| Guvnor

Enforced by: ICO, SRA, LSB, RQIA, Forestry Commission
Status: Amended (in force with amendments)
Penalty ceiling: Imprisonment 54 of 92 obligations carry a fine up to £17,500,000. 12 carry different penalties and 26 have no criminal penalty — flagged in the list below.

Does it bind you?

Business-side roles with duties under this instrument.

Data Controller46 Any Person17 Director or Officer1 Contractor1

Plus 27 duties on the regulator, Crown ministers and public bodies — folded into the section list below.

Other Acts binding the same actors

If a role above is yours, these are the other instruments that most often bind it.

Data Controller — also bound by 35 other Acts

UK GDPR (retained EU law) 127 duties

The Town and Country Planning (Entertainment Resort Complex, Bedford) Special Development (No. 2) Order 2025 50 duties

Regulation (EU) 2018/1139 (EASA Basic Regulation) 6 duties

Privacy and Electronic Communications Regulations 2003 5 duties

Equality Act 2010 3 duties

Any Person — also bound by 2340 other Acts

Human Medicines Regulations 2012 184 duties

Merchant Shipping Act 1995 144 duties

Insolvency (England and Wales) Rules 2016 104 duties

Communications Act 2003 92 duties

Road Traffic Act 1988 92 duties

Director or Officer — also bound by 429 other Acts

Insolvency (England and Wales) Rules 2016 162 duties

Companies Act 2006 126 duties

Insolvency Act 1986 77 duties

The Large and Medium-sized Companies and Groups (Accounts and Reports) Regulations 2008 68 duties

Building Societies Act 1986 32 duties

Contractor — also bound by 173 other Acts

The National Health Service (Personal Medical Services Agreements) Regulations 2015 141 duties

The National Health Service (General Medical Services Contracts) Regulations 2015 136 duties

Construction (Design and Management) Regulations 2015 114 duties

The National Health Service (General Medical Services Contracts) (Wales) Regulations 2023 94 duties

The National Health Service (General Medical Services Contracts) (Scotland) Regulations 2018 89 duties

What it requires

Sections creating concrete business duties or carrying penalties, grouped as the instrument is structured. Titles link to the source text — blue means you’re leaving for legislation.gov.uk.

Part 1

Preliminary

1 of 3 sections shown

s.002 Protection of personal data Prosecution

Process personal data lawfully, fairly, and transparentlyData Controller

Fine up to £17,500,000

2 other sections in this Part — procedural and definitional

s.001 Overview

s.003 Terms relating to the processing of personal data

Part 2

General processing

1 of 30 sections shown

s.013 Obligations of credit reference agencies Prosecution

Include specific legal rights statement when responding to data requestsData Controller

Fine up to £17,500,000

29 other sections in this Part — procedural and definitional

s.004 Processing to which this Part applies

s.005 Article 57(3) of the UK GDPR (performance of Commissioner’s tasks...

s.006 Meaning of “controller”

s.007 Meaning of “public authority” and “public body”

s.008 Lawfulness of processing: public interest etc

s.009 Child's consent in relation to information society services

s.009 Processing in reliance on relevant international law

s.010 Special categories of personal data and criminal convictions etc data

s.011 Special categories of personal data etc: supplementary

s.012 Limits on fees that may be charged by controllers

s.013 Meaning of “relevant offence” for purpose of right to erasure

s.014 Automated decision-making authorised by law: safeguards

s.015 Exemptions etc

s.016 Power to make further exemptions etc by regulations

s.017 Accreditation of certification providers

s.017 Transfers based on adequacy regulations

s.017 Transfers based on adequacy regulations: review etc

s.017 Standard data protection clauses

s.018 Transfers of personal data to third countries etc : public interest

s.019 Processing for archiving, research and statistical purposes: safeguards

s.020 Meaning of “court”

s.021 Definitions

s.022 Application of the GDPR to processing to which this Chapter applies

s.023 Power to make provision in consequence of regulations related to the GDPR

s.024 Manual unstructured data held by FOI public authorities

s.025 Manual unstructured data used in longstanding historical research

s.026 National security and defence exemption

s.027 National security: certificate

s.028 National security and defence: modifications to Articles 9 and 32 of the UK GDPR

Part 3

Law enforcement processing

34 of 65 sections shown

s.034 Overview and general duty of controller Prosecution

Comply with data protection principles and prove itData Controller

Fine up to £17,500,000

s.036 The second data protection principle Prosecution

Use law enforcement data only for specified and compatible purposesData Controller

Fine up to £17,500,000

s.037 The third data protection principle Prosecution

Ensure law enforcement data is adequate, relevant, and not excessiveAny Person

Fine up to £17,500,000

s.038 The fourth data protection principle Prosecution

Maintain accurate law enforcement data and verify its qualityData Controller

Fine up to £17,500,000

s.039 The fifth data protection principle Prosecution

Establish data retention limits and review periods for law enforcement dataAny Person

Fine up to £17,500,000

s.040 The sixth data protection principle Prosecution

Secure personal data against loss or unauthorized accessAny Person

Fine up to £17,500,000

s.041 Safeguards: archiving Prosecution

Do not use archived law enforcement data to make decisions about individualsData Controller

Fine up to £17,500,000

s.042 Safeguards: sensitive processing Prosecution

Maintain and review a policy for sensitive data processingData Controller

Fine up to £17,500,000

s.046 Right to rectification Prosecution

Correct or complete inaccurate personal data upon requestData Controller

Fine up to £17,500,000

s.047 Right to erasure or restriction of processing Prosecution

Erase or restrict processing of personal dataData Controller

Fine up to £17,500,000

s.048 Rights under section 46 or 47: supplementary Prosecution

Respond to data rectification, erasure, or restriction requestsData Controller

Fine up to £17,500,000

s.050 Restrictions on automated decision-making based on sensitive processing Prosecution

Do not make significant decisions using only automated sensitive data processingData Controller

Fine up to £17,500,000

s.050 Safeguards for automated decision-making Prosecution

Provide safeguards for automated decision-makingData Controller

Fine up to £17,500,000

s.051 Exercise of rights through the Commissioner Regulated

Other duties (1) — Crown / regulator

ICO must verify if a business's refusal of data rights was lawfulStatutory regulator

s.052 Form of provision of information etc Prosecution

Provide personal data in a clear, accessible, and free formatData Controller

Fine up to £17,500,000

s.053 Manifestly unfounded or excessive requests by the data subject Prosecution

Handling unfounded or excessive data subject requestsData Controller

Fine up to £17,500,000

s.056 General obligations of the controller Prosecution

Implement and demonstrate data protection compliance measuresData Controller

Fine up to £17,500,000

s.057 Data protection by design and default Prosecution

Build data protection into your systems and processes by defaultData Controller

Fine up to £17,500,000

s.058 Joint controllers Prosecution

Create a formal agreement and contact point with joint data controllersData Controller

Fine up to £17,500,000

s.059 Processors Prosecution

Use only compliant data processors and maintain written contractsData Controller

Fine up to £17,500,000

s.060 Processing under the authority of the controller or processor Prosecution

Only process personal data on instructions or for legal dutiesData Controller

Fine up to £17,500,000

s.061 Records of processing activities Prosecution

Maintain records of your data processing activitiesData Controller

Fine up to £17,500,000

s.062 Logging Prosecution

Maintain and share automated logs of data processing operationsData Controller

Fine up to £17,500,000

s.063 Co-operation with the Commissioner Prosecution

Co-operate with the Information Commissioner's Office (ICO)Data Controller

Fine up to £17,500,000

s.064 Data protection impact assessment Prosecution

Conduct a Data Protection Impact Assessment (DPIA) for high-risk processingData Controller

Fine up to £17,500,000

s.065 Prior consultation with the Commissioner Prosecution

Consult the ICO before high-risk data processingData Controller

Fine up to £17,500,000

s.066 Security of processing Prosecution

Implement appropriate security measures for personal dataData Controller

Fine up to £17,500,000

s.069 Designation of a data protection officer Prosecution

Appoint a Data Protection Officer and notify the ICOData Controller

Fine up to £17,500,000

s.070 Position of data protection officer Prosecution

Support and protect your Data Protection Officer (DPO)Data Controller

Fine up to £17,500,000

s.071 Tasks of data protection officer Prosecution

Ensure your Data Protection Officer performs their statutory tasksData Controller

Fine up to £17,500,000

s.073 General principles for transfers of personal data Prosecution

Verify legal conditions before transferring law enforcement data abroadData Controller

Fine up to £17,500,000

s.074 Transfers approved by regulations: monitoring Regulated

Other duties (1) — Crown / regulator

Secretary of State must monitor and update approved data transfer listsCrown / Minister / Government department

s.078 Subsequent transfers Prosecution

Control further transfers of law enforcement data abroadData Controller

Fine up to £17,500,000

s.080 Special processing restrictions Prosecution

Notify international data recipients of UK processing restrictionsData Controller

Fine up to £17,500,000

31 other sections in this Part — procedural and definitional

s.029 Processing to which this Part applies

s.030 Meaning of “competent authority”

s.031 “The law enforcement purposes”

s.032 Meaning of “controller” and “processor”

s.033 Other definitions

s.035 The first data protection principle

s.042 Further provision about sensitive processing

s.043 Overview and scope

s.044 ... Controller's general duties

s.045 Right of access by the data subject

s.045 Exemption from sections 44 and 45: legal professional privilege

s.049 Right not to be subject to automated decision-making

s.050 Automated decision-making authorised by law: safeguards

s.050 Automated processing and significant decisions

s.050 Further provision about automated decision-making

s.054 Meaning of “applicable time period”

s.055 Overview and scope

s.067 Notification of a personal data breach to the Commissioner

s.068 Communication of a personal data breach to the data subject

s.071 Codes of conduct

s.072 Overview and interpretation

s.074 Transfers on the basis of an adequacy decision

s.074 Transfers based on adequacy regulations

s.074 Transfers approved by regulations

s.074 The data protection test

s.075 Transfers subject to appropriate safeguards

s.076 Transfers based on special circumstances

s.077 Additional conditions for transfers in reliance on section 73(4)(b)

s.078 National security exemption

s.079 National security: certificate

s.081 Reporting of infringements

Part 4

Intelligence services processing

24 of 38 sections shown

s.082 Review and withdrawal of designation notice Regulated

Other duties (1) — Crown / regulator

Secretary of State must annually review national security designation noticesCrown / Minister / Government department

s.082 Records of designation notices Regulated

Other duties (1) — Crown / regulator

Secretary of State must notify ICO of designation noticesCrown / Minister / Government department

s.087 The second data protection principle Prosecution

Collect and process personal data only for specific, lawful purposesData Controller

Fine up to £17,500,000

s.088 The third data protection principle Prosecution

Ensure personal data is adequate, relevant, and not excessiveAny Person

Fine up to £17,500,000

s.089 The fourth data protection principle Prosecution

Keep all personal data accurate and up to dateAny Person

Fine up to £17,500,000

s.090 The fifth data protection principle Prosecution

Keep personal data only for as long as necessaryAny Person

Fine up to £17,500,000

s.091 The sixth data protection principle Prosecution

Implement appropriate security measures to protect personal dataAny Person

Fine up to £17,500,000

s.094 Right of access Prosecution

Respond to personal data access requestsData Controller

Fine up to £17,500,000

s.095 Right of access: supplementary Prosecution

Provide data subjects with copies of their personal dataData Controller

Fine up to £17,500,000

s.098 Right to information about decision-making Prosecution

Explain the logic behind automated or data-driven decisions upon requestData Controller

