follows. (2) In paragraph (18), after “enactment” insert “ or the GDPR ”…
- **Sch. 19 para. 281**: (1) Article 25 (the Council's power to require disclosure of information) is amended as follows. (2) In paragraph (3), after “enactment” insert “ or the GDPR…
- **Sch. 19 para. 282**: In article 39B (European professional card), after paragraph (2) insert— (3) For the purposes of Schedule 2B, “the GDPR” means Regulation (EU) 2016/679 of the…
- **Sch. 19 para. 283**: In article 40(6) (Directive 2005/36/EC: designation of competent authority etc), at the appropriate place insert— “the GDPR” means Regulation (EU) 2016/679 of…
- **Sch. 19 para. 284**: (1) Schedule 2B (Directive 2005/36/EC: European professional card) is amended as follows. (2) In paragraph 8(1) (access to data) for “Directive 95/46/EC”…
- **Sch. 19 para. 285**: (1) The table in Schedule 3 (functions of the Council under Directive 2005/36) is amended as follows. (2) In the entry for Article 56(2), in the second column…
- **Sch. 19 para. 286**: In Schedule 4 (interpretation), omit the definition of “Directive 95/46/EC”.
- **Sch. 19 para. 287**: Regulation 3 of the Electronic Commerce (EC Directive) Regulations 2002 (exclusions) is amended as follows.
- **Sch. 19 para. 288**: In paragraph (1)(b) for “the Data Protection Directive and the Telecommunications Data Protection Directive” substitute “ the GDPR ”.
- **Sch. 19 para. 289**: In paragraph (3)— (a) omit the definitions of “Data Protection Directive” and “Telecommunications Data Protection Directive”, and (b) at the appropriate place…
- **Sch. 19 para. 290**: The Data Protection (Processing of Sensitive Personal Data) (Elected Representatives) Order 2002 is revoked.
- **Sch. 19 para. 291**: The Privacy and Electronic Communications (EC Directive) Regulations 2003 are amended as follows.
- **Sch. 19 para. 292**: In regulation 2(1) (interpretation), in the definition of “the Information Commissioner” and “the Commissioner”, for “section 6 of the Data Protection Act…
- **Sch. 19 para. 293**: (1) Regulation 4 (relationship between these Regulations and the Data Protection Act 1998) is amended as follows. (2) The existing text becomes sub-paragraph…
- **Sch. 19 para. 294**: The Nationality, Immigration and Asylum Act 2002 (Juxtaposed Controls) Order 2003 is amended as follows.
- **Sch. 19 para. 295**: In article 8(2) (exercise of powers by French officers in a control zone in the United Kingdom: disapplication of law of England and Wales)— (a) for “The Data…
- **Sch. 19 para. 296**: In article 11(4) (exercise of powers by UK immigration officers and constables in a control zone in France: enactments having effect)— (a) for “The Data…
- **Sch. 19 para. 297**: The Pupils' Educational Records (Scotland) Regulations 2003 are amended as follows.
- **Sch. 19 para. 298**: (1) Regulation 2 (interpretation) is amended as follows. (2) Omit the definition of “the 1998 Act”. (3) At the appropriate place insert— “the GDPR” means…
- **Sch. 19 para. 299**: (1) Regulation 6 (circumstances where information should not be disclosed) is amended as follows. (2) After “any information” insert “ to the extent that any…
- **Sch. 19 para. 300**: In regulation 9 (fees), for paragraph (1) substitute— (1A) In complying with a request made under regulation 5(2), the responsible body may only charge a fee…
- **Sch. 19 para. 301**: Schedule 1 to the European Parliamentary Elections (Northern Ireland) Regulations 2004 (European Parliamentary elections rules) is amended as follows.
- **Sch. 19 para. 302**: (1) Paragraph 74(1) (interpretation) is amended as follows. (2) Omit the definitions of “relevant conditions” and “research purposes”. (3) At the appropriate…
- **Sch. 19 para. 303**: In paragraph 77(2)(b) (conditions on the use, supply and disclosure of documents open to public inspection), for “research purposes” substitute “ Article 89…
- **Sch. 19 para. 304**: In regulation 3(1) of the Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004, omit “the appropriate limit referred to in…
- **Sch. 19 para. 305**: The Environmental Information Regulations 2004 are amended as follows.
- **Sch. 19 para. 306**: (1) Regulation 2 (interpretation) is amended as follows. (2) In paragraph (1), at the appropriate places, insert— “the data protection principles” means the…
- **Sch. 19 para. 307**: (1) Regulation 13 (personal data) is amended as follows. (2) For paragraph (1) substitute— (1) To the extent that the information requested includes personal…
- **Sch. 19 para. 308**: In regulation 14 (refusal to disclose information), in paragraph (3)(b), for “regulations 13(2)(a)(ii) or 13(3)” substitute “ regulation 13(1)(b) or (5A) ”.
- **Sch. 19 para. 309**: In regulation 18 (enforcement and appeal provisions), in paragraph (5), for “regulation 13(5)” substitute “ regulation 13(5A) ”.
