Marketing compliance: PECR and UK GDPR
- 7 steps
UK Act of Parliament
2018
United Kingdom
Data Protection Act 2018
At a glance
Enforced by
ICO, SRA, LSB, RQIA, Forestry Commission
What's here
87 compliance obligations, 142 practical guides across 7 topics · 37 journeys · 9 statutory instruments
Penalty landscape
54 of 87 obligations carry a fine up to £17,500,000. 12 carry different penalties and 21 have no criminal penalty — flagged in the list below.
Who this Act binds
Business-side actors with duties under this Act, ranked by how often they appear.
- Data Controller 46
- Any Person 17
- Director or Officer 1
- Contractor 1
Plus 22 non-business duties on Crown ministers, regulators, local authorities or tribunals — shown collapsed under each section below.
Step-by-step journeys using this legislation
Walkthroughs that take you from a real business situation to compliance.
Comply with the Online Safety Act from scratch
- 3 steps
Respond to a data breach
- 5 steps
Data breach 72-hour checklist
- 3 steps
Start using AI responsibly in your business
- 7 steps
AI compliance quick check
- 9 steps
Relevant guidance
Practical guides for businesses affected by this Act, ordered by how closely they engage with it.
Direct — cites this Act
25 guidesAI Regulation Framework
Approvals and registrations you need before trading
Carry out a data protection impact assessment (DPIA)
Cookie consent: comply with PECR requirements
Cryptoasset Business Regulation
Data protection and CCTV for hospitality businesses
Data protection annual compliance checklist
Data protection for businesses
Supporting — topic alignment
98 guidesMentioned in related content
19 guides- AI compliance checklist
- AI compliance for financial services firms
- AI medical device compliance
- AI transparency and explainability obligations
- Age verification for online services
- Annual retail compliance checklist
- Assess your AI compliance obligations
- Children's safety duties under the Online Safety Act
- Conduct a children's access assessment
- E-commerce and digital exporting
Other Acts binding the same actors
For each actor bound by this Act, the other UK Acts that bind them most often. Useful for understanding the full compliance landscape facing each role.
Data Controllers also bound by 38 other Acts (top 5 shown)
- UK GDPR (retained EU law) 2016 126 duties
- The Town and Country Planning (Entertainment Resort Complex, Bedford) Special Development (No. 2) Order 2025 2025 50 duties
- Regulation (EU) 2018/1139 (EASA Basic Regulation) 2018 6 duties
- Commission Delegated Regulation (EU) No 231/2013 of 19 December 2012 supplementing Directive 2011/61/EU of the European Parliament and of the Council with regard to exemptions, general operating conditions, depositaries, leverage, transparency and supervision (Text with EEA relevance) 2013 5 duties
- Privacy and Electronic Communications Regulations 2003 2003 5 duties
Any Person also bound by 2338 other Acts (top 5 shown)
- Human Medicines Regulations 2012 2012 169 duties
- Merchant Shipping Act 1995 1995 144 duties
- Insolvency (England and Wales) Rules 2016 2016 101 duties
- Road Traffic Act 1988 1988 95 duties
- Air Navigation Order 2016 2016 95 duties
Directors and Officers also bound by 425 other Acts (top 5 shown)
- Insolvency (England and Wales) Rules 2016 2016 161 duties
- Companies Act 2006 2006 108 duties
- Insolvency Act 1986 1986 72 duties
- The Large and Medium-sized Companies and Groups (Accounts and Reports) Regulations 2008 2008 55 duties
- The Housing Administration (England and Wales) Rules 2018 2018 26 duties
Contractors also bound by 178 other Acts (top 5 shown)
- The National Health Service (Personal Medical Services Agreements) Regulations 2015 2015 137 duties
- The National Health Service (General Medical Services Contracts) Regulations 2015 2015 134 duties
- Construction (Design and Management) Regulations 2015 2015 114 duties
- The National Health Service (General Medical Services Contracts) (Wales) Regulations 2023 2023 93 duties
- The Health and Personal Social Services (General Medical Services Contracts) Regulations (Northern Ireland) 2004 2004 87 duties
What this Act requires
Sections that create concrete duties on businesses or carry penalties. Procedural and definitional sections are folded into the “Browse other sections” expander at the bottom of each group. Click any section title to read the source text on legislation.gov.uk.
Part 1 — Preliminary
Protection of personal data
Fine up to £17,500,000- Process personal data lawfully, fairly, and transparently Data Controller
Browse 2 other sections in this Part — procedural / definitional / commencement
Part 2 — General processing
Obligations of credit reference agencies
Fine up to £17,500,000- Include specific legal rights statement when responding to data requests Data Controller
Browse 29 other sections in this Part — procedural / definitional / commencement
Processing to which this Part applies
Article 57(3) of the UK GDPR (performance of Commissioner’s tasks...