Fine up to £17,500,000

s.100 Rights to rectification and erasure

amended 1 time (opens in a new tab)

s.101 Overview

amended 1 time (opens in a new tab)

s.102 General obligations of the controller Prosecution

Ensure and demonstrate that your data processing is legalData Controller

Fine up to £17,500,000 · amended 2 times (opens in a new tab)

s.103 Data protection by design Prosecution

Assess privacy impacts and design data protection into your systemsData Controller

Fine up to £17,500,000 · amended 1 time (opens in a new tab)

s.104 Joint controllers Prosecution

Establish an agreement between joint data controllersData Controller

Fine up to £17,500,000 · amended 2 times (opens in a new tab)

s.105 Processors Prosecution

Vet and monitor third-party data processorsData Controller

Fine up to £17,500,000 · amended 1 time (opens in a new tab)

s.106 Processing under the authority of the controller or processor Prosecution

Process personal data only on specific instructions or legal groundsData Controller

Fine up to £17,500,000 · amended 1 time (opens in a new tab)

s.107 Security of processing Prosecution

Implement appropriate security measures to protect personal dataData Controller

Fine up to £17,500,000 · amended 1 time (opens in a new tab)

s.108 Communication of a personal data breach

amended 3 times (opens in a new tab)

s.109 Transfers of personal data outside the United Kingdom Prosecution

Restrict personal data transfers outside the UKData Controller

Fine up to £17,500,000 · amended 1 time (opens in a new tab)

s.110 National security

amended 7 times (opens in a new tab)

s.111 National security: certificate

amended 1 time (opens in a new tab)

s.112 Other exemptions

amended 1 time (opens in a new tab)

s.113 Power to make further exemptions

amended 1 time (opens in a new tab)

14 other sections in this Part — procedural and definitional

s.082 Processing to which this Part applies

s.082 Designation of processing by a qualifying competent authority

s.082 Duration of designation notice

s.082 Appeal against designation notice

s.083 Meaning of “controller” and “processor”

s.084 Other definitions

s.085 Overview

s.086 The first data protection principle

s.091 Further provision about sensitive processing

s.092 Overview

s.093 Right to information

s.096 Right not to be subject to automated decision-making

s.097 Right to intervene in automated decision-making

s.099 Right to object to processing

Part 5

The Information Commissioner

38 of 38 sections shown

s.114 The Information Commissioner

amended 1 time (opens in a new tab)

s.114 The Information Commission

amended 1 time

s.115 General functions under the UK GDPR and safeguards

amended 16 times (opens in a new tab)

s.116 Other general functions

amended 10 times (opens in a new tab)

s.117 Competence in relation to courts etc

amended 4 times (opens in a new tab)

s.118 Co-operation between parties to the Data Protection Convention

amended 6 times (opens in a new tab)

s.119 Inspection of personal data in accordance with international obligations Imprisonment

Obstruct or fail to assist the ICO’s inspection powersAny Person

2 years imprisonment · amended 4 times (opens in a new tab)

s.119 Standard clauses for transfers to third countries etc Regulated

Other duties (1) — Crown / regulator

ICO must consult and publish standard data protection clausesStatutory regulator

amended 4 times

s.120 Further international role

amended 9 times (opens in a new tab)

s.120 Principal objective

amended 9 times

s.120 Duties in relation to functions under the data protection legislation Regulated

Other duties (1) — Crown / regulator

ICO must consider innovation and competition when enforcing data lawsStatutory regulator

amended 9 times

s.120 Strategy Regulated

Other duties (1) — Crown / regulator

Information Commissioner must publish a data protection strategyStatutory regulator

amended 9 times

s.120 Duty to consult other regulators

amended 9 times

s.121 Data-sharing code Regulated

Other duties (1) — Crown / regulator

ICO must produce and maintain a data-sharing code of practiceStatutory regulator

amended 2 times (opens in a new tab)

s.122 Direct marketing code Prosecution

Other duties (1) — Crown / regulator

ICO must produce and maintain a direct marketing code of practiceStatutory regulator

Fine up to £17,500,000 · amended 2 times (opens in a new tab)

s.123 Age-appropriate design code Regulated

Other duties (1) — Crown / regulator

Commissioner must prepare age-appropriate design codeStatutory regulator

amended 3 times (opens in a new tab)

s.124 Data protection and journalism code Regulated

Other duties (1) — Crown / regulator

ICO must produce and maintain a data protection and journalism codeStatutory regulator

amended 3 times (opens in a new tab)

s.124 Other codes of practice Regulated

Other duties (1) — Crown / regulator

ICO must prepare codes of practice on personal data processingStatutory regulator

amended 3 times

s.124 Panels to consider codes of practice

amended 3 times

s.124 Impact assessments for codes of practice Regulated

Other duties (1) — Crown / regulator

ICO must conduct impact assessments for codes of practiceStatutory regulator

amended 3 times

s.125 Approval of codes prepared under sections 121 to 124A

amended 12 times (opens in a new tab)

s.126 Publication and review of codes issued under section 125(4) Regulated

Other duties (1) — Crown / regulator

Information Commissioner must publish and review codes of practiceStatutory regulator

amended 2 times (opens in a new tab)

s.127 Effect of codes issued under section 125(4)

amended 2 times (opens in a new tab)

s.128 Other codes of practice

amended 2 times (opens in a new tab)

s.129 Consensual audits

amended 5 times (opens in a new tab)

s.130 Records of national security certificates Regulated

Other duties (1) — Crown / regulator

ICO must maintain a public record of national security certificatesStatutory regulator

amended 3 times (opens in a new tab)

s.131 Disclosure of information to the Commissioner

amended 2 times (opens in a new tab)

s.132 Confidentiality of information Prosecution

Unlawfully disclosing information held by the ICOContractor

Unlimited fine · amended 4 times (opens in a new tab)

s.133 Guidance about privileged communications Regulated

Other duties (1) — Crown / regulator

ICO must publish guidance on handling legally privileged informationStatutory regulator

amended 1 time (opens in a new tab)

s.134 Fees for services

amended 2 times (opens in a new tab)

s.135 Manifestly unfounded or excessive requests by data subjects etc

amended 13 times (opens in a new tab)

s.136 Guidance about fees Regulated

Other duties (1) — Crown / regulator

ICO must publish guidance on fees and consult the Secretary of StateStatutory regulator

amended 5 times (opens in a new tab)

s.137 Charges payable to the Commissioner by controllers

amended 4 times (opens in a new tab)

s.138 Regulations under section 137: supplementary

amended 2 times (opens in a new tab)

s.139 Reporting to Parliament Regulated

Other duties (1) — Crown / regulator

Information Commissioner must report annually to ParliamentStatutory regulator

amended 9 times (opens in a new tab)

s.139 Analysis of performance Regulated

Other duties (1) — Crown / regulator

ICO must publish an annual analysis of its own performanceStatutory regulator

amended 9 times

s.140 Publication by the Commissioner Regulated

Other duties (1) — Crown / regulator

Information Commissioner must publish required documents appropriatelyStatutory regulator

amended 3 times (opens in a new tab)

s.141 Notices from the Commissioner

amended 3 times (opens in a new tab)

Part 6

Enforcement

48 of 48 sections shown

s.142 Information notices

amended 20 times (opens in a new tab)

s.143 Information notices: restrictions

amended 9 times (opens in a new tab)

s.144 False statements made in response to information notices Prosecution

Make false statement in response to an information noticeAny Person

Unlimited fine · amended 2 times (opens in a new tab)

s.145 Information orders

amended 9 times (opens in a new tab)

s.146 Assessment notices

amended 16 times (opens in a new tab)

s.146 Assessment notices: approval of person to prepare report etc Prosecution

Nominate a person to prepare an assessment reportData Controller

Fine up to £17,500,000 · amended 16 times

s.147 Assessment notices: restrictions

amended 5 times (opens in a new tab)

s.148 Destroying or falsifying information and documents etc Imprisonment

Destroy or falsify information after an ICO noticeAny Person

2 years imprisonment · amended 7 times (opens in a new tab)

s.148 Interview notices

amended 7 times

s.148 Interview notices: restrictions

amended 7 times

s.148 False statements made in response to interview notices Imprisonment

Make false statement in response to interview noticeAny Person

2 years imprisonment · amended 7 times

s.149 Enforcement notices

amended 19 times (opens in a new tab)

s.150 Enforcement notices: supplementary

amended 6 times (opens in a new tab)

s.151 Enforcement notices: rectification and erasure of personal data etc

amended 8 times (opens in a new tab)

s.152 Enforcement notices: restrictions

amended 5 times (opens in a new tab)

s.153 Enforcement notices: cancellation and variation

amended 4 times (opens in a new tab)

s.154 Powers of entry and inspection

amended 2 times (opens in a new tab)

s.155 Penalty notices Prosecution

Breach of data protection laws or ICO noticesData Controller

Fine up to £17,500,000 · amended 14 times (opens in a new tab)

s.156 Penalty notices: restrictions

amended 4 times (opens in a new tab)

s.157 Maximum amount of penalty

amended 10 times (opens in a new tab)

s.158 Fixed penalties for non-compliance with charges regulations Regulated

Other duties (1) — Crown / regulator

Information Commissioner must publish fixed penalty amounts for fee failuresStatutory regulator

amended 3 times (opens in a new tab)

s.159 Amount of penalties: supplementary

amended 4 times (opens in a new tab)

s.160 Guidance about regulatory action Regulated

Other duties (1) — Crown / regulator

ICO must publish guidance on its regulatory and enforcement powersStatutory regulator

amended 16 times (opens in a new tab)

s.161 Approval of first guidance about regulatory action Regulated

Other duties (1) — Crown / regulator

ICO must obtain parliamentary approval before issuing first regulatory-action guidanceStatutory regulator

amended 6 times (opens in a new tab)

s.161 Annual report on regulatory action

amended 6 times

s.162 Rights of appeal

amended 3 times (opens in a new tab)

s.163 Determination of appeals

amended 4 times (opens in a new tab)

s.164 Applications in respect of urgent notices

amended 4 times (opens in a new tab)

s.164 Complaints by data subjects to controllers Prosecution

Establish and manage a formal data protection complaint processData Controller

Fine up to £17,500,000 · amended 4 times

s.164 Controllers to notify the Commissioner of the number of complaints

amended 4 times

s.165 Complaints by data subjects

amended 8 times (opens in a new tab)

s.166 Orders to progress complaints

amended 3 times (opens in a new tab)

s.167 Compliance orders

amended 2 times (opens in a new tab)

s.168 Compensation for contravention of the UK GDPR

amended 3 times (opens in a new tab)

s.169 Compensation for contravention of other data protection legislation

amended 2 times (opens in a new tab)

s.170 Unlawful obtaining etc of personal data Imprisonment

Unlawfully obtain, retain, disclose or sell personal dataAny Person

2 years imprisonment · amended 3 times (opens in a new tab)

s.171 Re-identification of de-identified personal data Imprisonment

Re‑identify de‑identified personal data without consentAny Person

2 years imprisonment · amended 4 times (opens in a new tab)

s.172 Re-identification: effectiveness testing conditions

amended 2 times (opens in a new tab)

s.173 Alteration etc of personal data to prevent disclosure to data subject Imprisonment

Alter data to block a data subject’s access requestData Controller

2 years imprisonment · amended 3 times (opens in a new tab)

s.174 The special purposes

amended 5 times (opens in a new tab)

s.175 Provision of assistance in special purposes proceedings

amended 2 times (opens in a new tab)

s.176 Staying special purposes proceedings

amended 2 times (opens in a new tab)

s.177 Guidance about how to seek redress against media organisations

amended 5 times (opens in a new tab)

s.178 Review of processing of personal data for the purposes of journalism Regulated