- **Sch. 19 para. 310**: The Environmental Information (Scotland) Regulations 2004 are amended as follows.
- **Sch. 19 para. 311**: (1) Regulation 2 (interpretation) is amended as follows. (2) In paragraph (1), at the appropriate places, insert— “the data protection principles” means the…
- **Sch. 19 para. 312**: (1) Regulation 11 (personal data) is amended as follows. (2) For paragraph (2) substitute— (2) To the extent that environmental information requested includes…
- **Sch. 19 para. 313**: (1) Regulation 7 of the Licensing Act 2003 (Personal Licences) Regulations 2005 (application for grant of a personal licence) is amended as follows. (2) In…
- **Sch. 19 para. 314**: The Education (Pupil Information) (England) Regulations 2005 are amended as follows.
- **Sch. 19 para. 315**: In regulation 3(5) (meaning of educational record) for “section 1(1) of the Data Protection Act 1998” substitute “ section 3(4) of the Data Protection Act 2018…
- **Sch. 19 para. 316**: (1) Regulation 5 (disclosure of curricular and educational records) is amended as follows. (2) In paragraph (4)— (a) in sub-paragraph (a), for “the Data…
- **Sch. 19 para. 317**: (1) Regulation 45 of the Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005 (sensitive information) is amended as follows. (2) In paragraph…
- **Sch. 19 para. 318**: In regulation 3 of the Register of Judgments, Orders and Fines Regulations 2005 (interpretation)— (a) for the definition of “data protection principles”…
- **Sch. 19 para. 319**: The Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005 are amended as follows.
- **Sch. 19 para. 320**: (1) Regulation 39 (sensitive information) is amended as follows. (2) In paragraph (1)(d)— (a) omit “, within the meaning of section 1(1) of the Data Protection…
- **Sch. 19 para. 321**: The Data Protection (Processing of Sensitive Personal Data) Order 2006 is revoked.
- **Sch. 19 para. 322**: (1) Paragraph 14 of Schedule 1 to the National Assembly for Wales (Representation of the People) Order 2007 (absent voting at Assembly elections: conditions on…
- **Sch. 19 para. 323**: In regulation 3 of the Mental Capacity Act 2005 (Loss of Capacity during Research Project) (England) Regulations 2007 (research which may be carried out…
- **Sch. 19 para. 324**: For article 5 of the National Assembly for Wales Commission (Crown Status) Order 2007 substitute— Data Protection Act 2018 5 (1) The Assembly Commission is to…
- **Sch. 19 para. 325**: In regulation 3 of the Mental Capacity Act 2005 (Loss of Capacity during Research Project) (Wales) Regulations 2007 (research which may be carried out despite…
- **Sch. 19 para. 326**: (1) Regulation 18 of the Representation of the People (Absent Voting at Local Elections) (Scotland) Regulations 2007 (conditions on the supply and inspection…
- **Sch. 19 para. 327**: In regulation 5 of the Representation of the People (Post-Local Government Elections Supply and Inspection of Documents) (Scotland) Regulations 2007…
- **Sch. 19 para. 328**: The Education (Pupil Records and Reporting) (Transitional) Regulations (Northern Ireland) 2007 are amended as follows.
- **Sch. 19 para. 329**: In regulation 2 (interpretation), at the appropriate place insert— “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of…
- **Sch. 19 para. 330**: In regulation 10(2) (duties of Boards of Governors), for “documents which are the subject of an order under section 30(2) of the Data Protection Act 1998”…
- **Sch. 19 para. 331**: In regulation 118 of the Representation of the People (Northern Ireland) Regulations 2008 (conditions on the use, supply and disclosure of documents open to…
- **Sch. 19 para. 332**: In paragraph 1(c) of the Schedule to the Companies Act 2006 (Extension of Takeover Panel Provisions) (Isle of Man) Order 2008 (modifications with which Chapter…
- **Sch. 19 para. 333**: The Controlled Drugs (Supervision of Management and Use) (Wales) Regulations 2008 are amended as follows.
- **Sch. 19 para. 334**: In regulation 2(1) (interpretation)— (a) at the appropriate place in the English language text insert— “the GDPR” (“y GDPR”) and references to Schedule 2 to…
- **Sch. 19 para. 335**: (1) Regulation 25 (duty to co-operate by disclosing information as regards relevant persons) is amended as follows. (2) In paragraph (7)— (a) in the English…
- **Sch. 19 para. 336**: (1) Regulation 26 (responsible bodies requesting additional information be disclosed about relevant persons) is amended as follows. (2) In paragraph (6)— (a)…
- **Sch. 19 para. 337**: (1) Regulation 29 (occurrence reports) is amended as follows. (2) In paragraph (3)— (a) in the English language text, at the end insert “ or the GDPR ”, and…
- **Sch. 19 para. 338**: (1) Regulation 5 of the Energy Order 2003 (Supply of Information) Regulations (Northern Ireland) 2008 (information whose disclosure would be affected by the…
- **Sch. 19 para. 339**: (1) Paragraph 6 of Schedule 2 to the Companies (Disclosure of Address) Regulations 2009 (conditions for permitted disclosure to a credit reference agency) is…
- **Sch. 19 para. 340**: (1) Paragraph 6 of Schedule 2 to the Overseas Companies Regulations 2009 (conditions for permitted disclosure to a credit reference agency) is amended as…
- **Sch. 19 para. 341**: The Data Protection (Processing of Sensitive Personal Data) Order 2009 is revoked.