Meaning of “controller”
Meaning of “public authority” and “public body”
Lawfulness of processing: public interest etc
Child's consent in relation to information society services
Processing in reliance on relevant international law
Special categories of personal data and criminal convictions etc data
Special categories of personal data etc: supplementary
Limits on fees that may be charged by controllers
Meaning of “relevant offence” for purpose of right to erasure
Automated decision-making authorised by law: safeguards
Exemptions etc
Power to make further exemptions etc by regulations
Accreditation of certification providers
Transfers based on adequacy regulations
Transfers based on adequacy regulations: review etc
Standard data protection clauses
Transfers of personal data to third countries etc : public interest
Processing for archiving, research and statistical purposes: safeguards
Meaning of “court”
Definitions
Application of the GDPR to processing to which this Chapter applies
Power to make provision in consequence of regulations related to the GDPR
Manual unstructured data held by FOI public authorities
Manual unstructured data used in longstanding historical research
National security and defence exemption
National security: certificate
National security and defence: modifications to Articles 9 and 32 of the UK GDPR
Part 3 — Law enforcement processing
Overview and general duty of controller
Fine up to £17,500,000- Comply with data protection principles and prove it Data Controller
The second data protection principle
Fine up to £17,500,000- Use law enforcement data only for specified and compatible purposes Data Controller
The third data protection principle
Fine up to £17,500,000- Ensure law enforcement data is adequate, relevant, and not excessive Any Person
The fourth data protection principle
Fine up to £17,500,000- Maintain accurate law enforcement data and verify its quality Data Controller
The fifth data protection principle
Fine up to £17,500,000- Establish data retention limits and review periods for law enforcement data Any Person
The sixth data protection principle
Fine up to £17,500,000- Secure personal data against loss or unauthorized access Any Person
Safeguards: archiving
Fine up to £17,500,000- Do not use archived law enforcement data to make decisions about individuals Data Controller
Safeguards: sensitive processing
Fine up to £17,500,000- Maintain and review a policy for sensitive data processing Data Controller
Right to rectification
Fine up to £17,500,000- Correct or complete inaccurate personal data upon request Data Controller
Right to erasure or restriction of processing
Fine up to £17,500,000- Erase or restrict processing of personal data Data Controller
Rights under section 46 or 47: supplementary
Fine up to £17,500,000- Respond to data rectification, erasure, or restriction requests Data Controller
Restrictions on automated decision-making based on sensitive processing
Fine up to £17,500,000- Do not make significant decisions using only automated sensitive data processing Data Controller
Safeguards for automated decision-making
Fine up to £17,500,000- Provide safeguards for automated decision-making Data Controller
Exercise of rights through the Commissioner
Other duties (1) — Crown / regulator
- ICO must verify if a business's refusal of data rights was lawful Statutory regulator
Form of provision of information etc
Fine up to £17,500,000- Provide personal data in a clear, accessible, and free format Data Controller
Manifestly unfounded or excessive requests by the data subject
Fine up to £17,500,000- Handling unfounded or excessive data subject requests Data Controller
General obligations of the controller
Fine up to £17,500,000- Implement and demonstrate data protection compliance measures Data Controller
Data protection by design and default
Fine up to £17,500,000- Build data protection into your systems and processes by default Data Controller
Joint controllers
Fine up to £17,500,000- Create a formal agreement and contact point with joint data controllers Data Controller
Processors
Fine up to £17,500,000- Use only compliant data processors and maintain written contracts Data Controller
Processing under the authority of the controller or processor
Fine up to £17,500,000- Only process personal data on instructions or for legal duties Data Controller
Records of processing activities
Fine up to £17,500,000- Maintain records of your data processing activities Data Controller
Logging
Fine up to £17,500,000- Maintain and share automated logs of data processing operations Data Controller
Co-operation with the Commissioner
Fine up to £17,500,000- Co-operate with the Information Commissioner's Office (ICO) Data Controller
Data protection impact assessment
Fine up to £17,500,000- Conduct a Data Protection Impact Assessment (DPIA) for high-risk processing Data Controller
Prior consultation with the Commissioner
Fine up to £17,500,000- Consult the ICO before high-risk data processing Data Controller
Security of processing
Fine up to £17,500,000- Implement appropriate security measures for personal data Data Controller
Designation of a data protection officer
Fine up to £17,500,000- Appoint a Data Protection Officer and notify the ICO Data Controller
Position of data protection officer
Fine up to £17,500,000- Support and protect your Data Protection Officer (DPO) Data Controller
Tasks of data protection officer
Fine up to £17,500,000- Ensure your Data Protection Officer performs their statutory tasks Data Controller
General principles for transfers of personal data
Fine up to £17,500,000- Verify legal conditions before transferring law enforcement data abroad Data Controller
Transfers approved by regulations: monitoring
Other duties (1) — Crown / regulator
- Secretary of State must monitor and update approved data transfer lists Crown / Minister / Government department
Subsequent transfers
Fine up to £17,500,000- Control further transfers of law enforcement data abroad Data Controller
Special processing restrictions
Fine up to £17,500,000- Notify international data recipients of UK processing restrictions Data Controller
Browse 31 other sections in this Part — procedural / definitional / commencement
Processing to which this Part applies
Meaning of “competent authority”
“The law enforcement purposes”
Meaning of “controller” and “processor”
Other definitions
The first data protection principle
Further provision about sensitive processing
Overview and scope
... Controller's general duties
Right of access by the data subject
Exemption from sections 44 and 45: legal professional privilege
Right not to be subject to automated decision-making
Automated decision-making authorised by law: safeguards
Automated processing and significant decisions
Further provision about automated decision-making
Meaning of “applicable time period”
Overview and scope
Notification of a personal data breach to the Commissioner
Communication of a personal data breach to the data subject
Codes of conduct
Overview and interpretation
Transfers on the basis of an adequacy decision
Transfers based on adequacy regulations
Transfers approved by regulations
The data protection test
Transfers subject to appropriate safeguards
Transfers based on special circumstances
Additional conditions for transfers in reliance on section 73(4)(b)
National security exemption
National security: certificate
Reporting of infringements