Other duties (1) — Crown / regulator

ICO must periodically review and report on media data protection complianceStatutory regulator

amended 5 times (opens in a new tab)

s.179 Effectiveness of the media's dispute resolution procedures Regulated

Other duties (1) — Crown / regulator

Secretary of State must report on media data protection dispute resolutionCrown / Minister / Government department

s.180 Jurisdiction

amended 4 times (opens in a new tab)

s.180 Procedure in connection with subject access requests

amended 4 times

s.181 Interpretation of Part 6

amended 4 times (opens in a new tab)

Part 7

Supplementary and final provision

35 of 37 sections shown

s.182 Regulations and consultation

amended 14 times (opens in a new tab)

s.183 Power to reflect changes to the Data Protection Convention

amended 5 times (opens in a new tab)

s.183 Protection of prohibitions and restrictions etc on processing: relevant enactments

amended 5 times

s.183 Protection of prohibitions and restrictions etc on processing: other enactments

amended 5 times

s.184 Prohibition of requirement to produce relevant records Imprisonment

Require a relevant record from another personAny Person

2 years imprisonment · amended 4 times (opens in a new tab)

s.185 Avoidance of certain contractual terms relating to health records

amended 3 times (opens in a new tab)

s.186 Protection of data subject’s rights

amended 8 times (opens in a new tab)

s.186 Protection of data subject’s rights: further provision

amended 8 times

s.187 Representation of data subjects with their authority

amended 17 times (opens in a new tab)

s.188 Representation of data subjects with their authority: collective proceedings

amended 2 times (opens in a new tab)

s.189 Duty to review provision for representation of data subjects

amended 5 times (opens in a new tab)

s.190 Post-review powers to make provision about representation of data subjects

amended 2 times (opens in a new tab)

s.191 Framework for Data Processing by Government

amended 2 times (opens in a new tab)

s.192 Approval of the Framework

amended 2 times (opens in a new tab)

s.193 Publication and review of the Framework Regulated

Other duties (1) — Crown / regulator

Secretary of State must publish and review the Data Processing FrameworkCrown / Minister / Government department

amended 1 time (opens in a new tab)

s.194 Effect of the Framework Prosecution

Follow official guidance when processing personal dataAny Person

Fine up to £17,500,000 · amended 2 times (opens in a new tab)

s.195 Reserve forces: data-sharing by HMRC Imprisonment

Unlawfully disclose reserve force member contact detailsAny Person

2 years imprisonment · amended 1 time (opens in a new tab)

s.196 Penalties for offences Prosecution

Commit certain data‑protection offencesAny Person

Unlimited fine · amended 3 times (opens in a new tab)

s.197 Prosecution

amended 4 times (opens in a new tab)

s.198 Liability of directors etc Prosecution

Be liable as director for a data protection offenceDirector or Officer

Unlimited fine · amended 1 time (opens in a new tab)

s.199 Recordable offences

amended 2 times (opens in a new tab)

s.200 Guidance about PACE codes of practice Regulated

Other duties (1) — Crown / regulator

ICO must publish guidance on police and criminal evidence codesStatutory regulator

amended 2 times (opens in a new tab)

s.201 Disclosure of information to the Tribunal

amended 2 times (opens in a new tab)

s.202 Proceedings in the First-tier Tribunal: contempt

amended 3 times (opens in a new tab)

s.203 Tribunal Procedure Rules

amended 3 times (opens in a new tab)

s.204 Meaning of “health professional” and “social work professional”

amended 6 times (opens in a new tab)

s.205 General interpretation

amended 18 times (opens in a new tab)

s.206 Index of defined expressions

amended 17 times (opens in a new tab)

s.207 Territorial application of this Act

amended 10 times (opens in a new tab)

s.208 Children in Scotland

amended 1 time (opens in a new tab)

s.209 Application to the Crown

amended 9 times (opens in a new tab)

s.210 Application to Parliament

amended 2 times (opens in a new tab)

s.211 Minor and consequential provision

amended 1 time (opens in a new tab)

s.213 Transitional provision

amended 4 times (opens in a new tab)

s.214 Extent

amended 2 times (opens in a new tab)

2 other sections in this Part — procedural and definitional

s.212 Commencement

s.215 Short title

Schedules

0 of 885 shown

885 other schedules

s.004 Exemptions etc from the UK GDPR : disclosure prohibited or restricted by an enactment

s.005 Accreditation of certification providers: reviews and appeals

s.006 The applied GDPR and the applied Chapter 2

s.007 Competent authorities

s.009 Conditions for processing under Part 4

s.014 Co-operation and mutual assistance

s.015 Powers of entry and inspection

s.017 Review of processing of personal data for the purposes of journalism

s.020 Transitional provision etc

s.sch001 (1) This condition is met if— (a) the processing is...

s.sch001 (1) This condition is met if the processing—

s.sch001 (1) This condition is met if— (a) the processing is...

s.sch001 (1) This condition is met if— (a) the processing consists...

s.sch001 (1) This condition is met if the processing—

s.sch001 This condition is met if the processing is necessary for...

s.sch001 (1) This condition is met if the processing—

s.sch001 (1) This condition is met if— (a) the processing is...

s.sch001 (1) This condition is met if the processing—

s.sch001 (1) This condition is met if the processing is necessary...

s.sch001 (1) This condition is met if the processing—

s.sch001 (1) This condition is met if— (a) the processing is...

s.sch001 (1) This condition is met if— (a) the processing consists...

s.sch001 This condition is met if the processing—

s.sch001 (1) This condition is met if the processing is necessary—...

s.sch001 (1) This condition is met if the processing—

s.sch001 This condition is met if the data subject has given...

s.sch001 This condition is met if the processing—

s.sch001 This condition is met if— (a) the processing is necessary...

s.sch001 This condition is met if the processing is carried out—...

s.sch001 This condition is met if the processing relates to personal...

s.sch001 This condition is met if the processing—

s.sch001 This condition is met if the processing is necessary when...

s.sch001 (1) This condition is met if— (a) the processing is...

s.sch001 This condition is met if the processing would meet a...

s.sch001 This condition is met if the processing—

s.sch001 This Part of this Schedule makes provision about the processing...

s.sch001 The controller has an appropriate policy document in place in...

s.sch001 This condition is met if the processing—

s.sch001 (1) Where personal data is processed in reliance on a...

s.sch001 A record maintained by the controller, or the controller's representative,...

s.sch001 (1) Except as otherwise provided, a condition in this Part...

s.sch001 (1) This condition is met if the processing—

s.sch001 This condition is met if the processing is necessary—

s.sch001 (1) This condition is met if the processing—

s.sch002 In this Part of this Schedule, “the listed GDPR provisions”...

s.sch002 (1) The listed GDPR provisions do not apply to personal...

s.sch002 The listed GDPR provisions do not apply to personal data...

s.sch002 In the Table in paragraph 11— ... ... the “Financial...

s.sch002 The listed GDPR provisions and Article 34(1) and (4) of...

s.sch002 (1) The listed GDPR provisions do not apply to personal...

s.sch002 (1) Article 15(1) to (3) of the UK GDPR (confirmation...

s.sch002 (1) For the purposes of paragraph 16(2)(b), it is to...

s.sch002 In this Part of this Schedule, “the listed GDPR provisions”...

s.sch002 The listed GDPR provisions do not apply to personal data...

s.sch002 (1) The listed GDPR provisions and Article 34(1) and (4)...

s.sch002 (1) A person need not comply with the listed GDPR...

s.sch002 (1) The listed GDPR provisions do not apply to personal...

s.sch002 The listed GDPR provisions do not apply to personal data...

s.sch002 (1) The listed GDPR provisions do not apply to personal...

s.sch002 (1) In this paragraph, “the special purposes” means one or...

s.sch002 (1) The listed GDPR provisions do not apply to personal...

s.sch002 (1) The UK GDPR provisions listed in sub-paragraph (3) do...

s.sch002 (1) The relevant UK GDPR provisions do not apply to...

s.sch002 (1) A decision under paragraph 4(1) as to whether, and...

s.sch002 (1) Where the Secretary of State makes a decision mentioned...

s.sch002 (1) The listed GDPR provisions do not apply to personal...

s.sch002 In this Part of this Schedule, “the listed GDPR provisions”...

s.sch002 The listed GDPR provisions do not apply to personal data...

s.sch002 (1) The listed GDPR provisions do not apply to personal...

s.sch003 In this Schedule “the listed GDPR provisions” means the following...

s.sch003 (1) This paragraph applies where a request for social work...

s.sch003 Article 15(1) to (3) of the UK GDPR (confirmation of...

s.sch003 (1) This paragraph applies where— (a) a question arises as...

s.sch003 In this Part of this Schedule “educational record” means a...

s.sch003 (1) This paragraph applies to a record of information which—...

s.sch003 (1) This paragraph applies to a record of information which...

s.sch003 (1) This paragraph applies to a record of information which—...

s.sch003 (1) In this Part of this Schedule— “education authority” and...

s.sch003 (1) The listed GDPR provisions do not apply to education...

s.sch003 Article 15(1) to (3) of the UK GDPR (confirmation of...

s.sch003 (1) In this Part of this Schedule— “the appropriate health...

s.sch003 (1) This paragraph applies where— (a) a question arises as...

s.sch003 (1) This paragraph applies where a request for child abuse...

s.sch003 (1) The listed GDPR provisions do not apply to data...

s.sch003 (1) This paragraph applies where a request for data concerning...

s.sch003 (1) Article 15(1) to (3) of the UK GDPR (confirmation...

s.sch003 (1) In this Part of this Schedule— “education data” has...

s.sch003 (1) This paragraph applies to personal data falling within any...

s.sch003 (1) The listed GDPR provisions do not apply to data...

s.sch004 In this Schedule “the listed GDPR provisions” means the following...

s.sch004 The listed GDPR provisions do not apply to personal data...

s.sch004 (1) The listed GDPR provisions do not apply to personal...

s.sch004 The listed GDPR provisions do not apply to personal data...

s.sch005 (1) This Schedule applies where— (a) a person (“the applicant”)...

s.sch005 (1) The applicant may ask the accreditation authority to review...

s.sch005 (1) If the applicant is dissatisfied with the decision on...

s.sch005 (1) If the applicant makes a request in accordance with...

s.sch005 (1) If the appeal panel considers it necessary, a hearing...

s.sch005 (1) The appeal panel must, before the end of the...

s.sch005 In this Schedule, “working day” means any day other than—...

s.sch006 In its application by virtue of section 22(1), the GDPR...

s.sch006 In Article 6 (lawfulness of processing)— (a) omit paragraph 2;...

s.sch006 In Article 8 (conditions applicable to child's consent in relation...

s.sch006 In Article 9 (processing of special categories of personal data)—...

s.sch006 In Article 10 (processing of personal data relating to criminal...

s.sch006 In Article 12 (transparent information etc for the exercise of...

s.sch006 In Article 13 (personal data collected from data subject: information...

s.sch006 In Article 14 (personal data collected other than from data...

s.sch006 In Article 17 (right to erasure (‘right to be forgotten’))—...

s.sch006 In Article 18 (right to restriction of processing), in paragraph...

s.sch006 In Article 21 (right to object), in paragraph 5, omit...

s.sch006 (1) References to “this Regulation” and to provisions of the...

s.sch006 In Article 22 (automated individual decision-making, including profiling), for paragraph...

s.sch006 In Article 23 (restrictions), in paragraph 1—

s.sch006 In Article 26 (joint controllers), in paragraph 1, for “Union...

s.sch006 Omit Article 27 (representatives of controllers or processors not established...

s.sch006 In Article 28 (processor)— (a) in paragraph 3, in point...