- **Sch. 19 para. 342**: In regulation 25 of the Provision of Services Regulations 2009 (derogations from the freedom to provide services), for paragraph (d) substitute— (d) matters…
- **Sch. 19 para. 343**: (1) Regulation 9 of the INSPIRE Regulations 2009 (public access to spatial data sets and spatial data services) is amended as follows. (2) In paragraph (2)—…
- **Sch. 19 para. 344**: (1) Regulation 10 of the INSPIRE (Scotland) Regulations 2009 (public access to spatial data sets and spatial data services) is amended as follows. (2) In…
- **Sch. 19 para. 345**: The Controlled Drugs (Supervision of Management and Use) Regulations (Northern Ireland) 2009 are amended as follows.
- **Sch. 19 para. 346**: In regulation 2(2) (interpretation), at the appropriate place insert— “the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same…
- **Sch. 19 para. 347**: (1) Regulation 25 (duty to co-operate by disclosing information as regards relevant persons) is amended as follows. (2) In paragraph (7), at the end insert “…
- **Sch. 19 para. 348**: (1) Regulation 26 (responsible bodies requesting additional information be disclosed about relevant persons) is amended as follows. (2) In paragraph (6), at…
- **Sch. 19 para. 349**: (1) Regulation 29 (occurrence reports) is amended as follows. (2) In paragraph (3), at the end insert “ or the GDPR ”. (3) For paragraph (4) substitute— (4) In…
- **Sch. 19 para. 350**: The Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010 are revoked.
- **Sch. 19 para. 351**: The Pharmacy Order 2010 is amended as follows.
- **Sch. 19 para. 352**: In article 3(1) (interpretation), omit the definition of “Directive 95/46/EC”.
- **Sch. 19 para. 353**: (1) Article 9 (inspection and enforcement) is amended as follows. (2) For paragraph (4) substitute— (4) If a report that the Council proposes to publish…
- **Sch. 19 para. 354**: In article 33A (European professional card), after paragraph (2) insert— (3) In Schedule 2A, “the GDPR” means Regulation (EU) 2016/679 of the European…
- **Sch. 19 para. 355**: (1) Article 49 (disclosure of information: general) is amended as follows. (2) In paragraph (2)(a), after “enactment” insert “ or the GDPR ”. (3) For paragraph…
- **Sch. 19 para. 356**: (1) Article 55 (professional performance assessments) is amended as follows. (2) In paragraph (5)(a), after “enactment” insert “ or the GDPR ”. (3) For…
- **Sch. 19 para. 357**: In article 67(6) (Directive 2005/36/EC: designation of competent authority etc.), after sub-paragraph (a) insert— (aa) “the GDPR” means Regulation (EU)…
- **Sch. 19 para. 358**: (1) Schedule 2A (Directive 2005/36/EC: European professional card) is amended as follows. (2) In paragraph 8(1) (access to data), for “Directive 95/46/EC)”…
- **Sch. 19 para. 359**: (1) The table in Schedule 3 (Directive 2005/36/EC: designation of competent authority etc.) is amended as follows. (2) In the entry for Article 56(2), in the…
- **Sch. 19 para. 360**: The Data Protection (Monetary Penalties) Order 2010 is revoked.
- **Sch. 19 para. 361**: The National Employment Savings Trust Order 2010 is amended as follows.
- **Sch. 19 para. 362**: In article 2 (interpretation)— (a) omit the definition of “data” and “personal data”, and (b) at the appropriate place insert— “personal data” has the same…
- **Sch. 19 para. 363**: (1) Article 10 (disclosure of requested data to the Secretary of State) is amended as follows. (2) In paragraph (1)— (a) for “disclosure of data” substitute “…
- **Sch. 19 para. 364**: (1) Schedule 3 to the Local Elections (Northern Ireland) Order 2010 (access to marked registers and other documents open to public inspection after an…
- **Sch. 19 para. 365**: (1) Regulation 5 of the Pupil Information (Wales) Regulations 2011 (duties of head teacher - educational records) is amended as follows. (2) In paragraph (5)—…
- **Sch. 19 para. 366**: In Schedule 4 to the Debt Arrangement Scheme (Scotland) Regulations 2011 (payments distributors), omit paragraph 2.
- **Sch. 19 para. 367**: The Police and Crime Commissioner Elections Order 2012 is amended as follows.