Part 4 — Intelligence services processing
Records of designation notices
Other duties (1) — Crown / regulator
- Secretary of State must notify ICO of designation notices Crown / Minister / Government department
The second data protection principle
Fine up to £17,500,000- Collect and process personal data only for specific, lawful purposes Data Controller
The third data protection principle
Fine up to £17,500,000- Ensure personal data is adequate, relevant, and not excessive Any Person
The fourth data protection principle
Fine up to £17,500,000- Keep all personal data accurate and up to date Any Person
The fifth data protection principle
Fine up to £17,500,000- Keep personal data only for as long as necessary Any Person
The sixth data protection principle
Fine up to £17,500,000- Implement appropriate security measures to protect personal data Any Person
Right of access
Fine up to £17,500,000- Respond to personal data access requests Data Controller
Right of access: supplementary
Fine up to £17,500,000- Provide data subjects with copies of their personal data Data Controller
Right to information about decision-making
Fine up to £17,500,000- Explain the logic behind automated or data-driven decisions upon request Data Controller
Rights to rectification and erasure
Amended 1 timeOverview
Amended 1 timeGeneral obligations of the controller
Fine up to £17,500,000 Amended 2 times- Ensure and demonstrate that your data processing is legal Data Controller
Data protection by design
Fine up to £17,500,000 Amended 1 time- Assess privacy impacts and design data protection into your systems Data Controller
Joint controllers
Fine up to £17,500,000 Amended 2 times- Establish an agreement between joint data controllers Data Controller
Processors
Fine up to £17,500,000 Amended 1 time- Vet and monitor third-party data processors Data Controller
Processing under the authority of the controller or processor
Fine up to £17,500,000 Amended 1 time- Process personal data only on specific instructions or legal grounds Data Controller
Security of processing
Fine up to £17,500,000 Amended 1 time- Implement appropriate security measures to protect personal data Data Controller
Communication of a personal data breach
Amended 3 timesTransfers of personal data outside the United Kingdom
Fine up to £17,500,000 Amended 1 time- Restrict personal data transfers outside the UK Data Controller
National security
Amended 7 timesNational security: certificate
Amended 1 timeOther exemptions
Amended 1 timePower to make further exemptions
Amended 1 timeBrowse 15 other sections in this Part — procedural / definitional / commencement
Processing to which this Part applies
Designation of processing by a qualifying competent authority
Duration of designation notice
Review and withdrawal of designation notice
Appeal against designation notice
Meaning of “controller” and “processor”
Other definitions
Overview
The first data protection principle
Further provision about sensitive processing
Overview
Right to information
Right not to be subject to automated decision-making
Right to intervene in automated decision-making
Right to object to processing
Part 5 — The Information Commissioner
The Information Commissioner
Amended 1 timeThe Information Commission
Amended 1 timeGeneral functions under the UK GDPR and safeguards
Amended 16 timesOther general functions
Amended 10 timesCompetence in relation to courts etc
Amended 4 timesCo-operation between parties to the Data Protection Convention
Amended 6 timesInspection of personal data in accordance with international obligations
2 years imprisonment Amended 4 times- Obstruct or fail to assist the ICO’s inspection powers Any Person
Standard clauses for transfers to third countries etc
Amended 4 timesFurther international role
Amended 9 timesPrincipal objective
Amended 9 timesDuties in relation to functions under the data protection legislation
Amended 9 timesOther duties (1) — Crown / regulator
- ICO must consider innovation and competition when enforcing data laws Statutory regulator
Strategy
Amended 9 timesOther duties (1) — Crown / regulator
- Information Commissioner must publish a data protection strategy Statutory regulator
Duty to consult other regulators
Amended 9 timesData-sharing code
Amended 2 timesOther duties (1) — Crown / regulator
- ICO must produce and maintain a data-sharing code of practice Statutory regulator
Direct marketing code
Fine up to £17,500,000 Amended 2 timesOther duties (1) — Crown / regulator
- ICO must produce and maintain a direct marketing code of practice Statutory regulator
Age-appropriate design code
Amended 3 timesData protection and journalism code
Amended 3 timesOther duties (1) — Crown / regulator
- ICO must produce and maintain a data protection and journalism code Statutory regulator
Other codes of practice
Amended 3 timesOther duties (1) — Crown / regulator
- ICO must prepare codes of practice on personal data processing Statutory regulator
Panels to consider codes of practice
Amended 3 timesImpact assessments for codes of practice
Amended 3 timesOther duties (1) — Crown / regulator
- ICO must conduct impact assessments for codes of practice Statutory regulator
Approval of codes prepared under sections 121 to 124A
Amended 12 timesPublication and review of codes issued under section 125(4)
Amended 2 timesOther duties (1) — Crown / regulator
- Information Commissioner must publish and review codes of practice Statutory regulator
Effect of codes issued under section 125(4)
Amended 2 timesOther codes of practice
Amended 2 timesConsensual audits
Amended 5 timesRecords of national security certificates
Amended 3 timesOther duties (1) — Crown / regulator
- ICO must maintain a public record of national security certificates Statutory regulator
Disclosure of information to the Commissioner
Amended 2 timesConfidentiality of information
Unlimited fine Amended 4 times- Unlawfully disclosing information held by the ICO Contractor
Guidance about privileged communications
Amended 1 timeOther duties (1) — Crown / regulator
- ICO must publish guidance on handling legally privileged information Statutory regulator
Fees for services
Amended 2 timesManifestly unfounded or excessive requests by data subjects etc
Amended 13 timesGuidance about fees
Amended 5 timesOther duties (1) — Crown / regulator
- ICO must publish guidance on fees and consult the Secretary of State Statutory regulator
Charges payable to the Commissioner by controllers
Amended 4 timesRegulations under section 137: supplementary
Amended 2 timesReporting to Parliament
Amended 9 timesOther duties (1) — Crown / regulator
- Information Commissioner must report annually to Parliament Statutory regulator
Analysis of performance
Amended 9 timesOther duties (1) — Crown / regulator
- ICO must publish an annual analysis of its own performance Statutory regulator
Publication by the Commissioner
Amended 3 timesOther duties (1) — Crown / regulator
- Information Commissioner must publish required documents appropriately Statutory regulator
Notices from the Commissioner
Amended 3 timesPart 6 — Enforcement
Information notices
Amended 20 timesInformation notices: restrictions
Amended 9 timesFalse statements made in response to information notices
Unlimited fine Amended 2 times- Make false statement in response to an information notice Any Person
Information orders
Amended 9 timesAssessment notices