s.sch006 In Article 30 (records of processing activities)—

s.sch006 In Article 31 (co-operation with the supervisory authority), omit “and,...

s.sch006 In Article 35 (data protection impact assessment), omit paragraphs 4,...

s.sch006 In Article 36 (prior consultation)— (a) for paragraph 4 substitute—...

s.sch006 In Article 37 (designation of data protection officers), omit paragraph...

s.sch006 (1) References to “Union law”, “Member State law”, “the law...

s.sch006 In Article 39 (tasks of the data protection officer), in...

s.sch006 In Article 40 (codes of conduct)— (a) in paragraph 1,...

s.sch006 In Article 41 (monitoring of approved codes of conduct), omit...

s.sch006 In Article 42 (certification)— (a) in paragraph 1—

s.sch006 In Article 43 (certification bodies)— (a) in paragraph 1, in...

s.sch006 In Article 45 (transfers on the basis of an adequacy...

s.sch006 In Article 46 (transfers subject to appropriate safeguards)—

s.sch006 In Article 47 (binding corporate rules)— (a) in paragraph 1,...

s.sch006 In Article 49 (derogations for specific situations)—

s.sch006 In Article 50 (international co-operation for the protection of personal...

s.sch006 (1) References to “the Union”, “a Member State” and “Member...

s.sch006 In Article 51 (supervisory authority)— (a) in paragraph 1—

s.sch006 In Article 52 (independence)— (a) in paragraph 2—

s.sch006 Omit Article 53 (general conditions for the members of the...

s.sch006 Omit Article 54 (rules on the establishment of the supervisory...

s.sch006 In Article 55 (competence)— (a) in paragraph 1, omit “on...

s.sch006 Omit Article 56 (competence of the lead supervisory authority).

s.sch006 In Article 57 (tasks)— (a) in paragraph 1, in the...

s.sch006 In Article 58 (powers)— (a) in paragraph 1, in point...

s.sch006 In Article 59 (activity reports)— (a) for “, the government...

s.sch006 For Articles 60 to 76 substitute— Article 61 Co-operation with...

s.sch006 (1) References to a “supervisory authority”, a “competent supervisory authority”...

s.sch006 In Article 77 (right to lodge a complaint with a...

s.sch006 In Article 78 (right to an effective judicial remedy against...

s.sch006 In Article 79 (right to an effective judicial remedy against...

s.sch006 In Article 80 (representation of data subjects)—

s.sch006 Omit Article 81 (suspension of proceedings).

s.sch006 In Article 82 (right to compensation and liability), for paragraph...

s.sch006 In Article 83 (general conditions for imposing administrative fines)—

s.sch006 In Article 84 (penalties)— (a) for paragraph 1 substitute— The rules on other penalties applicable to infringements of this...

s.sch006 In Article 85 (processing and freedom of expression and information)—...

s.sch006 In Article 86 (processing and public access to official documents),...

s.sch006 References to “the national parliament” have effect as references to...

s.sch006 Omit Article 87 (processing of national identification number).

s.sch006 Omit Article 88 (processing in the context of employment).

s.sch006 In Article 89 (safeguards and derogations relating to processing for...

s.sch006 Omit Article 90 (obligations of secrecy).

s.sch006 Omit Article 91 (existing data protection rules of churches and...

s.sch006 Omit Article 92 (exercise of the delegation).

s.sch006 Omit Article 93 (committee procedure).

s.sch006 Omit Article 94 (repeal of Directive 95/46/EC).

s.sch006 Omit Article 95 (relationship with Directive 2002/58/EC).

s.sch006 In Article 96 (relationship with previously concluded Agreements), for “by...

s.sch006 For Article 2 (material scope) substitute— This Regulation applies to the processing of personal data to...

s.sch006 Omit Article 97 (Commission reports).

s.sch006 Omit Article 98 (Commission reviews).

s.sch006 Omit Article 99 (entry into force and application).

s.sch006 In its application by virtue of section 22(2), Chapter 2...

s.sch006 (1) References to Chapter 2 of Part 2 and the...

s.sch006 In section 16 (power to make further exemptions etc by...

s.sch006 For Article 3 substitute— Article 3 Territorial application Subsections (1),...

s.sch006 In Article 4 (definitions)— (a) in paragraph (7) (meaning of...

s.sch007 Any United Kingdom government department other than a non-ministerial government...

s.sch007 The chief constable of the British Transport Police.

s.sch007 The chief constable of the Civil Nuclear Constabulary.

s.sch007 The chief constable of the Ministry of Defence Police.

s.sch007 The Provost Marshal of the Royal Navy Police.

s.sch007 The Provost Marshal of the Royal Military Police.

s.sch007 The Provost Marshal of the Royal Air Force Police.

s.sch007 The Provost Marshal for serious crime.

s.sch007 The chief officer of— (a) a body of constables appointed...

s.sch007 A body established in accordance with a collaboration agreement under...

s.sch007 The Director General of the Independent Office for Police Conduct....

s.sch007 The Service Police Complaints Commissioner.

s.sch007 The Police Investigations and Review Commissioner.

s.sch007 The Scottish Ministers.

s.sch007 The Police Ombudsman for Northern Ireland.

s.sch007 The Commissioners for Her Majesty's Revenue and Customs.

s.sch007 The Welsh Revenue Authority.

s.sch007 Revenue Scotland.

s.sch007 The Director General of the National Crime Agency.

s.sch007 The Director of the Serious Fraud Office.

s.sch007 The Director of Border Revenue.

s.sch007 The Financial Conduct Authority.

s.sch007 The Health and Safety Executive.

s.sch007 The Competition and Markets Authority.

s.sch007 Any Northern Ireland department.

s.sch007 The Gas and Electricity Markets Authority.

s.sch007 The Food Standards Agency.

s.sch007 Food Standards Scotland.

s.sch007 Her Majesty's Land Registry.

s.sch007 The Criminal Cases Review Commission.

s.sch007 The Scottish Criminal Cases Review Commission.

s.sch007 A provider of probation services (other than the Secretary of...

s.sch007 The Youth Justice Board for England and Wales.

s.sch007 The Parole Board for England and Wales.

s.sch007 The Parole Board for Scotland.

s.sch007 The Welsh Ministers.

s.sch007 The Parole Commissioners for Northern Ireland.

s.sch007 The Probation Board for Northern Ireland.

s.sch007 The Prisoner Ombudsman for Northern Ireland.

s.sch007 A person who has entered into a contract for the...

s.sch007 A person who has entered into a contract with the...

s.sch007 A person who is, under or by virtue of any...

s.sch007 A youth offending team established under section 39 of the...

s.sch007 The Director of Public Prosecutions.

s.sch007 The Director of Public Prosecutions for Northern Ireland.

s.sch007 The Lord Advocate.

s.sch007 The chief constable of a police force maintained under section...

s.sch007 A Procurator Fiscal.

s.sch007 The Director of Service Prosecutions.

s.sch007 The Information Commissioner.

s.sch007 The Scottish Information Commissioner.

s.sch007 The Scottish Courts and Tribunal Service.

s.sch007 The Crown agent.

s.sch007 A court or tribunal.

s.sch007 The Border Security Commander.

s.sch007 The Commissioner of Police of the Metropolis.

s.sch007 The Commissioner of Police for the City of London.

s.sch007 The Chief Constable of the Police Service of Northern Ireland....

s.sch007 The chief constable of the Police Service of Scotland.

s.sch008 This condition is met if the processing—

s.sch008 This condition is met if the processing is necessary for...

s.sch008 This condition is met if the processing is necessary to...

s.sch008 (1) This condition is met if— (a) the processing is...

s.sch008 This condition is met if the processing relates to personal...

s.sch008 This condition is met if the processing—

s.sch008 This condition is met if the processing is necessary when...

s.sch008 (1) This condition is met if the processing—

s.sch008 This condition is met if the processing is necessary—

s.sch009 The data subject has given consent to the processing.

s.sch009 The processing is necessary— (a) for the performance of a...

s.sch009 The processing is necessary for compliance with a legal obligation...

s.sch009 The processing is necessary in order to protect the vital...

s.sch009 The processing is necessary— (a) for the administration of justice,...

s.sch009 (1) The processing is necessary for the purposes of legitimate...

s.sch010 The data subject has given consent to the processing.

s.sch010 The processing is necessary for the purposes of exercising or...

s.sch010 The processing is necessary— (a) in order to protect the...

s.sch010 (1) This condition is met if— (a) the processing is...

s.sch010 The information contained in the personal data has been made...

s.sch010 The processing— (a) is necessary for the purpose of, or...

s.sch010 The processing is necessary— (a) for the administration of justice,...

s.sch010 (1) The processing is necessary for medical purposes and is...

s.sch010 (1) The processing— (a) is of sensitive personal data consisting...

s.sch011 In this Schedule, “the listed provisions” means—

s.sch011 The listed provisions do not apply to personal data that...

s.sch011 The listed provisions do not apply to personal data consisting...

s.sch011 (1) The listed provisions do not apply to personal data...

s.sch011 The listed provisions do not apply to personal data processed...

s.sch011 (1) The listed provisions do not apply to personal data...

s.sch011 The listed provisions do not apply to personal data where...

s.sch011 The listed provisions do not apply to personal data to...

s.sch011 The listed provisions do not apply to personal data processed...

s.sch011 The listed provisions do not apply to personal data to...

s.sch011 The listed provisions do not apply to personal data that...

s.sch012 (1) The Commissioner is to continue to be a corporation...

s.sch012 (1) All fees, charges, penalties and other sums received by...

s.sch012 (1) The Commissioner must— (a) keep proper accounts and other...

s.sch012 Paragraphs 1(1), 7 and 8 do not extend to Scotland....

s.sch012 (1) The Commissioner is to be appointed by Her Majesty...

s.sch012 (1) The Commissioner may be relieved of office by Her...

s.sch012 (1) The Commissioner is to be paid such salary as...

s.sch012 (1) The Commissioner— (a) must appoint one or more deputy...

s.sch012 (1) The functions of the Commissioner are to be carried...

s.sch012 The application of the seal of the Commissioner is to...

s.sch012 A document purporting to be an instrument issued by the...

s.sch012 The Secretary of State may make payments to the Commissioner...

s.sch012a The Information Commission

s.sch012a Status

s.sch012a Remuneration and pensions of non-executive members

s.sch012a Executive members: terms and conditions

s.sch012a Other staff: appointment, terms and conditions

s.sch012a Committees

s.sch012a Delegation of functions

s.sch012a Advice from committees

s.sch012a Proceedings

s.sch012a Records of proceedings

s.sch012a Disqualification for acting in relation to certain matters

s.sch012a Validity of proceedings

s.sch012a Number of members

s.sch012a Money

s.sch012a Fees etc and other sums

s.sch012a Accounts

s.sch012a Authentication of seal and presumption of authenticity of documents

s.sch012a Supplementary powers

s.sch012a Transitional provision: interim chief executive

s.sch012a Interpretation

s.sch012a Membership: general

s.sch012a Membership: non-executive members to outnumber executive members

s.sch012a Membership: selection on merit etc

s.sch012a Membership: conflicts of interests

s.sch012a Tenure of the chair

s.sch012a Tenure of deputy chair

s.sch012a Tenure of the other non-executive members

s.sch013 (1) The Commissioner must— (a) monitor and enforce Parts 3...

s.sch013 The Commissioner has the following investigative, corrective, authorisation and advisory...

s.sch013 In this Schedule— “foreign designated authority” means an authority designated...

s.sch014 In this Part of this Schedule, “foreign designated authority” means...

s.sch014 (1) The Commissioner must, at the request of a foreign...