- **Sch. 19 para. 368**: (1) Schedule 2 (absent voting in Police and Crime Commissioner elections) is amended as follows. (2) In paragraph 20 (absent voter lists: supply of copies…
- **Sch. 19 para. 369**: (1) Schedule 10 (access to marked registers and other documents open to public inspection after an election) is amended as follows. (2) In paragraph 1(2)…
- **Sch. 19 para. 370**: The Data Protection (Processing of Sensitive Personal Data) Order 2012 is revoked.
- **Sch. 19 para. 371**: Schedule 6 to the Neighbourhood Planning (Referendums) Regulations 2012 (registering to vote in a business referendum) is amended as follows.
- **Sch. 19 para. 372**: (1) Paragraph 29(1) (interpretation of Part 8) is amended as follows. (2) At the appropriate places insert— “Article 89 GDPR purposes” means the purposes…
- **Sch. 19 para. 373**: In paragraph 32(3)(b)(i), for “section 11(3) of the Data Protection Act 1998” substitute “ section 122(5) of the Data Protection Act 2018 ”.
- **Sch. 19 para. 374**: In paragraph 33(6) and (7) (supply of copy of business voting register to the British Library and restrictions on use), for “research purposes in compliance…
- **Sch. 19 para. 375**: In paragraph 34(6) and (7) (supply of copy of business voting register to the Office of National Statistics and restrictions on use), for “research purposes in…
- **Sch. 19 para. 376**: In paragraph 39(8) and (97) (supply of copy of business voting register to public libraries and local authority archives services and restrictions on use), for…
- **Sch. 19 para. 377**: In paragraph 45(2) (conditions on the use, supply and disclosure of documents open to public inspection), for paragraph (a) (but not the final “or”)…
- **Sch. 19 para. 378**: (1) Regulation 20 of the Controlled Drugs (Supervision of Management and Use) Regulations 2013 (information management) is amended as follows. (2) For…
- **Sch. 19 para. 379**: (1) Article 3 of the Communications Act 2003 (Disclosure of Information) Order 2014 (specification of relevant functions) is amended as follows. (2) The…
- **Sch. 19 para. 380**: In the Criminal Justice and Data Protection (Protocol No. 36) Regulations 2014, omit Part 4 (data protection in relation to police and judicial co-operation in…
- **Sch. 19 para. 381**: The Data Protection (Assessment Notices) (Designation of National Health Service Bodies) Order 2014 is revoked.
- **Sch. 19 para. 382**: In regulation 6 of the Control of Explosives Precursors etc Regulations (Northern Ireland) 2014 (applications)— (a) in paragraph (9), omit sub-paragraph (b)…
- **Sch. 19 para. 383**: In regulation 3 of the Control of Poisons and Explosives Precursors Regulations 2015 (applications in relation to licences under section 4A of the Poisons Act…
- **Sch. 19 para. 384**: (1) Paragraph 6 of Schedule 2 to the Companies (Disclosure of Date of Birth Information) Regulations 2015 (conditions for permitted disclosure to a credit…
- **Sch. 19 para. 385**: The Small and Medium Sized Business (Credit Information) Regulations 2015 are amended as follows.
- **Sch. 19 para. 386**: (1) Regulation 12 (criteria for the designation of a credit reference agency) is amended as follows. (2) In paragraph (1)(b), for “the Data Protection Act…
- **Sch. 19 para. 387**: (1) Regulation 15 (access to and correction of information for individuals and small firms) is amended as follows. (2) For paragraph (1) substitute— (1)…
- **Sch. 19 para. 388**: The European Union (Recognition of Professional Qualifications) Regulations 2015 are amended as follows.
- **Sch. 19 para. 389**: (1) Regulation 2(1) (interpretation) is amended as follows. (2) Omit the definition of “Directive 95/46/EC”. (3) At the appropriate place insert— “the GDPR”…
- **Sch. 19 para. 390**: In regulation 5(5) (functions of competent authorities in the United Kingdom) for “Directives 95/46/EC” substitute “ the GDPR and Directive ”.
- **Sch. 19 para. 391**: In regulation 45(3) (processing and access to data regarding the European Professional Card), for “Directive 95/46/EC” substitute “ the GDPR ”.
- **Sch. 19 para. 392**: In regulation 46(1) (processing and access to data regarding the European Professional Card), for “Directive 95/46/EC” substitute “ the GDPR ”.
- **Sch. 19 para. 393**: In regulation 48(2) (processing and access to data regarding the European Professional Card), omit paragraph (2) (deeming the relevant designated competent…
- **Sch. 19 para. 394**: In regulation 66(3) (exchange of information), for “Directives 95/46/EC” substitute “ the GDPR and Directive ”.
- **Sch. 19 para. 395**: The Scottish Parliament (Elections etc) Order 2015 is amended as follows.
- **Sch. 19 para. 396**: (1) Schedule 3 (absent voting) is amended as follows. (2) In paragraph 16 (absent voting lists: supply of copies etc)— (a) in sub-paragraph (4), for paragraph…
- **Sch. 19 para. 397**: (1) Schedule 8 (access to marked registers and other documents open to public inspection after an election) is amended as follows. (2) In paragraph 1(2)…
- **Sch. 19 para. 398**: In paragraph 1(3) of Schedule 3 to the Recall of MPs Act 2015 (Recall Petition) Regulations 2016 (access to marked registers after a petition), omit the…
- **Sch. 19 para. 399**: Schedule 4 to the Register of People with Significant Control Regulations 2016 (conditions for permitted disclosure) is amended as follows.