Amended 16 timesAssessment notices: approval of person to prepare report etc
Fine up to £17,500,000 Amended 16 times- Nominate a person to prepare an assessment report Data Controller
Assessment notices: restrictions
Amended 5 timesDestroying or falsifying information and documents etc
2 years imprisonment Amended 7 times- Destroy or falsify information after an ICO notice Any Person
Interview notices
Amended 7 timesInterview notices: restrictions
Amended 7 timesFalse statements made in response to interview notices
2 years imprisonment Amended 7 times- Make false statement in response to interview notice Any Person
Enforcement notices
Amended 19 timesEnforcement notices: supplementary
Amended 6 timesEnforcement notices: rectification and erasure of personal data etc
Amended 8 timesEnforcement notices: restrictions
Amended 5 timesEnforcement notices: cancellation and variation
Amended 4 timesPowers of entry and inspection
Amended 2 timesPenalty notices
Fine up to £17,500,000 Amended 14 times- Breach of data protection laws or ICO notices Data Controller
Penalty notices: restrictions
Amended 4 timesMaximum amount of penalty
Amended 10 timesFixed penalties for non-compliance with charges regulations
Amended 3 timesOther duties (1) — Crown / regulator
- Information Commissioner must publish fixed penalty amounts for fee failures Statutory regulator
Amount of penalties: supplementary
Amended 4 timesGuidance about regulatory action
Amended 16 timesOther duties (1) — Crown / regulator
- ICO must publish guidance on its regulatory and enforcement powers Statutory regulator
Approval of first guidance about regulatory action
Amended 6 timesAnnual report on regulatory action
Amended 6 timesRights of appeal
Amended 3 timesDetermination of appeals
Amended 4 timesApplications in respect of urgent notices
Amended 4 timesComplaints by data subjects to controllers
Fine up to £17,500,000 Amended 4 times- Establish and manage a formal data protection complaint process Data Controller
Controllers to notify the Commissioner of the number of complaints
Amended 4 timesComplaints by data subjects
Amended 8 timesOrders to progress complaints
Amended 3 timesCompliance orders
Amended 2 timesCompensation for contravention of the UK GDPR
Amended 3 timesCompensation for contravention of other data protection legislation
Amended 2 timesUnlawful obtaining etc of personal data
2 years imprisonment Amended 3 times- Unlawfully obtain, retain, disclose or sell personal data Any Person
Re-identification of de-identified personal data
2 years imprisonment Amended 4 times- Re‑identify de‑identified personal data without consent Any Person
Re-identification: effectiveness testing conditions
Amended 2 timesAlteration etc of personal data to prevent disclosure to data subject
2 years imprisonment Amended 3 times- Alter data to block a data subject’s access request Data Controller
The special purposes
Amended 5 timesProvision of assistance in special purposes proceedings
Amended 2 timesStaying special purposes proceedings
Amended 2 timesGuidance about how to seek redress against media organisations
Amended 5 timesReview of processing of personal data for the purposes of journalism
Amended 5 timesEffectiveness of the media's dispute resolution procedures
Other duties (1) — Crown / regulator
- Secretary of State must report on media data protection dispute resolution Crown / Minister / Government department
Jurisdiction
Amended 4 timesProcedure in connection with subject access requests
Amended 4 timesInterpretation of Part 6
Amended 4 timesPart 7 — Supplementary and final provision
Regulations and consultation
Amended 14 timesPower to reflect changes to the Data Protection Convention
Amended 5 timesProtection of prohibitions and restrictions etc on processing: relevant enactments
Amended 5 timesProtection of prohibitions and restrictions etc on processing: other enactments
Amended 5 timesProhibition of requirement to produce relevant records
2 years imprisonment Amended 4 times- Require a relevant record from another person Any Person
Avoidance of certain contractual terms relating to health records
Amended 3 timesProtection of data subject’s rights
Amended 8 timesProtection of data subject’s rights: further provision
Amended 8 timesRepresentation of data subjects with their authority
Amended 17 timesRepresentation of data subjects with their authority: collective proceedings
Amended 2 timesDuty to review provision for representation of data subjects
Amended 5 timesPost-review powers to make provision about representation of data subjects
Amended 2 timesFramework for Data Processing by Government
Amended 2 timesApproval of the Framework
Amended 2 timesPublication and review of the Framework
Amended 1 timeOther duties (1) — Crown / regulator
- Secretary of State must publish and review the Data Processing Framework Crown / Minister / Government department
Effect of the Framework
Fine up to £17,500,000 Amended 2 times- Follow official guidance when processing personal data Any Person
Reserve forces: data-sharing by HMRC
2 years imprisonment Amended 1 time- Unlawfully disclose reserve force member contact details Any Person
Penalties for offences
Unlimited fine Amended 3 times- Commit certain data‑protection offences Any Person
Prosecution
Amended 4 timesLiability of directors etc
Unlimited fine Amended 1 time- Be liable as director for a data protection offence Director or Officer
Recordable offences
Amended 2 timesGuidance about PACE codes of practice
Amended 2 timesOther duties (1) — Crown / regulator
- ICO must publish guidance on police and criminal evidence codes Statutory regulator
Disclosure of information to the Tribunal
Amended 2 timesProceedings in the First-tier Tribunal: contempt
Amended 3 timesTribunal Procedure Rules
Amended 3 timesMeaning of “health professional” and “social work professional”
Amended 6 timesGeneral interpretation
Amended 18 timesIndex of defined expressions
Amended 17 timesTerritorial application of this Act
Amended 10 timesChildren in Scotland
Amended 1 timeApplication to the Crown
Amended 9 timesApplication to Parliament
Amended 2 timesMinor and consequential provision
Amended 1 timeTransitional provision
Amended 4 timesExtent
Amended 2 timesBrowse 2 other sections in this Part — procedural / definitional / commencement
Commencement
Short title
Schedules
Browse 885 other Schedules — structural / supplementary
Exemptions etc from the UK GDPR : disclosure prohibited or restricted by an enactment
Accreditation of certification providers: reviews and appeals
The applied GDPR and the applied Chapter 2
Competent authorities
Conditions for processing under Part 4
Co-operation and mutual assistance
Powers of entry and inspection
Review of processing of personal data for the purposes of journalism
Transitional provision etc
(1) This condition is met if— (a) the processing is...
(1) This condition is met if the processing—
(1) This condition is met if the processing—
(1) This condition is met if— (a) the processing is...
(1) This condition is met if— (a) the processing consists...
(1) This condition is met if the processing—
This condition is met if the processing is necessary for...
(1) This condition is met if the processing—
(1) This condition is met if the processing—
(1) This condition is met if— (a) the processing is...
(1) This condition is met if the processing—
(1) This condition is met if the processing is necessary...