s.sch014 (1) This paragraph applies where a request for assistance in...

s.sch014 Where the Commissioner receives information from a foreign designated authority...

s.sch015 (1) This paragraph applies if a judge of the High...

s.sch015 (1) This paragraph applies where a person executing a warrant...

s.sch015 (1) The powers of inspection and seizure conferred by a...

s.sch015 The powers of inspection and seizure conferred by a warrant...

s.sch015 (1) This paragraph applies if a person in occupation of...

s.sch015 (1) Where a warrant issued under this Schedule is executed—...

s.sch015 (1) It is an offence for a person—

s.sch015 (1) An explanation given, or information provided, by a person...

s.sch015 In this Schedule— (a) “premises” includes a vehicle, vessel or...

s.sch015 In the application of this Schedule to Scotland—

s.sch015 In the application of this Schedule to Northern Ireland—

s.sch015 (1) This paragraph applies if a judge of the High...

s.sch015 A judge must not issue a warrant under this Schedule...

s.sch015 (1) A judge must not issue a warrant under this...

s.sch015 (1) A warrant issued under this Schedule must authorise the...

s.sch015 A judge who issues a warrant under this Schedule must—...

s.sch015 A person executing a warrant issued under this Schedule may...

s.sch015 A warrant issued under this Schedule may be executed only...

s.sch015 (1) If an occupier of the premises in respect of...

s.sch016 In this Schedule, “penalty” means a penalty imposed by a...

s.sch016 (1) Before giving a person a penalty notice, the Commissioner...

s.sch016 (1) A notice of intent must contain the following information—...

s.sch016 (A1) This paragraph applies where the Commissioner gives a notice...

s.sch016 (1) A penalty notice must contain the following information—

s.sch016 (1) A penalty must be paid to the Commissioner within...

s.sch016 (1) The Commissioner may vary a penalty notice by giving...

s.sch016 (1) The Commissioner may cancel a penalty notice by giving...

s.sch016 (1) The Commissioner must not take action to recover a...

s.sch017 In this Schedule— “relevant period” means— the period of 18...

s.sch017 (1) This paragraph applies where the Commissioner gives an information...

s.sch017 (1) Sub-paragraph (2) applies where the Commissioner gives an assessment...

s.sch017 (1) Sub-paragraph (2) applies where the Commissioner gives an interview...

s.sch017 Section 164 applies where an information notice , assessment notice...

s.sch018 (1) In section 184, “relevant record” means—

s.sch018 “Relevant health record” means a health record which has been...

s.sch018 (1) “Relevant record relating to a conviction or caution” means...

s.sch018 (1) “Relevant record relating to statutory functions” means a record...

s.sch018 In this Schedule, “data subject access right” means a right...

s.sch018 For the purposes of this Schedule, a record which states...

s.sch018 (1) The Secretary of State may by regulations amend this...

s.sch019 (1) Section 19AC of the Registration Service Act 1953 (codes...

s.sch019 In section 189(1) (definitions), at the appropriate place insert— “the...

s.sch019 The Companies (Audit, Investigations and Community Enterprise) Act 2004 is...

s.sch019 (1) Section 15A (disclosure of information by tax authorities) is...

s.sch019 (1) Section 15D (permitted disclosure of information obtained under compulsory...

s.sch019 (1) Section 54 of the Domestic Violence, Crime and Victims...

s.sch019 The Children Act 2004 is amended as follows.

s.sch019 (1) Section 12 (information databases) is amended as follows.

s.sch019 (1) Section 29 (information databases: Wales) is amended as follows....

s.sch019 (1) Section 107 of the Constitutional Reform Act 2005 (disclosure...

s.sch019 In section 64 of the Mental Capacity Act 2005 (interpretation),...

s.sch019 (1) Section 34X of the Public Services Ombudsman (Wales) Act...

s.sch019 The Pharmacy (Northern Ireland) Order 1976 is amended as follows....

s.sch019 (1) Section 22 of the Commissioners for Revenue and Customs...

s.sch019 (1) Section 352 of the Gambling Act 2005 (data protection)...

s.sch019 (1) Section 18 of the Commissioner for Older People (Wales)...

s.sch019 The National Health Service Act 2006 is amended as follows....

s.sch019 (1) Section 251 (control of patient information) is amended as...

s.sch019 (1) Section 264C (provision and disclosure of information about health...

s.sch019 In paragraph 7B(3) of Schedule 1 (further provision about the...

s.sch019 The National Health Service (Wales) Act 2006 is amended as...

s.sch019 (1) Section 201C (provision of information about medical supplies: supplementary)...

s.sch019 In paragraph 7B(3) of Schedule 1 (further provision about the...

s.sch019 In article 2(2) (interpretation), omit the definition of “Directive 95/46/EC”....

s.sch019 The Companies Act 2006 is amended as follows.

s.sch019 In section 458(2) (disclosure of information by tax authorities)—

s.sch019 In section 461(7) (permitted disclosure of information obtained under compulsory...

s.sch019 In section 948(9) (restrictions on disclosure) for “the Data Protection...

s.sch019 In section 1173(1) (minor definitions: general), at the appropriate place...

s.sch019 In section 1224A(7) (restrictions on disclosure), for “the Data Protection...

s.sch019 In section 1253D(3) (restriction on transfer of audit working papers...

s.sch019 In section 1261(1) (minor definitions: Part 42), at the appropriate...

s.sch019 In section 1262 (index of defined expressions: Part 42), at...

s.sch019 In Schedule 8 (index of defined expressions: general), at the...

s.sch019 In article 8D (European professional card), after paragraph (3) insert—...

s.sch019 The Tribunals, Courts and Enforcement Act 2007 is amended as...

s.sch019 In section 11(5)(b) (right to appeal to Upper Tribunal), for...

s.sch019 In section 13(8)(a) (right to appeal to the Court of...

s.sch019 The Statistics and Registration Service Act 2007 is amended as...

s.sch019 (1) Section 45 (information held by HMRC) is amended as...

s.sch019 (1) Section 45A (information held by other public authorities) is...

s.sch019 (1) Section 45B(3) (access to information held by Crown bodies...

s.sch019 (1) Section 45C(13) (power to require disclosures by other public...

s.sch019 In section 45D(9)(b) (power to require disclosure by undertakings), for...

s.sch019 (1) Section 45E (further provision about powers in sections 45B,...

s.sch019 In article 22A(6) (Directive 2005/36/EC: functions of competent authority etc.),...

s.sch019 (1) Section 53A (disclosure by the Statistics Board to devolved...

s.sch019 (1) Section 54 (Data Protection Act 1998 and Human Rights...

s.sch019 In section 67 (general interpretation: Part 1), at the appropriate...

s.sch019 The Serious Crime Act 2007 is amended as follows.

s.sch019 (1) Section 5A (verification and disclosure of information) is amended...

s.sch019 (1) Section 68 (disclosure of information to prevent fraud) is...

s.sch019 (1) Section 85 (disclosure of information by Revenue and Customs)...

s.sch019 (1) Section 169 of the Legal Services Act 2007 (disclosure...

s.sch019 In section 74 of the Adoption and Children (Scotland) Act...

s.sch019 The Criminal Justice and Immigration Act 2008 is amended as...

s.sch019 (1) Schedule 2C (Directive 2005/36/EC: European professional card) is amended...

s.sch019 Omit— (a) section 77 (power to alter penalty for unlawfully...

s.sch019 (1) Section 114 (supply of information to Secretary of State...

s.sch019 (1) Section 70 of the Regulatory Enforcement and Sanctions Act...

s.sch019 In section 20A(5) of the Health and Social Care Act...

s.sch019 (1) Section 20 of the Counter-Terrorism Act 2008 (disclosure and...

s.sch019 (1) Section 117 of the Public Health etc. (Scotland) Act...

s.sch019 (1) Section 83ZY of the Banking Act 2009 (special resolution...

s.sch019 (1) Section 19 of the Borders, Citizenship and Immigration Act...

s.sch019 The Marine and Coastal Access Act 2009 is amended as...

s.sch019 (1) Paragraph 13 of Schedule 7 (further provision about civil...

s.sch019 (1) The table in Schedule 2D (functions of the Society...

s.sch019 (1) Paragraph 9 of Schedule 10 (further provision about fixed...

s.sch019 In Schedule 21 to the Coroners and Justice Act 2009...

s.sch019 (1) Section 38 of the Broads Authority Act 2009 (provision...

s.sch019 (1) Section 13 of the Health and Social Care (Reform)...

s.sch019 (1) Section 25 of the Terrorist Asset-Freezing etc. Act 2010...

s.sch019 (1) Paragraph 12 of Schedule 2 to the Marine (Scotland)...

s.sch019 (1) Section 59 of the Charities Act 2011 (disclosure: supplementary)...

s.sch019 The Welsh Language (Wales) Measure 2011 is amended as follows....

s.sch019 (1) Section 22 (power to disclose information) is amended as...

s.sch019 (1) Paragraph 8 of Schedule 2 (inquiries by the Commissioner:...

s.sch019 (1) Paragraph 2 of Schedule 3 (fitness to practice: disclosure...

s.sch019 (1) Section 10 of the Safeguarding Board Act (Northern Ireland)...

s.sch019 The Health and Social Care Act 2012 is amended as...

s.sch019 In section 250(7) (power to publish information standards), for the...

s.sch019 (1) Section 251A (consistent identifiers) is amended as follows.

s.sch019 (1) Section 251B (duty to share information) is amended as...

s.sch019 The Protection of Freedoms Act 2012 is amended as follows....

s.sch019 (1) Section 27 (exceptions and further provision about consent and...

s.sch019 In section 28(1) (interpretation: Chapter 2), for the definition of...

s.sch019 In section 29(7) (code of practice for surveillance camera systems),...

s.sch019 (1) Section 14A of the HGV Road User Levy Act...

s.sch019 (1) Schedule 2 to the Representation of the People Act...

s.sch019 The Crime and Courts Act 2013 is amended as follows....

s.sch019 (1) Section 42 (other interpretive provisions) is amended as follows....

s.sch019 (1) Paragraph 1 of Schedule 7 (statutory restrictions on disclosure)...

s.sch019 (1) Paragraph 8 of Schedule 2 to the Marine Act...

s.sch019 (1) Paragraph 3 of Schedule 9 to the Local Audit...

s.sch019 (1) Paragraph 7 of Schedule 4 to the Anti-social Behaviour,...

s.sch019 (1) Paragraph 6 of Schedule 6 to the Immigration Act...

s.sch019 In section 67(9) of the Care Act 2014 (involvement in...

s.sch019 In section 18(10)(b) of the Social Services and Well-being (Wales)...

s.sch019 (1) Section 38 of the Counter-Terrorism and Security Act 2015...

s.sch019 The Medical Act 1983 is amended as follows.

s.sch019 (1) Section 6 of the Small Business, Enterprise and Employment...

s.sch019 (1) Section 54A of the Modern Slavery Act 2015 (Gangmasters...

s.sch019 The Human Trafficking and Exploitation (Criminal Justice and Support for...

s.sch019 In section 13(5) (duty to notify National Crime Agency about...

s.sch019 In section 25(1) (interpretation of this Act), at the appropriate...

s.sch019 In paragraph 18(5) of Schedule 3 (supply of information to...

s.sch019 (1) Section 72 of the Justice Act (Northern Ireland) 2015...

s.sch019 (1) Section 7 of the Immigration Act 2016 (information gateways:...

s.sch019 The Investigatory Powers Act 2016 is amended as follows.

s.sch019 In section 1(5)(b), for sub-paragraph (ii) substitute—

s.sch019 (1) Section 1A of the Veterinary Surgeons Act 1966 (functions...