- **Sch. 19 para. 400**: (1) Paragraph 6 (disclosure to a credit reference agency) is amended as follows. (2) In sub-paragraph (b), for paragraph (ii) (together with the final “; and”)…
- **Sch. 19 para. 401**: In paragraph 12A (disclosure to a credit institution or a financial institution), for sub-paragraph (b) substitute— (b) for the purposes of ensuring that it…
- **Sch. 19 para. 402**: In Part 3 (interpretation), after paragraph 13 insert— 14 In this Schedule, “data protection obligations”, in relation to a credit reference agency, a credit…
- **Sch. 19 para. 403**: The Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 are amended as follows.
- **Sch. 19 para. 404**: In regulation 2(1) (interpretation), omit the definition of “the 1998 Act”.
- **Sch. 19 para. 405**: In regulation 3(3) (supervision), omit “under the 1998 Act”.
- **Sch. 19 para. 406**: For Schedule 2 substitute— SCHEDULE 2 Information Commissioner's enforcement powers Provisions applied for enforcement purposes 1 For the purposes of enforcing…
- **Sch. 19 para. 407**: The Court Files Privileged Access Rules (Northern Ireland) 2016 are amended as follows.
- **Sch. 19 para. 408**: In rule 5 (information that may released) for “Schedule 1 of the Data Protection Act 1998” substitute — (a) Article 5(1) of the GDPR, and (b) section 34(1) of…
- **Sch. 19 para. 409**: In rule 7(2) (provision of information) for “Schedule 1 of the Data Protection Act 1998” substitute — (a) Article 5(1) of the GDPR, and (b) section 34(1) of…
- **Sch. 19 para. 410**: The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 are amended as follows.
- **Sch. 19 para. 411**: In regulation 3(1) (interpretation), at the appropriate places insert— “the data protection legislation” has the same meaning as in the Data Protection Act…
- **Sch. 19 para. 412**: In regulation 16(8) (risk assessment by the Treasury and Home Office), for “the Data Protection Act 1998 or any other enactment” substitute — (a) the Data…
- **Sch. 19 para. 413**: In regulation 17(9) (risk assessment by supervisory authorities), for “the Data Protection Act 1998 or any other enactment” substitute — (a) the Data…
- **Sch. 19 para. 414**: For regulation 40(9)(c) (record keeping) substitute— (c) “data subject” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act)…
- **Sch. 19 para. 415**: (1) Regulation 41 (data protection) is amended as follows. (2) Omit paragraph (2). (3) In paragraph (3)(a), after “Regulations” insert “ or the GDPR ”. (4)…
- **Sch. 19 para. 416**: (1) Regulation 84 (publication: the Financial Conduct Authority) is amended as follows. (2) In paragraph (10), for “the Data Protection Act 1998” substitute “…
- **Sch. 19 para. 417**: (1) Regulation 85 (publication: the Commissioners) is amended as follows. (2) In paragraph (9), for “the Data Protection Act 1998” substitute “ the data…
- **Sch. 19 para. 418**: For regulation 106(a) (general restrictions) substitute— (a) a disclosure in contravention of the data protection legislation; or .
- **Sch. 19 para. 419**: After paragraph 27 of Schedule 3 (relevant offences) insert— 27A An offence under the Data Protection Act 2018, apart from an offence under section 173 of that…
- **Sch. 19 para. 420**: (1) Paragraph 6 of Schedule 5 to the Scottish Partnerships (Register of People with Significant Control) Regulations 2017 (conditions for permitted disclosure…
- **Sch. 19 para. 421**: In regulation 1(2) of the Data Protection (Charges and Information) Regulations 2018 (interpretation), at the appropriate places insert— “data controller”…
- **Sch. 19 para. 422**: The National Health Service (General Medical Services Contracts) (Scotland) Regulations 2018 are amended as follows.
- **Sch. 19 para. 423**: (1) Regulation 1 (citation and commencement) is amended as follows. (2) In paragraph (2), omit “Subject to paragraph (3),”. (3) Omit paragraph (3).
- **Sch. 19 para. 424**: In regulation 3(1) (interpretation)— (a) omit the definition of “the 1998 Act”, (b) at the appropriate place insert— “the data protection legislation” has the…
- **Sch. 19 para. 425**: (1) Schedule 6 (other contractual terms) is amended as follows. (2) In paragraph 63(2) (interpretation: general), for “the 1998 Act or any directly applicable…
- **Sch. 19 para. 426**: The National Health Service (Primary Medical Services Section 17C Agreements) (Scotland) Regulations 2018 are amended as follows.