(1) This condition is met if the processing—
(1) This condition is met if the processing—
(1) This condition is met if the processing—
(1) This condition is met if— (a) the processing is...
(1) This condition is met if— (a) the processing consists...
(1) This condition is met if— (a) the processing consists...
This condition is met if the processing—
(1) This condition is met if the processing is necessary—...
(1) This condition is met if the processing—
This condition is met if the data subject has given...
This condition is met if the processing—
This condition is met if— (a) the processing is necessary...
This condition is met if the processing is carried out—...
This condition is met if the processing relates to personal...
This condition is met if the processing—
This condition is met if the processing is necessary when...
(1) This condition is met if— (a) the processing is...
This condition is met if the processing would meet a...
This condition is met if the processing—
This Part of this Schedule makes provision about the processing...
The controller has an appropriate policy document in place in...
This condition is met if the processing—
(1) Where personal data is processed in reliance on a...
A record maintained by the controller, or the controller's representative,...
(1) Except as otherwise provided, a condition in this Part...
(1) This condition is met if the processing—
This condition is met if the processing is necessary—
(1) This condition is met if the processing—
(1) This condition is met if the processing—
In this Part of this Schedule, “the listed GDPR provisions”...
(1) The listed GDPR provisions do not apply to personal...
The listed GDPR provisions do not apply to personal data...
In the Table in paragraph 11— ... ... the “Financial...
The listed GDPR provisions and Article 34(1) and (4) of...
(1) The listed GDPR provisions do not apply to personal...
(1) The listed GDPR provisions do not apply to personal...
(1) Article 15(1) to (3) of the UK GDPR (confirmation...
(1) For the purposes of paragraph 16(2)(b), it is to...
In this Part of this Schedule, “the listed GDPR provisions”...
The listed GDPR provisions do not apply to personal data...
(1) The listed GDPR provisions and Article 34(1) and (4)...
(1) A person need not comply with the listed GDPR...
(1) The listed GDPR provisions do not apply to personal...
The listed GDPR provisions do not apply to personal data...
The listed GDPR provisions do not apply to personal data...
The listed GDPR provisions do not apply to personal data...
(1) The listed GDPR provisions do not apply to personal...
(1) In this paragraph, “the special purposes” means one or...
(1) The listed GDPR provisions do not apply to personal...
(1) The listed GDPR provisions do not apply to personal...
(1) The UK GDPR provisions listed in sub-paragraph (3) do...
(1) The relevant UK GDPR provisions do not apply to...
(1) A decision under paragraph 4(1) as to whether, and...
(1) Where the Secretary of State makes a decision mentioned...
(1) The listed GDPR provisions do not apply to personal...
In this Part of this Schedule, “the listed GDPR provisions”...
The listed GDPR provisions do not apply to personal data...
(1) The listed GDPR provisions do not apply to personal...
(1) The listed GDPR provisions do not apply to personal...
In this Schedule “the listed GDPR provisions” means the following...
(1) This paragraph applies where a request for social work...
Article 15(1) to (3) of the UK GDPR (confirmation of...
(1) This paragraph applies where— (a) a question arises as...
In this Part of this Schedule “educational record” means a...
(1) This paragraph applies to a record of information which—...
(1) This paragraph applies to a record of information which...
(1) This paragraph applies to a record of information which—...
(1) In this Part of this Schedule— “education authority” and...
(1) The listed GDPR provisions do not apply to education...
Article 15(1) to (3) of the UK GDPR (confirmation of...
(1) In this Part of this Schedule— “the appropriate health...
(1) This paragraph applies where— (a) a question arises as...
(1) This paragraph applies where a request for child abuse...
(1) The listed GDPR provisions do not apply to data...
(1) This paragraph applies where a request for data concerning...
(1) Article 15(1) to (3) of the UK GDPR (confirmation...
(1) Article 15(1) to (3) of the UK GDPR (confirmation...
(1) In this Part of this Schedule— “education data” has...
(1) This paragraph applies to personal data falling within any...
(1) The listed GDPR provisions do not apply to data...
In this Schedule “the listed GDPR provisions” means the following...
The listed GDPR provisions do not apply to personal data...
(1) The listed GDPR provisions do not apply to personal...
(1) The listed GDPR provisions do not apply to personal...
(1) The listed GDPR provisions do not apply to personal...
The listed GDPR provisions do not apply to personal data...
(1) This Schedule applies where— (a) a person (“the applicant”)...
(1) The applicant may ask the accreditation authority to review...
(1) If the applicant is dissatisfied with the decision on...
(1) If the applicant makes a request in accordance with...
(1) If the appeal panel considers it necessary, a hearing...
(1) The appeal panel must, before the end of the...
In this Schedule, “working day” means any day other than—...
In its application by virtue of section 22(1), the GDPR...
In Article 6 (lawfulness of processing)— (a) omit paragraph 2;...
In Article 8 (conditions applicable to child's consent in relation...
In Article 9 (processing of special categories of personal data)—...
In Article 10 (processing of personal data relating to criminal...
In Article 12 (transparent information etc for the exercise of...
In Article 13 (personal data collected from data subject: information...
In Article 14 (personal data collected other than from data...
In Article 17 (right to erasure (‘right to be forgotten’))—...
In Article 18 (right to restriction of processing), in paragraph...
In Article 21 (right to object), in paragraph 5, omit...
(1) References to “this Regulation” and to provisions of the...
In Article 22 (automated individual decision-making, including profiling), for paragraph...
In Article 23 (restrictions), in paragraph 1—
In Article 26 (joint controllers), in paragraph 1, for “Union...
Omit Article 27 (representatives of controllers or processors not established...
In Article 28 (processor)— (a) in paragraph 3, in point...
In Article 30 (records of processing activities)—
In Article 31 (co-operation with the supervisory authority), omit “and,...
In Article 35 (data protection impact assessment), omit paragraphs 4,...
In Article 36 (prior consultation)— (a) for paragraph 4 substitute—...
In Article 37 (designation of data protection officers), omit paragraph...
(1) References to “Union law”, “Member State law”, “the law...