s.sch019 (1) Section 29E (evidence) is amended as follows.

s.sch019 In section 199 (bulk personal datasets: interpretation), for subsection (2)...

s.sch019 In section 202(4) (restriction on use of class BPD warrants),...

s.sch019 In section 206 (additional safeguards for health records), for subsection...

s.sch019 (1) Section 237 (information gateway) is amended as follows.

s.sch019 (1) Section 49 of the Police Services Ombudsman Act (Northern...

s.sch019 (1) Section 1 of the Health and Social Care (Control...

s.sch019 In section 306(1) of the Mental Capacity Act (Northern Ireland)...

s.sch019 The Justice Act (Northern Ireland) 2016 is amended as follows....

s.sch019 (1) Section 17 (disclosure of information) is amended as follows....

s.sch019 In section 44(3) (disclosure of information)— (a) in paragraph (a),...

s.sch019 (1) Section 35A (General Medical Council's power to require disclosure...

s.sch019 (1) Section 50 of the Policing and Crime Act 2017...

s.sch019 In Schedule 5 to the Children and Social Work Act...

s.sch019 The Higher Education and Research Act 2017 is amended as...

s.sch019 (1) Section 63 (cooperation and information sharing by the Office...

s.sch019 (1) Section 112 (cooperation and information sharing between the Office...

s.sch019 The Digital Economy Act 2017 is amended as follows.

s.sch019 (1) Section 40 (further provisions about disclosures under sections 35...

s.sch019 (1) Section 43 (codes of practice) is amended as follows....

s.sch019 (1) Section 49 (further provision about disclosures under section 48)...

s.sch019 (1) Section 52 (code of practice) is amended as follows....

s.sch019 In section 49B(7) (Directive 2005/36: designation of competent authority etc.),...

s.sch019 (1) Section 57 (further provision about disclosures under section 56)...

s.sch019 (1) Section 60 (code of practice) is amended as follows....

s.sch019 (1) Section 65 (supplementary provision about disclosures under section 64)...

s.sch019 (1) Section 70 (code of practice) is amended as follows....

s.sch019 Omit sections 108 to 110 (charges payable to the Information...

s.sch019 (1) Section 60 of the Landfill Disposals Tax (Wales) Act...

s.sch019 (1) Section 4 of the Additional Learning Needs and Educational...

s.sch019 (1) Section 204 of this Act (meaning of “health professional”...

s.sch019 In the table in the Schedule to the Estate Agents...

s.sch019 (1) Article 4 of the Channel Tunnel (International Arrangements) Order...

s.sch019 In section 55(1) (interpretation), omit the definition of “Directive 95/46/EC”....

s.sch019 The Access to Health Records (Northern Ireland) Order 1993 is...

s.sch019 In Article 4 (health professionals), for paragraph (1) substitute—

s.sch019 In Article 5(4)(a) (fees for access to health records), for...

s.sch019 In article 4 of the Channel Tunnel (Miscellaneous Provisions) Order...

s.sch019 The European Primary and Specialist Dental Qualifications Regulations 1998 are...

s.sch019 (1) Regulation 2(1) (interpretation) is amended as follows.

s.sch019 (1) The table in Schedule A1 (functions of the GDC...

s.sch019 For article 7 of the Scottish Parliamentary Corporate Body (Crown...

s.sch019 For article 9 of the Northern Ireland Assembly Commission (Crown...

s.sch019 The Data Protection (Corporate Finance Exemption) Order 2000 is revoked....

s.sch019 (1) Paragraph 9B of Schedule 1 (incidental powers of the...

s.sch019 The Data Protection (Conditions under Paragraph 3 of Part II...

s.sch019 The Data Protection (Functions of Designated Authority) Order 2000 is...

s.sch019 The Data Protection (International Co-operation) Order 2000 is revoked.

s.sch019 The Data Protection (Subject Access) (Fees and Miscellaneous Provisions) Regulations...

s.sch019 In the Consumer Credit (Credit Reference Agency) Regulations 2000, regulation...

s.sch019 The Data Protection (Subject Access Modification) (Health) Order 2000 is...

s.sch019 The Data Protection (Subject Access Modification) (Education) Order 2000 is...

s.sch019 The Data Protection (Subject Access Modification) (Social Work) Order 2000...

s.sch019 The Data Protection (Crown Appointments) Order 2000 is revoked.

s.sch019 The Data Protection (Processing of Sensitive Personal Data) Order 2000...

s.sch019 (1) Paragraph 5A of Schedule 4 (professional performance assessments and...

s.sch019 The Data Protection (Miscellaneous Subject Access Exemptions) Order 2000 is...

s.sch019 The Data Protection (Designated Codes of Practice) (No. 2) Order...

s.sch019 The Representation of the People (England and Wales) Regulations 2001...

s.sch019 In regulation 3(1) (interpretation), at the appropriate places insert— “Article...

s.sch019 In regulation 26(3)(a) (applications for registration), for “the Data Protection...

s.sch019 In regulation 26A(2)(a) (application for alteration of register in respect...

s.sch019 In regulation 32ZA(3)(f) (annual canvass), for “the Data Protection Act...

s.sch019 In regulation 61A (conditions on the use, supply and inspection...

s.sch019 (1) Regulation 92(2) (interpretation and application of Part VI etc)...

s.sch019 In regulation 96(2A)(b)(i) (restriction on use of the full register),...

s.sch019 (1) The table in Schedule 4A (functions of the General...

s.sch019 In regulation 97(5) and (6) (supply of free copy of...

s.sch019 In regulation 97A(7) and (8) (supply of free copy of...

s.sch019 In regulation 99(6) and (7) (supply of free copy of...

s.sch019 In regulation 109A(9) and (10) (supply of free copy of...

s.sch019 In regulation 119(2) (conditions on the use, supply and disclosure...

s.sch019 The Representation of the People (Scotland) Regulations 2001 are amended...

s.sch019 In regulation 3(1) (interpretation), at the appropriate places, insert— “Article...

s.sch019 In regulation 26(3)(a) (applications for registration), for “the Data Protection...

s.sch019 In regulation 26A(2)(a) (application for alteration of register in respect...

s.sch019 In regulation 32ZA(3)(f) (annual canvass), for “the Data Protection Act...

s.sch019 The Dentists Act 1984 is amended as follows.

s.sch019 In regulation 61(3) (records and lists kept under Schedule 4),...

s.sch019 In regulation 61A (conditions on the use, supply and inspection...

s.sch019 (1) Regulation 92(2) (interpretation of Part VI etc) is amended...

s.sch019 In regulation 95(3)(b)(i) (restriction on use of the full register),...

s.sch019 In regulation 96(5) and (6) (supply of free copy of...

s.sch019 In regulation 98(6) and (7) (supply of free copy of...

s.sch019 In regulation 108A(9) and (10) (supply of full register to...

s.sch019 In regulation 119(2) (conditions on the use, supply and disclosure...

s.sch019 (1) Article 9 of the Financial Services and Markets 2000...

s.sch019 The Nursing and Midwifery Order 2001 is amended as follows....

s.sch019 (1) Section 33B (the General Dental Council's power to require...

s.sch019 (1) Article 3 (the Nursing and Midwifery Council and its...

s.sch019 (1) Article 25 (the Council's power to require disclosure of...

s.sch019 In article 39B (European professional card), after paragraph (2) insert—...

s.sch019 In article 40(6) (Directive 2005/36/EC: designation of competent authority etc),...

s.sch019 (1) Schedule 2B (Directive 2005/36/EC: European professional card) is amended...

s.sch019 (1) The table in Schedule 3 (functions of the Council...

s.sch019 In Schedule 4 (interpretation), omit the definition of “Directive 95/46/EC”....

s.sch019 Regulation 3 of the Electronic Commerce (EC Directive) Regulations 2002...

s.sch019 In paragraph (1)(b) for “the Data Protection Directive and the...

s.sch019 In paragraph (3)— (a) omit the definitions of “Data Protection...

s.sch019 In section 36ZA(6) (Directive 2005/36: designation of competent authority etc),...

s.sch019 The Data Protection (Processing of Sensitive Personal Data) (Elected Representatives)...

s.sch019 The Privacy and Electronic Communications (EC Directive) Regulations 2003 are...

s.sch019 In regulation 2(1) (interpretation), in the definition of “the Information...

s.sch019 (1) Regulation 4 (relationship between these Regulations and the Data...

s.sch019 The Nationality, Immigration and Asylum Act 2002 (Juxtaposed Controls) Order...

s.sch019 In article 8(2) (exercise of powers by French officers in...

s.sch019 In article 11(4) (exercise of powers by UK immigration officers...

s.sch019 The Pupils' Educational Records (Scotland) Regulations 2003 are amended as...

s.sch019 (1) Regulation 2 (interpretation) is amended as follows.

s.sch019 (1) Regulation 6 (circumstances where information should not be disclosed)...

s.sch019 In section 11AA(1) of the Parliamentary Commissioner Act 1967 (disclosure...

s.sch019 (1) Section 36Y (the General Dental Council's power to require...

s.sch019 In regulation 9 (fees), for paragraph (1) substitute—

s.sch019 Schedule 1 to the European Parliamentary Elections (Northern Ireland) Regulations...

s.sch019 (1) Paragraph 74(1) (interpretation) is amended as follows.

s.sch019 In paragraph 77(2)(b) (conditions on the use, supply and disclosure...

s.sch019 In regulation 3(1) of the Freedom of Information and Data...

s.sch019 The Environmental Information Regulations 2004 are amended as follows.

s.sch019 (1) Regulation 2 (interpretation) is amended as follows.

s.sch019 (1) Regulation 13 (personal data) is amended as follows.

s.sch019 In regulation 14 (refusal to disclose information), in paragraph (3)(b),...

s.sch019 In regulation 18 (enforcement and appeal provisions), in paragraph (5),...

s.sch019 In section 53(1) (interpretation), omit the definition of “Directive 95/46/EC”....

s.sch019 The Environmental Information (Scotland) Regulations 2004 are amended as follows....

s.sch019 (1) Regulation 2 (interpretation) is amended as follows.

s.sch019 (1) Regulation 11 (personal data) is amended as follows.

s.sch019 (1) Regulation 7 of the Licensing Act 2003 (Personal Licences)...

s.sch019 The Education (Pupil Information) (England) Regulations 2005 are amended as...

s.sch019 In regulation 3(5) (meaning of educational record) for “section 1(1)...

s.sch019 (1) Regulation 5 (disclosure of curricular and educational records) is...

s.sch019 (1) Regulation 45 of the Civil Contingencies Act 2004 (Contingency...

s.sch019 In regulation 3 of the Register of Judgments, Orders and...

s.sch019 The Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005...

s.sch019 (1) The table in Schedule 4ZA (Directive 2005/36: functions of...

s.sch019 (1) Regulation 39 (sensitive information) is amended as follows.

s.sch019 The Data Protection (Processing of Sensitive Personal Data) Order 2006...

s.sch019 (1) Paragraph 14 of Schedule 1 to the National Assembly...

s.sch019 In regulation 3 of the Mental Capacity Act 2005 (Loss...

s.sch019 For article 5 of the National Assembly for Wales Commission...

s.sch019 In regulation 3 of the Mental Capacity Act 2005 (Loss...

s.sch019 (1) Regulation 18 of the Representation of the People (Absent...

s.sch019 In regulation 5 of the Representation of the People (Post-Local...

s.sch019 The Education (Pupil Records and Reporting) (Transitional) Regulations (Northern Ireland)...

s.sch019 In regulation 2 (interpretation), at the appropriate place insert— “the...