- **Sch. 19 para. 427**: (1) Regulation 1 (citation and commencement) is amended as follows. (2) In paragraph (2), omit “Subject to paragraph (3),”. (3) Omit paragraph (3).
- **Sch. 19 para. 428**: In regulation 3(1) (interpretation)— (a) omit the definition of “the 1998 Act”, and (b) at the appropriate place insert— “the data protection legislation” has…
- **Sch. 19 para. 429**: (1) Schedule 1 (content of agreements) is amended as follows. (2) In paragraph 34 (interpretation)— (a) in sub-paragraph (1)— (i) omit “Subject to…
- **Sch. 19 para. 430**: (1) Unless the context otherwise requires, legislation described in sub-paragraph (2) has effect on and after the day on which this Part of this Schedule comes…
- **Sch. 19 para. 431**: (1) References to a particular provision of, or made under, the Data Protection Act 1998 have effect as references to the equivalent provision or provisions…
- **Sch. 19 para. 432**: (1) References to personal data, and to the processing of such data, as defined in the Data Protection Act 1998, have effect as references to personal data…
- **Sch. 19 para. 433**: Section 3(14) does not apply to this Schedule.
- **Sch. 19 para. 434**: Provision inserted into subordinate legislation by this Schedule may be amended or revoked as if it had been inserted using the power under which the…

### SCHEDULE 20

- **Sch. 20 para. 1**: (1) In this Schedule— “the 1984 Act” means the Data Protection Act 1984; “the 1998 Act” means the Data Protection Act 1998; “the 2014 Regulations” means the…
- **Sch. 20 para. 2**: (1) The repeal of sections 7 to 9A of the 1998 Act (right of access to personal data) does not affect the application of those sections after the relevant time…
- **Sch. 20 para. 3**: (1) The repeal of section 10 of the 1998 Act (right to prevent processing likely to cause damage or distress) does not affect the application of that section…
- **Sch. 20 para. 4**: (1) The repeal of section 11 of the 1998 Act (right to prevent processing for purposes of direct marketing) does not affect the application of that section…
- **Sch. 20 para. 5**: (1) The repeal of section 12 of the 1998 Act (rights in relation to automated decision-taking) does not affect the application of that section after the…
- **Sch. 20 para. 6**: (1) The repeal of section 13 of the 1998 Act (compensation for failure to comply with certain requirements) does not affect the application of that section…
- **Sch. 20 para. 7**: (1) The repeal of section 14(1) to (3) and (6) of the 1998 Act (rectification, blocking, erasure and destruction of inaccurate personal data) does not affect…
- **Sch. 20 para. 8**: The repeal of section 15 of the 1998 Act (jurisdiction and procedure) does not affect the application of that section in connection with sections 7 to 14 of…
- **Sch. 20 para. 9**: (1) The repeal of Part 4 of the 1998 Act (exemptions) does not affect the application of that Part after the relevant time in connection with a provision of…
- **Sch. 20 para. 10**: (1) In Schedule 18 to this Act, references to a record obtained in the exercise of a data subject access right include a record obtained at any time in the…
- **Sch. 20 para. 11**: In section 185 of this Act, references to a record obtained in the exercise of a data subject access right include a record obtained at any time in the…
- **Sch. 20 para. 12**: In paragraph 20(2) of Schedule 2 to this Act (self-incrimination), the reference to an offence under this Act includes an offence under the 1998 Act or the…
- **Sch. 20 para. 13**: Until the first regulations under section 24(8) of this Act come into force, “the appropriate maximum” for the purposes of that section is— (a) where the…
- **Sch. 20 para. 14**: (1) In relation to an automated processing system set up before 6 May 2016, subsections (1) to (3) of section 62 of this Act do not apply if and to the extent…
- **Sch. 20 para. 15**: Nothing in this Schedule, read with the revocation of regulation 50 of the 2014 Regulations, has the effect of applying a provision of the 1998 Act to the…
- **Sch. 20 para. 16**: Until the first regulations under section 94(4)(b) of this Act come into force, the maximum amount of a fee that may be required by a controller under that…
- **Sch. 20 para. 17**: (1) The repeal of section 28(2) to (12) of the 1998 Act does not affect the application of those provisions after the relevant time with respect to the…
- **Sch. 20 para. 18**: (1) This paragraph applies to a certificate issued under section 28(2) of the 1998 Act (an “old certificate”) which has effect immediately before the relevant…
- **Sch. 20 para. 19**: (1) On and after the relevant day, the individual who was the Commissioner immediately before that day— (a) continues to be the Commissioner, (b) is to be…
- **Sch. 20 para. 20**: (1) The repeal of paragraph 10 of Schedule 5 to the 1998 Act does not affect the duties of the Commissioner and the Comptroller and Auditor General under that…
- **Sch. 20 para. 21**: (1) The repeal of section 52(1) of the 1998 Act (annual report) does not affect the Commissioner's duty under that subsection to produce a general report on…
- **Sch. 20 para. 22**: (1) The repeal of Schedule 5 to the 1998 Act (Information Commissioner) does not affect the application of paragraph 9 of that Schedule after the relevant time…
- **Sch. 20 para. 23**: Paragraph 10 of Schedule 12 to this Act applies only to amounts received by the Commissioner after the time when that Schedule comes into force.