In Article 39 (tasks of the data protection officer), in...
In Article 40 (codes of conduct)— (a) in paragraph 1,...
In Article 41 (monitoring of approved codes of conduct), omit...
In Article 42 (certification)— (a) in paragraph 1—
In Article 43 (certification bodies)— (a) in paragraph 1, in...
In Article 45 (transfers on the basis of an adequacy...
In Article 46 (transfers subject to appropriate safeguards)—
In Article 47 (binding corporate rules)— (a) in paragraph 1,...
In Article 49 (derogations for specific situations)—
In Article 50 (international co-operation for the protection of personal...
(1) References to “the Union”, “a Member State” and “Member...
In Article 51 (supervisory authority)— (a) in paragraph 1—
In Article 52 (independence)— (a) in paragraph 2—
Omit Article 53 (general conditions for the members of the...
Omit Article 54 (rules on the establishment of the supervisory...
In Article 55 (competence)— (a) in paragraph 1, omit “on...
Omit Article 56 (competence of the lead supervisory authority).
In Article 57 (tasks)— (a) in paragraph 1, in the...
In Article 58 (powers)— (a) in paragraph 1, in point...
In Article 59 (activity reports)— (a) for “, the government...
For Articles 60 to 76 substitute— Article 61 Co-operation with...
(1) References to a “supervisory authority”, a “competent supervisory authority”...
In Article 77 (right to lodge a complaint with a...
In Article 78 (right to an effective judicial remedy against...
In Article 79 (right to an effective judicial remedy against...
In Article 80 (representation of data subjects)—
Omit Article 81 (suspension of proceedings).
In Article 82 (right to compensation and liability), for paragraph...
In Article 83 (general conditions for imposing administrative fines)—
In Article 84 (penalties)— (a) for paragraph 1 substitute— The rules on other penalties applicable to infringements of this...
In Article 85 (processing and freedom of expression and information)—...
In Article 86 (processing and public access to official documents),...
References to “the national parliament” have effect as references to...
Omit Article 87 (processing of national identification number).
Omit Article 88 (processing in the context of employment).
In Article 89 (safeguards and derogations relating to processing for...
Omit Article 90 (obligations of secrecy).
Omit Article 91 (existing data protection rules of churches and...
Omit Article 92 (exercise of the delegation).
Omit Article 93 (committee procedure).
Omit Article 94 (repeal of Directive 95/46/EC).
Omit Article 95 (relationship with Directive 2002/58/EC).
In Article 96 (relationship with previously concluded Agreements), for “by...
For Article 2 (material scope) substitute— This Regulation applies to the processing of personal data to...
Omit Article 97 (Commission reports).
Omit Article 98 (Commission reviews).
Omit Article 99 (entry into force and application).
In its application by virtue of section 22(2), Chapter 2...
(1) References to Chapter 2 of Part 2 and the...
In section 16 (power to make further exemptions etc by...
For Article 3 substitute— Article 3 Territorial application Subsections (1),...
In Article 4 (definitions)— (a) in paragraph (7) (meaning of...
Any United Kingdom government department other than a non-ministerial government...
The chief constable of the British Transport Police.
The chief constable of the Civil Nuclear Constabulary.
The chief constable of the Ministry of Defence Police.
The Provost Marshal of the Royal Navy Police.
The Provost Marshal of the Royal Military Police.
The Provost Marshal of the Royal Air Force Police.
The Provost Marshal for serious crime.
The chief officer of— (a) a body of constables appointed...
A body established in accordance with a collaboration agreement under...
The Director General of the Independent Office for Police Conduct....
The Service Police Complaints Commissioner.
The Police Investigations and Review Commissioner.
The Scottish Ministers.
The Police Ombudsman for Northern Ireland.
The Commissioners for Her Majesty's Revenue and Customs.
The Welsh Revenue Authority.
Revenue Scotland.
The Director General of the National Crime Agency.
The Director of the Serious Fraud Office.
The Director of Border Revenue.
The Financial Conduct Authority.
The Health and Safety Executive.
The Competition and Markets Authority.
Any Northern Ireland department.
The Gas and Electricity Markets Authority.
The Food Standards Agency.
Food Standards Scotland.
Her Majesty's Land Registry.
The Criminal Cases Review Commission.
The Scottish Criminal Cases Review Commission.
A provider of probation services (other than the Secretary of...
The Youth Justice Board for England and Wales.
The Parole Board for England and Wales.
The Parole Board for Scotland.
The Welsh Ministers.
The Parole Commissioners for Northern Ireland.
The Probation Board for Northern Ireland.
The Prisoner Ombudsman for Northern Ireland.
A person who has entered into a contract for the...
A person who has entered into a contract with the...
A person who is, under or by virtue of any...
A youth offending team established under section 39 of the...
The Director of Public Prosecutions.
The Director of Public Prosecutions for Northern Ireland.
The Lord Advocate.
The chief constable of a police force maintained under section...
A Procurator Fiscal.
The Director of Service Prosecutions.
The Information Commissioner.
The Scottish Information Commissioner.
The Scottish Courts and Tribunal Service.
The Crown agent.
A court or tribunal.
The Border Security Commander.
The Commissioner of Police of the Metropolis.
The Commissioner of Police for the City of London.
The Chief Constable of the Police Service of Northern Ireland....
The chief constable of the Police Service of Scotland.
This condition is met if the processing—
This condition is met if the processing is necessary for...
This condition is met if the processing is necessary to...
(1) This condition is met if— (a) the processing is...
This condition is met if the processing relates to personal...
This condition is met if the processing—
This condition is met if the processing is necessary when...
(1) This condition is met if the processing—
This condition is met if the processing is necessary—
The data subject has given consent to the processing.
The processing is necessary— (a) for the performance of a...
The processing is necessary for compliance with a legal obligation...
The processing is necessary in order to protect the vital...
The processing is necessary— (a) for the administration of justice,...
(1) The processing is necessary for the purposes of legitimate...
The data subject has given consent to the processing.
The processing is necessary for the purposes of exercising or...