s.sch019 In section 449(11) of the Companies Act 1985 (provision for...

s.sch019 In regulation 10(2) (duties of Boards of Governors), for “documents...

s.sch019 In regulation 118 of the Representation of the People (Northern...

s.sch019 In paragraph 1(c) of the Schedule to the Companies Act...

s.sch019 The Controlled Drugs (Supervision of Management and Use) (Wales) Regulations...

s.sch019 In regulation 2(1) (interpretation)— (a) at the appropriate place in...

s.sch019 (1) Regulation 25 (duty to co-operate by disclosing information as...

s.sch019 (1) Regulation 26 (responsible bodies requesting additional information be disclosed...

s.sch019 (1) Regulation 29 (occurrence reports) is amended as follows.

s.sch019 (1) Regulation 5 of the Energy Order 2003 (Supply of...

s.sch019 (1) Paragraph 6 of Schedule 2 to the Companies (Disclosure...

s.sch019 In section 2(1) of the Access to Medical Reports Act...

s.sch019 (1) Paragraph 6 of Schedule 2 to the Overseas Companies...

s.sch019 The Data Protection (Processing of Sensitive Personal Data) Order 2009...

s.sch019 In regulation 25 of the Provision of Services Regulations 2009...

s.sch019 (1) Regulation 9 of the INSPIRE Regulations 2009 (public access...

s.sch019 (1) Regulation 10 of the INSPIRE (Scotland) Regulations 2009 (public...

s.sch019 The Controlled Drugs (Supervision of Management and Use) Regulations (Northern...

s.sch019 In regulation 2(2) (interpretation), at the appropriate place insert— “the...

s.sch019 (1) Regulation 25 (duty to co-operate by disclosing information as...

s.sch019 (1) Regulation 26 (responsible bodies requesting additional information be disclosed...

s.sch019 (1) Regulation 29 (occurrence reports) is amended as follows.

s.sch019 (1) Section 13B of the Opticians Act 1989 (the Council's...

s.sch019 The Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations...

s.sch019 The Pharmacy Order 2010 is amended as follows.

s.sch019 In article 3(1) (interpretation), omit the definition of “Directive 95/46/EC”....

s.sch019 (1) Article 9 (inspection and enforcement) is amended as follows....

s.sch019 In article 33A (European professional card), after paragraph (2) insert—...

s.sch019 (1) Article 49 (disclosure of information: general) is amended as...

s.sch019 (1) Article 55 (professional performance assessments) is amended as follows....

s.sch019 In article 67(6) (Directive 2005/36/EC: designation of competent authority etc.),...

s.sch019 (1) Schedule 2A (Directive 2005/36/EC: European professional card) is amended...

s.sch019 (1) The table in Schedule 3 (Directive 2005/36/EC: designation of...

s.sch019 The Access to Health Records Act 1990 is amended as...

s.sch019 The Data Protection (Monetary Penalties) Order 2010 is revoked.

s.sch019 The National Employment Savings Trust Order 2010 is amended as...

s.sch019 In article 2 (interpretation)— (a) omit the definition of “data”...

s.sch019 (1) Article 10 (disclosure of requested data to the Secretary...

s.sch019 (1) Schedule 3 to the Local Elections (Northern Ireland) Order...

s.sch019 (1) Regulation 5 of the Pupil Information (Wales) Regulations 2011...

s.sch019 In Schedule 4 to the Debt Arrangement Scheme (Scotland) Regulations...

s.sch019 The Police and Crime Commissioner Elections Order 2012 is amended...

s.sch019 (1) Schedule 2 (absent voting in Police and Crime Commissioner...

s.sch019 (1) Schedule 10 (access to marked registers and other documents...

s.sch019 For section 2 substitute— Health professionals In this Act, “health professional” has the same meaning as...

s.sch019 The Data Protection (Processing of Sensitive Personal Data) Order 2012...

s.sch019 Schedule 6 to the Neighbourhood Planning (Referendums) Regulations 2012 (registering...

s.sch019 (1) Paragraph 29(1) (interpretation of Part 8) is amended as...

s.sch019 In paragraph 32(3)(b)(i), for “section 11(3) of the Data Protection...

s.sch019 In paragraph 33(6) and (7) (supply of copy of business...

s.sch019 In paragraph 34(6) and (7) (supply of copy of business...

s.sch019 In paragraph 39(8) and (97) (supply of copy of business...

s.sch019 In paragraph 45(2) (conditions on the use, supply and disclosure...

s.sch019 (1) Regulation 20 of the Controlled Drugs (Supervision of Management...

s.sch019 (1) Article 3 of the Communications Act 2003 (Disclosure of...

s.sch019 (1) Section 3 (right of access to health records) is...

s.sch019 In the Criminal Justice and Data Protection (Protocol No. 36)...

s.sch019 The Data Protection (Assessment Notices) (Designation of National Health Service...

s.sch019 In regulation 6 of the Control of Explosives Precursors etc...

s.sch019 In regulation 3 of the Control of Poisons and Explosives...

s.sch019 (1) Paragraph 6 of Schedule 2 to the Companies (Disclosure...

s.sch019 The Small and Medium Sized Business (Credit Information) Regulations 2015...

s.sch019 (1) Regulation 12 (criteria for the designation of a credit...

s.sch019 (1) Regulation 15 (access to and correction of information for...

s.sch019 The European Union (Recognition of Professional Qualifications) Regulations 2015 are...

s.sch019 (1) Regulation 2(1) (interpretation) is amended as follows.

s.sch019 (1) Section 33D of the Human Fertilisation and Embryology Act...

s.sch019 In regulation 5(5) (functions of competent authorities in the United...

s.sch019 In regulation 45(3) (processing and access to data regarding the...

s.sch019 In regulation 46(1) (processing and access to data regarding the...

s.sch019 In regulation 48(2) (processing and access to data regarding the...

s.sch019 In regulation 66(3) (exchange of information), for “Directives 95/46/EC” substitute...

s.sch019 The Scottish Parliament (Elections etc) Order 2015 is amended as...

s.sch019 (1) Schedule 3 (absent voting) is amended as follows.

s.sch019 (1) Schedule 8 (access to marked registers and other documents...

s.sch019 In paragraph 1(3) of Schedule 3 to the Recall of...

s.sch019 Schedule 4 to the Register of People with Significant Control...

s.sch019 The Local Government Act 1974 is amended as follows.

s.sch019 (1) Section 251B of the Trade Union and Labour Relations...

s.sch019 (1) Paragraph 6 (disclosure to a credit reference agency) is...

s.sch019 In paragraph 12A (disclosure to a credit institution or a...

s.sch019 In Part 3 (interpretation), after paragraph 13 insert— In this Schedule, “data protection obligations”, in relation to a...

s.sch019 The Electronic Identification and Trust Services for Electronic Transactions Regulations...

s.sch019 In regulation 2(1) (interpretation), omit the definition of “the 1998...

s.sch019 In regulation 3(3) (supervision), omit “under the 1998 Act”.

s.sch019 For Schedule 2 substitute— SCHEDULE 2 Information Commissioner's enforcement powers...

s.sch019 The Court Files Privileged Access Rules (Northern Ireland) 2016 are...

s.sch019 In rule 5 (information that may released) for “Schedule 1...

s.sch019 In rule 7(2) (provision of information) for “Schedule 1 of...

s.sch019 In the table in Part 1 of Schedule 1 to...

s.sch019 The Money Laundering, Terrorist Financing and Transfer of Funds (Information...

s.sch019 In regulation 3(1) (interpretation), at the appropriate places insert— “the...

s.sch019 In regulation 16(8) (risk assessment by the Treasury and Home...

s.sch019 In regulation 17(9) (risk assessment by supervisory authorities), for “the...

s.sch019 For regulation 40(9)(c) (record keeping) substitute— (c) “data subject” has...

s.sch019 (1) Regulation 41 (data protection) is amended as follows.

s.sch019 (1) Regulation 84 (publication: the Financial Conduct Authority) is amended...

s.sch019 (1) Regulation 85 (publication: the Commissioners) is amended as follows....

s.sch019 For regulation 106(a) (general restrictions) substitute— (a) a disclosure in...

s.sch019 After paragraph 27 of Schedule 3 (relevant offences) insert— An offence under the Data Protection Act 2018, apart from...

s.sch019 (1) Article 90B of the Industrial Relations (Northern Ireland) Order...

s.sch019 (1) Paragraph 6 of Schedule 5 to the Scottish Partnerships...

s.sch019 In regulation 1(2) of the Data Protection (Charges and Information)...

s.sch019 The National Health Service (General Medical Services Contracts) (Scotland) Regulations...

s.sch019 (1) Regulation 1 (citation and commencement) is amended as follows....

s.sch019 In regulation 3(1) (interpretation)— (a) omit the definition of “the...

s.sch019 (1) Schedule 6 (other contractual terms) is amended as follows....

s.sch019 The National Health Service (Primary Medical Services Section 17C Agreements)...

s.sch019 (1) Regulation 1 (citation and commencement) is amended as follows....

s.sch019 In regulation 3(1) (interpretation)— (a) omit the definition of “the...

s.sch019 (1) Schedule 1 (content of agreements) is amended as follows....

s.sch019 In section 18A(1) of the Health Service Commissioners Act 1993...

s.sch019 (1) Unless the context otherwise requires, legislation described in sub-paragraph...

s.sch019 (1) References to a particular provision of, or made under,...

s.sch019 (1) References to personal data, and to the processing of...

s.sch019 Section 3(14) does not apply to this Schedule.

s.sch019 Provision inserted into subordinate legislation by this Schedule may be...

s.sch019 The Data Protection Act 1998 is repealed, with the exception...

s.sch019 In section 17A(4) of the Crime and Disorder Act 1998...

s.sch019 (1) Section 19 of the Food Standards Act 1999 (publication...

s.sch019 (1) Section 13 of the Immigration and Asylum Act 1999...

s.sch019 The Financial Services and Markets Act 2000 is amended as...

s.sch019 In section 86(9) (exempt offers to the public), for “the...

s.sch019 In section 33A(1) (disclosure of information by Local Commissioner to...

s.sch019 In section 391A(6)(b) (publication: special provisions relating to the capital...

s.sch019 In section 391C(7)(a) (publication: special provisions relating to the UCITS...

s.sch019 In section 391D(9)(a) (publication: special provisions relating to the markets...

s.sch019 In section 417 (definitions), at the appropriate place insert— “the...

s.sch019 In section 21F(2)(d) of the Terrorism Act 2000 (other permitted...

s.sch019 The Freedom of Information Act 2000 is amended as follows....

s.sch019 In section 2(3) (absolute exemptions), for paragraph (f) substitute—

s.sch019 In section 18 (the Information Commissioner), omit subsection (1).

s.sch019 (1) Section 40 (personal information) is amended as follows.

s.sch019 Omit section 49 (reports to be laid before Parliament).

s.sch019 In section 34O(1) (disclosure of information by Local Commissioner to...

s.sch019 For section 61 (appeal proceedings) substitute— Appeal proceedings (1) Tribunal Procedure Rules may make provision for regulating the...

s.sch019 In section 76(1) (disclosure of information between Commissioner and ombudsmen),...

s.sch019 After section 76A insert— Disclosure of information to Tribunal (1) No enactment or rule of law prohibiting or restricting...

s.sch019 In section 77(1)(b) (offence of altering etc records with intent...

s.sch019 In section 84 (interpretation), at the appropriate place insert— “the...

s.sch019 (1) Paragraph 28 of Schedule 19C to the Political Parties,...

s.sch019 The Public Finance and Accountability (Scotland) Act 2000 is amended...

s.sch019 In section 26B(3)(a) (voluntary disclosure of data to Audit Scotland),...