- **Sch. 20 para. 24**: (1) The repeal of section 54(2) of the 1998 Act (functions to be discharged by the Commissioner for the purposes of Article 13 of the Data Protection…
- **Sch. 20 para. 25**: (1) The repeal of section 54(3) of the 1998 Act (co-operation by the Commissioner with the European Commission etc), and the revocation of the Data Protection…
- **Sch. 20 para. 26**: (1) The Data Protection (Charges and Information) Regulations 2018 (S.I. 2018/480) have effect after the relevant time (until revoked) as if they were made…
- **Sch. 20 para. 27**: (1) The repeal of section 42 of the 1998 Act (requests for assessment) does not affect the application of that section after the relevant time in a case in…
- **Sch. 20 para. 28**: (1) The repeal of section 52E of the 1998 Act (effect of codes of practice) does not affect the application of that section after the relevant time in relation…
- **Sch. 20 para. 29**: (1) In this Part of this Schedule, references to contravention of the sixth data protection principle sections are to relevant contravention of any of sections…
- **Sch. 20 para. 30**: (1) The repeal of section 43 of the 1998 Act (information notices) does not affect the application of that section after the relevant time in a case in which—…
- **Sch. 20 para. 31**: (1) The repeal of section 44 of the 1998 Act (special information notices) does not affect the application of that section after the relevant time in a case in…
- **Sch. 20 para. 32**: (1) The repeal of sections 41A and 41B of the 1998 Act (assessment notices) does not affect the application of those sections after the relevant time in a case…
- **Sch. 20 para. 33**: (1) The repeal of sections 40 and 41 of the 1998 Act (enforcement notices) does not affect the application of those sections after the relevant time in a case…
- **Sch. 20 para. 34**: (1) The repeal of section 45 of the 1998 Act (determination by Commissioner as to the special purposes) does not affect the application of that section after…
- **Sch. 20 para. 35**: (1) The repeal of section 46 of the 1998 Act (restriction on enforcement in case of processing for the special purposes) does not affect the application of…
- **Sch. 20 para. 36**: (1) The repeal of sections 47, 60 and 61 of the 1998 Act (offences of failing to comply with certain notices and of providing false information etc in response…
- **Sch. 20 para. 37**: (1) The repeal of sections 50, 60 and 61 of, and Schedule 9 to, the 1998 Act (powers of entry) does not affect the application of those provisions after the…
- **Sch. 20 para. 38**: (1) The repeal of sections 55A, 55B, 55D and 55E of the 1998 Act (monetary penalties) does not affect the application of those provisions after the relevant…
- **Sch. 20 para. 39**: (1) The repeal of sections 48 and 49 of the 1998 Act (appeals) does not affect the application of those sections after the relevant time in relation to a…
- **Sch. 20 para. 40**: (1) The repeal of section 28 of the 1998 Act (national security) does not affect the application of that section after the relevant time for the purposes of a…
- **Sch. 20 para. 41**: (1) The repeal of paragraph 7 of Schedule 6 to the 1998 Act (Tribunal Procedure Rules) does not affect the application of that paragraph, or of rules made…
- **Sch. 20 para. 42**: (1) The repeal of paragraph 8 of Schedule 6 to the 1998 Act (obstruction etc in proceedings before the Tribunal) does not affect the application of that…
- **Sch. 20 para. 43**: (1) The references in the preceding paragraphs of this Part of this Schedule to provisions of the 1998 Act include those provisions as applied, with…
- **Sch. 20 para. 44**: In section 143 of this Act— (a) the reference to an offence under section 144 of this Act includes an offence under section 47 of the 1998 Act (including as it…
- **Sch. 20 para. 45**: In paragraph 16 of Schedule 15 to this Act (powers of entry: self-incrimination), the reference to an offence under paragraph 15 of that Schedule includes an…
- **Sch. 20 para. 46**: (1) Tribunal Procedure Rules made under paragraph 7(1)(a) of Schedule 6 to the 1998 Act (appeal rights under the 1998 Act) and in force immediately before the…
- **Sch. 20 para. 47**: (1) The following provisions (as amended by Schedule 19 to this Act) have effect after the relevant time as if the matters they refer to included a matter in…
- **Sch. 20 para. 48**: (1) This paragraph applies in relation to the code of practice issued under each of the following provisions— (a) section 19AC of the Registration Service Act…
- **Sch. 20 para. 49**: (1) This paragraph applies in relation to the original statement published under section 45E of the Statistics and Registration Service Act 2007 (statement of…
- **Sch. 20 para. 50**: In section 159(1)(a) of the Consumer Credit Act 1974 (correction of wrong information) (as amended by Schedule 19 to this Act), the reference to information…
- **Sch. 20 para. 51**: Paragraphs 52 to 55 make provision about the Freedom of Information Act 2000 (“the 2000 Act”).