The processing is necessary— (a) in order to protect the...
(1) This condition is met if— (a) the processing is...
The information contained in the personal data has been made...
The processing— (a) is necessary for the purpose of, or...
The processing is necessary— (a) for the administration of justice,...
(1) The processing is necessary for medical purposes and is...
(1) The processing— (a) is of sensitive personal data consisting...
In this Schedule, “the listed provisions” means—
The listed provisions do not apply to personal data that...
The listed provisions do not apply to personal data consisting...
(1) The listed provisions do not apply to personal data...
(1) The listed provisions do not apply to personal data...
(1) The listed provisions do not apply to personal data...
The listed provisions do not apply to personal data processed...
(1) The listed provisions do not apply to personal data...
The listed provisions do not apply to personal data where...
The listed provisions do not apply to personal data to...
The listed provisions do not apply to personal data processed...
The listed provisions do not apply to personal data to...
The listed provisions do not apply to personal data to...
The listed provisions do not apply to personal data that...
(1) The Commissioner is to continue to be a corporation...
(1) All fees, charges, penalties and other sums received by...
(1) The Commissioner must— (a) keep proper accounts and other...
Paragraphs 1(1), 7 and 8 do not extend to Scotland....
(1) The Commissioner is to be appointed by Her Majesty...
(1) The Commissioner may be relieved of office by Her...
(1) The Commissioner is to be paid such salary as...
(1) The Commissioner— (a) must appoint one or more deputy...
(1) The functions of the Commissioner are to be carried...
The application of the seal of the Commissioner is to...
A document purporting to be an instrument issued by the...
The Secretary of State may make payments to the Commissioner...
The Information Commission
Status
Remuneration and pensions of non-executive members
Executive members: terms and conditions
Other staff: appointment, terms and conditions
Committees
Delegation of functions
Advice from committees
Proceedings
Records of proceedings
Disqualification for acting in relation to certain matters
Validity of proceedings
Number of members
Money
Fees etc and other sums
Accounts
Authentication of seal and presumption of authenticity of documents
Supplementary powers
Transitional provision: interim chief executive
Interpretation
Membership: general
Membership: non-executive members to outnumber executive members
Membership: selection on merit etc
Membership: conflicts of interests
Tenure of the chair
Tenure of deputy chair
Tenure of the other non-executive members
(1) The Commissioner must— (a) monitor and enforce Parts 3...
The Commissioner has the following investigative, corrective, authorisation and advisory...
In this Schedule— “foreign designated authority” means an authority designated...
In this Part of this Schedule, “foreign designated authority” means...
(1) The Commissioner must, at the request of a foreign...
(1) This paragraph applies where a request for assistance in...
(1) This paragraph applies where a request for assistance in...
Where the Commissioner receives information from a foreign designated authority...
(1) This paragraph applies if a judge of the High...
(1) This paragraph applies where a person executing a warrant...
(1) The powers of inspection and seizure conferred by a...
The powers of inspection and seizure conferred by a warrant...
(1) This paragraph applies if a person in occupation of...
(1) Where a warrant issued under this Schedule is executed—...
(1) It is an offence for a person—
(1) An explanation given, or information provided, by a person...
In this Schedule— (a) “premises” includes a vehicle, vessel or...
In the application of this Schedule to Scotland—
In the application of this Schedule to Northern Ireland—
(1) This paragraph applies if a judge of the High...
A judge must not issue a warrant under this Schedule...
(1) A judge must not issue a warrant under this...
(1) A warrant issued under this Schedule must authorise the...
A judge who issues a warrant under this Schedule must—...
A person executing a warrant issued under this Schedule may...
A warrant issued under this Schedule may be executed only...
(1) If an occupier of the premises in respect of...
In this Schedule, “penalty” means a penalty imposed by a...
(1) Before giving a person a penalty notice, the Commissioner...
(1) A notice of intent must contain the following information—...
(A1) This paragraph applies where the Commissioner gives a notice...
(1) A penalty notice must contain the following information—
(1) A penalty must be paid to the Commissioner within...
(1) The Commissioner may vary a penalty notice by giving...
(1) The Commissioner may cancel a penalty notice by giving...
(1) The Commissioner must not take action to recover a...
In this Schedule— “relevant period” means— the period of 18...
(1) This paragraph applies where the Commissioner gives an information...
(1) Sub-paragraph (2) applies where the Commissioner gives an assessment...
(1) Sub-paragraph (2) applies where the Commissioner gives an interview...
Section 164 applies where an information notice , assessment notice...
(1) In section 184, “relevant record” means—
“Relevant health record” means a health record which has been...
(1) “Relevant record relating to a conviction or caution” means...
(1) “Relevant record relating to statutory functions” means a record...
In this Schedule, “data subject access right” means a right...
For the purposes of this Schedule, a record which states...
(1) The Secretary of State may by regulations amend this...
(1) Section 19AC of the Registration Service Act 1953 (codes...
In section 189(1) (definitions), at the appropriate place insert— “the...
The Companies (Audit, Investigations and Community Enterprise) Act 2004 is...
(1) Section 15A (disclosure of information by tax authorities) is...
(1) Section 15D (permitted disclosure of information obtained under compulsory...
(1) Section 54 of the Domestic Violence, Crime and Victims...
The Children Act 2004 is amended as follows.
(1) Section 12 (information databases) is amended as follows.
(1) Section 29 (information databases: Wales) is amended as follows....
(1) Section 107 of the Constitutional Reform Act 2005 (disclosure...
In section 64 of the Mental Capacity Act 2005 (interpretation),...
(1) Section 34X of the Public Services Ombudsman (Wales) Act...
The Pharmacy (Northern Ireland) Order 1976 is amended as follows....
(1) Section 22 of the Commissioners for Revenue and Customs...
(1) Section 352 of the Gambling Act 2005 (data protection)...
(1) Section 18 of the Commissioner for Older People (Wales)...
The National Health Service Act 2006 is amended as follows....
(1) Section 251 (control of patient information) is amended as...
(1) Section 264C (provision and disclosure of information about health...