s.sch019 In section 26C(3)(a) (power to require disclosure of data), for...

s.sch019 In section 29(1) (interpretation), at the appropriate place insert— “the...

s.sch019 The Consumer Credit Act 1974 is amended as follows.

s.sch019 The Criminal Justice and Police Act 2001 is amended as...

s.sch019 In section 57(1) (retention of seized items)—

s.sch019 In section 65(7) (meaning of “legal privilege”)—

s.sch019 In Schedule 1 (powers of seizure)— (a) omit paragraph 65,...

s.sch019 The Anti-terrorism, Crime and Security Act 2001 is amended as...

s.sch019 (1) Section 19 (disclosure of information held by revenue departments)...

s.sch019 (1) Part 1 of Schedule 4 (extension of existing disclosure...

s.sch019 (1) Section 7A of the Health and Personal Social Services...

s.sch019 (1) Section 5A of the Justice (Northern Ireland) Act 2002...

s.sch019 The Proceeds of Crime Act 2002 is amended as follows....

s.sch019 In section 157(2A) (duty to disclose name etc of agency)—...

s.sch019 In section 333C(2)(d) (other permitted disclosures between institutions etc), for...

s.sch019 In section 436(3)(a) (disclosure of information to certain Directors), for...

s.sch019 In section 438(8)(a) (disclosure of information by certain Directors), for...

s.sch019 In section 439(3)(a) (disclosure of information to Lord Advocate and...

s.sch019 In section 441(7)(a) (disclosure of information by Lord Advocate and...

s.sch019 After section 442 insert— Data protection legislation In this Part, “the data protection legislation” has the same...

s.sch019 (1) Section 237 of the Enterprise Act 2002 (general restriction...

s.sch019 (1) In Schedule 5 to the Scottish Public Services Ombudsman...

s.sch019 The Freedom of Information (Scotland) Act 2002 is amended as...

s.sch019 In section 2(2)(e)(ii) (absolute exemptions), omit “by virtue of subsection...

s.sch019 In section 159(1)(a) (correction of wrong information) for “section 7...

s.sch019 (1) Section 38 (personal information) is amended as follows.

s.sch019 Schedule 5 to the Courts Act 2003 (collection of fines)...

s.sch019 (1) Paragraph 9C (disclosure of information in connection with making...

s.sch019 (1) Paragraph 10A (attachment of earnings orders (Justice Act (Northern...

s.sch019 (1) Section 94 of the Sexual Offences Act 2003 (Part...

s.sch019 The Criminal Justice Act 2003 is amended as follows.

s.sch019 In section 327A(9) (disclosure of information about convictions etc of...

s.sch019 In section 327B (disclosure of information about convictions etc of...

s.sch019 (1) Section 279 of the Mental Health (Care and Treatment)...

s.sch019 (1) Section 64C of the Public Audit (Wales) Act 2004...

s.sch020 (1) In this Schedule— “the 1984 Act” means the Data...

s.sch020 (1) In Schedule 18 to this Act, references to a...

s.sch020 In section 185 of this Act, references to a record...

s.sch020 In paragraph 20(2) of Schedule 2 to this Act (self-incrimination),...

s.sch020 Until the first regulations under section 24(8) of this Act...

s.sch020 (1) In relation to an automated processing system set up...

s.sch020 Nothing in this Schedule, read with the revocation of regulation...

s.sch020 Until the first regulations under section 94(4)(b) of this Act...

s.sch020 (1) The repeal of section 28(2) to (12) of the...

s.sch020 (1) This paragraph applies to a certificate issued under section...

s.sch020 (1) On and after the relevant day, the individual who...

s.sch020 (1) The repeal of sections 7 to 9A of the...

s.sch020 (1) The repeal of paragraph 10 of Schedule 5 to...

s.sch020 (1) The repeal of section 52(1) of the 1998 Act...

s.sch020 (1) The repeal of Schedule 5 to the 1998 Act...

s.sch020 Paragraph 10 of Schedule 12 to this Act applies only...

s.sch020 (1) The repeal of section 54(2) of the 1998 Act...

s.sch020 (1) The repeal of section 54(3) of the 1998 Act...

s.sch020 (1) The Data Protection (Charges and Information) Regulations 2018 (S.I....

s.sch020 (1) The repeal of section 42 of the 1998 Act...

s.sch020 (1) The repeal of section 52E of the 1998 Act...

s.sch020 (1) In this Part of this Schedule, references to contravention...

s.sch020 (1) The repeal of section 10 of the 1998 Act...

s.sch020 (1) The repeal of section 43 of the 1998 Act...

s.sch020 (1) The repeal of section 44 of the 1998 Act...

s.sch020 (1) The repeal of sections 41A and 41B of the...

s.sch020 (1) The repeal of sections 40 and 41 of the...

s.sch020 (1) The repeal of section 45 of the 1998 Act...

s.sch020 (1) The repeal of section 46 of the 1998 Act...

s.sch020 (1) The repeal of sections 47, 60 and 61 of...

s.sch020 (1) The repeal of sections 50, 60 and 61 of,...

s.sch020 (1) The repeal of sections 55A, 55B, 55D and 55E...

s.sch020 (1) The repeal of sections 48 and 49 of the...

s.sch020 (1) The repeal of section 11 of the 1998 Act...

s.sch020 (1) The repeal of section 28 of the 1998 Act...

s.sch020 (1) The repeal of paragraph 7 of Schedule 6 to...

s.sch020 (1) The repeal of paragraph 8 of Schedule 6 to...

s.sch020 (1) The references in the preceding paragraphs of this Part...

s.sch020 In section 143 of this Act— (a) the reference to...

s.sch020 In paragraph 16 of Schedule 15 to this Act (powers...

s.sch020 (1) Tribunal Procedure Rules made under paragraph 7(1)(a) of Schedule...

s.sch020 (1) The following provisions (as amended by Schedule 19 to...

s.sch020 (1) This paragraph applies in relation to the code of...

s.sch020 (1) This paragraph applies in relation to the original statement...

s.sch020 (1) The repeal of section 12 of the 1998 Act...

s.sch020 In section 159(1)(a) of the Consumer Credit Act 1974 (correction...

s.sch020 Paragraphs 52 to 55 make provision about the Freedom of...

s.sch020 (1) This paragraph applies where a request for information was...

s.sch020 (1) Tribunal Procedure Rules made under paragraph 7(1)(b) of Schedule...

s.sch020 (1) The repeal of paragraph 8 of Schedule 6 to...

s.sch020 (1) The amendment of section 77 of the 2000 Act...

s.sch020 (1) This paragraph applies where a request for information was...

s.sch020 Until the first regulations under Article 5(4)(a) of the Access...

s.sch020 (1) The repeal of a provision of the 1998 Act...

s.sch020 Part 3 of Schedule 19 to this Act (modifications) does...

s.sch020 (1) The repeal of section 13 of the 1998 Act...

s.sch020 (1) This paragraph applies where a request for information was...

s.sch020 (1) The repeal of section 14(1) to (3) and (6)...

s.sch020 The repeal of section 15 of the 1998 Act (jurisdiction...

s.sch020 (1) The repeal of Part 4 of the 1998 Act...

s.sch021 The applied GPDR

s.sch021 Part 3 (law enforcement processing): transfers approved by regulations

s.sch021 (1) The following are specified for the purposes of paragraph...

s.sch021 (1) In sections 74B and 76(A1)— (a) references to regulations...

s.sch021 Applied GDPR: power to make provision in consequence of GDPR regulations

s.sch021 Applied GDPR: national security certificates

s.sch021 Confidentiality of information

s.sch021 GDPR: maximum amount of penalties

s.sch021 GDPR: right to an effective remedy against the Commissioner

s.sch021 Merger of the directly applicable GDPR and the applied GDPR

s.sch021 (1) Anything done in connection with the EU GDPR as...

s.sch021 UK GDPR: transfers approved by regulations

s.sch021 (1) The following are specified for the purposes of paragraph...

s.sch021 (1) In the provisions listed in sub-paragraph (2)—

s.sch021 UK GDPR: transfers subject to appropriate safeguards provided by standard data protection clauses

s.sch021 (1) Paragraph 7 does not apply to the extent that...

s.sch021 UK GDPR: transfers subject to appropriate safeguards provided by binding corporate rules

1 other provision

s.processing in reliance on relevant international l Processing in reliance on relevant international law

Help complying

Guvnor’s practical routes through this instrument.

Marketing compliance: PECR and UK GDPR

Learn how to send compliant marketing emails, texts, and make telephone calls. Covers PECR consent rules, the soft opt-in exception, TPS screening, …

Comply with the Online Safety Act from scratch

A complete learning path for platform operators new to the Online Safety Act 2023. Covers understanding the Act, determining scope and platform …

Respond to a data breach

Step-by-step breach response when personal data has been compromised. Covers the 72-hour ICO notification deadline, assessing risk, notifying affected individuals, and documenting …

Data breach 72-hour checklist

Emergency checklist when you discover a personal data breach. Covers immediate containment, the 72-hour ICO notification rule, when to notify affected individuals, …

Start using AI responsibly in your business

End-to-end learning path for businesses adopting AI: understanding the regulatory landscape, assessing obligations, setting up governance, managing specific risks around data, bias, …

AI compliance quick check

Rapid AI compliance self-assessment: identify AI systems, map to regulators, flag critical obligations, confirm key safeguards in place.

AI Regulation Framework

The UK takes a principles-based, sector-specific approach to AI regulation. There is no single AI law. Instead, existing regulators — including the …

Approvals and registrations you need before trading

Understanding the approvals, registrations, and licences your business needs before you can legally start trading. Covers universal registrations, activity-triggered licences, professional body …

Carry out a data protection impact assessment (DPIA)

How to carry out a data protection impact assessment under UK GDPR Article 35. Covers when a DPIA is legally required, the …

Cookie consent: comply with PECR requirements

How to comply with cookie consent rules under the Privacy and Electronic Communications Regulations 2003 (PECR). Covers consent banners, strictly necessary exemptions, …

Cryptoasset Business Regulation

Regulatory requirements for cryptoasset businesses in the UK - how token classification determines whether you need full FCA authorisation or Money Laundering …

Data protection and CCTV for hospitality businesses

How to comply with UK GDPR and PECR in hospitality, covering CCTV use, guest booking data, wifi login data, loyalty programmes, marketing …

Data protection annual compliance checklist

Annual checklist for verifying your data protection compliance. Covers ICO fee renewal, privacy notices, records of processing, breach procedures, staff training, DPIAs, …

Data protection for businesses

How to comply with UK GDPR and the Data Protection Act 2018. Covers ICO registration, lawful bases for processing, data subject rights, …

134 more guides that reference this instrument

Connected legislation

Instruments made under this Act. They carry the detail the Act delegates.

The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2022 SI 2022/76

The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024 SI 2024/342

The Data Protection Act 2018 (Commencement No. 2) Regulations 2019 SI 2019/1188

The Data Protection Act 2018 (Commencement No. 3) Regulations 2019 SI 2019/1434

The Data Protection Act 2018 (Transitional Provision) Regulations 2023 SI 2023/414

The Data Protection (Charges and Information) (Amendment) Regulations 2019 SI 2019/478

The Data Protection (Charges and Information) (Amendment) Regulations 2025 SI 2025/63

The Data Protection (Fundamental Rights and Freedoms) (Amendment) Regulations 2023 SI 2023/1417

The Privacy and Electronic Communications (Amendment) Regulations 2018 SI 2018/1189

Duty extraction and severity labels are Guvnor’s analysis of the instrument, not the instrument itself. Always verify against the linked source text.