- **Sch. 20 para. 52**: (1) This paragraph applies where a request for information was made to a public authority under the 2000 Act before the relevant time. (2) To the extent that…
- **Sch. 20 para. 53**: (1) Tribunal Procedure Rules made under paragraph 7(1)(b) of Schedule 6 to the 1998 Act (appeal rights under the 2000 Act) and in force immediately before the…
- **Sch. 20 para. 54**: (1) The repeal of paragraph 8 of Schedule 6 to the 1998 Act (obstruction etc in proceedings before the Tribunal) does not affect the application of that…
- **Sch. 20 para. 55**: (1) The amendment of section 77 of the 2000 Act in Schedule 19 to this Act (offence of altering etc record with intent to prevent disclosure: omission of…
- **Sch. 20 para. 56**: (1) This paragraph applies where a request for information was made to a Scottish public authority under the Freedom of Information (Scotland) Act 2002 (“the…
- **Sch. 20 para. 57**: Until the first regulations under Article 5(4)(a) of the Access to Health Records (Northern Ireland) Order 1993 (as amended by Schedule 19 to this Act) come…
- **Sch. 20 para. 58**: (1) The repeal of a provision of the 1998 Act does not affect its operation for the purposes of the Privacy and Electronic Communications (EC Directive)…
- **Sch. 20 para. 59**: Part 3 of Schedule 19 to this Act (modifications) does not have effect in relation to the reference to an accessible record within the meaning of section 68 of…
- **Sch. 20 para. 60**: (1) This paragraph applies where a request for information was made to a public authority under the Environmental Information Regulations 2004 (“the 2004…
- **Sch. 20 para. 61**: (1) This paragraph applies where a request for information was made to a Scottish public authority under the Environmental Information (Scotland) Regulations…

### SCHEDULE 21

- **Sch. 21 para. 1 The applied GPDR**: In this Schedule, “the applied GDPR” means the EU GDPR as applied by Chapter 3 of Part 2 before IP completion day.
- **Sch. 21 para. 2 Merger of the directly applicable GDPR and the applied GDPR**: (1) On and after IP completion day, references in an enactment to the UK GDPR (including the reference in the definition of “the data protection legislation”…
- **Sch. 21 para. 3**: (1) Anything done in connection with the EU GDPR as it was directly applicable to the United Kingdom before IP completion day, the applied GDPR or this Act—…
- **Sch. 21 para. 4 UK GDPR: transfers approved by regulations**: (1) On and after IP completion day, for the purposes of the UK GDPR and Part 2 of this Act, a transfer of personal data to a third country or an international…
- **Sch. 21 para. 5**: (1) The following are specified for the purposes of paragraph 4(1)— (a) an EEA state; (b) Gibraltar; (c) a Union institution, body, office or agency set up by…
- **Sch. 21 para. 6**: (1) In the provisions listed in sub-paragraph (2)— (a) references to regulations made under Article 45A of the UK GDPR (other than references to making such…
- **Sch. 21 para. 9 UK GDPR: transfers subject to appropriate safeguards provided by binding corporate rules**: (1) The requirement for safeguards to be provided under Article 46(1A)(a)(i) of the UK GDPR may be satisfied on and after IP completion day as described in…
- **Sch. 21 para. 10 Part 3 (law enforcement processing): transfers approved by regulations**: (1) On and after IP completion day, for the purposes of Part 3 of this Act, a transfer of personal data to a third country or an international organisation is…
- **Sch. 21 para. 11**: (1) The following are specified for the purposes of paragraph 10(1)— (a) an EEA state; (aa) Switzerland; (b) Gibraltar; (c) a third country, a territory or…
- **Sch. 21 para. 12**: (1) In sections 74B and 76(A1)— (a) references to regulations made under section 74AA (other than references to making such regulations) include the provision…
- **Sch. 21 para. 13 Applied GDPR: power to make provision in consequence of GDPR regulations**: (1) Regulations made under section 23 before IP completion day continue in force until they are revoked, despite the repeal of that section by the Data…
- **Sch. 21 para. 14 Applied GDPR: national security certificates**: (1) This paragraph applies to a certificate issued under section 27 of this Act which has effect immediately before IP completion day. (2) A reference in the…
- **Sch. 21 para. 15 Confidentiality of information**: The repeal of section 132(2)(d) by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 has effect only in…
- **Sch. 21 para. 16 GDPR: maximum amount of penalties**: In relation to an infringement, before IP completion day, of a provision of the EU GDPR (as it was directly applicable to the United Kingdom) or the applied…
- **Sch. 21 para. 17 GDPR: right to an effective remedy against the Commissioner**: (1) This paragraph applies where— (a) proceedings are brought against a decision made by the Commissioner before IP completion day, and (b) the Commissioner's…

---

Consilena is a software provider, not a law firm. AI output is not legal advice: consult a licensed lawyer in the relevant jurisdiction. Page: https://consilena.com/coverage/laws/stat_uk_ukpga_2018_12. Index of every page: https://consilena.com/llms.txt.