In paragraph 7B(3) of Schedule 1 (further provision about the...
The National Health Service (Wales) Act 2006 is amended as...
(1) Section 201C (provision of information about medical supplies: supplementary)...
In paragraph 7B(3) of Schedule 1 (further provision about the...
In article 2(2) (interpretation), omit the definition of “Directive 95/46/EC”....
The Companies Act 2006 is amended as follows.
In section 458(2) (disclosure of information by tax authorities)—
In section 461(7) (permitted disclosure of information obtained under compulsory...
In section 948(9) (restrictions on disclosure) for “the Data Protection...
In section 1173(1) (minor definitions: general), at the appropriate place...
In section 1224A(7) (restrictions on disclosure), for “the Data Protection...
In section 1253D(3) (restriction on transfer of audit working papers...
In section 1261(1) (minor definitions: Part 42), at the appropriate...
In section 1262 (index of defined expressions: Part 42), at...
In Schedule 8 (index of defined expressions: general), at the...
In article 8D (European professional card), after paragraph (3) insert—...
The Tribunals, Courts and Enforcement Act 2007 is amended as...
In section 11(5)(b) (right to appeal to Upper Tribunal), for...
In section 13(8)(a) (right to appeal to the Court of...
The Statistics and Registration Service Act 2007 is amended as...
(1) Section 45 (information held by HMRC) is amended as...
(1) Section 45A (information held by other public authorities) is...
(1) Section 45B(3) (access to information held by Crown bodies...
(1) Section 45C(13) (power to require disclosures by other public...
In section 45D(9)(b) (power to require disclosure by undertakings), for...
(1) Section 45E (further provision about powers in sections 45B,...
In article 22A(6) (Directive 2005/36/EC: functions of competent authority etc.),...
(1) Section 53A (disclosure by the Statistics Board to devolved...
(1) Section 54 (Data Protection Act 1998 and Human Rights...
In section 67 (general interpretation: Part 1), at the appropriate...
The Serious Crime Act 2007 is amended as follows.
(1) Section 5A (verification and disclosure of information) is amended...
(1) Section 68 (disclosure of information to prevent fraud) is...
(1) Section 85 (disclosure of information by Revenue and Customs)...
(1) Section 169 of the Legal Services Act 2007 (disclosure...
In section 74 of the Adoption and Children (Scotland) Act...
The Criminal Justice and Immigration Act 2008 is amended as...
(1) Schedule 2C (Directive 2005/36/EC: European professional card) is amended...
Omit— (a) section 77 (power to alter penalty for unlawfully...
(1) Section 114 (supply of information to Secretary of State...
(1) Section 70 of the Regulatory Enforcement and Sanctions Act...
In section 20A(5) of the Health and Social Care Act...
(1) Section 20 of the Counter-Terrorism Act 2008 (disclosure and...
(1) Section 117 of the Public Health etc. (Scotland) Act...
(1) Section 83ZY of the Banking Act 2009 (special resolution...
(1) Section 19 of the Borders, Citizenship and Immigration Act...
The Marine and Coastal Access Act 2009 is amended as...
(1) Paragraph 13 of Schedule 7 (further provision about civil...
(1) The table in Schedule 2D (functions of the Society...
(1) Paragraph 9 of Schedule 10 (further provision about fixed...
In Schedule 21 to the Coroners and Justice Act 2009...
(1) Section 38 of the Broads Authority Act 2009 (provision...
(1) Section 13 of the Health and Social Care (Reform)...
(1) Section 25 of the Terrorist Asset-Freezing etc. Act 2010...
(1) Paragraph 12 of Schedule 2 to the Marine (Scotland)...
(1) Section 59 of the Charities Act 2011 (disclosure: supplementary)...
The Welsh Language (Wales) Measure 2011 is amended as follows....
(1) Section 22 (power to disclose information) is amended as...
(1) Paragraph 8 of Schedule 2 (inquiries by the Commissioner:...
(1) Paragraph 2 of Schedule 3 (fitness to practice: disclosure...
(1) Section 10 of the Safeguarding Board Act (Northern Ireland)...
The Health and Social Care Act 2012 is amended as...
In section 250(7) (power to publish information standards), for the...
(1) Section 251A (consistent identifiers) is amended as follows.
(1) Section 251B (duty to share information) is amended as...
The Protection of Freedoms Act 2012 is amended as follows....
(1) Section 27 (exceptions and further provision about consent and...
In section 28(1) (interpretation: Chapter 2), for the definition of...
In section 29(7) (code of practice for surveillance camera systems),...
(1) Section 14A of the HGV Road User Levy Act...
(1) Schedule 2 to the Representation of the People Act...
The Crime and Courts Act 2013 is amended as follows....
(1) Section 42 (other interpretive provisions) is amended as follows....
(1) Paragraph 1 of Schedule 7 (statutory restrictions on disclosure)...
(1) Paragraph 8 of Schedule 2 to the Marine Act...
(1) Paragraph 3 of Schedule 9 to the Local Audit...
(1) Paragraph 7 of Schedule 4 to the Anti-social Behaviour,...
(1) Paragraph 6 of Schedule 6 to the Immigration Act...
In section 67(9) of the Care Act 2014 (involvement in...
In section 18(10)(b) of the Social Services and Well-being (Wales)...
(1) Section 38 of the Counter-Terrorism and Security Act 2015...
The Medical Act 1983 is amended as follows.
(1) Section 6 of the Small Business, Enterprise and Employment...
(1) Section 54A of the Modern Slavery Act 2015 (Gangmasters...
The Human Trafficking and Exploitation (Criminal Justice and Support for...
In section 13(5) (duty to notify National Crime Agency about...
In section 25(1) (interpretation of this Act), at the appropriate...
In paragraph 18(5) of Schedule 3 (supply of information to...
(1) Section 72 of the Justice Act (Northern Ireland) 2015...
(1) Section 7 of the Immigration Act 2016 (information gateways:...
The Investigatory Powers Act 2016 is amended as follows.
In section 1(5)(b), for sub-paragraph (ii) substitute—
(1) Section 1A of the Veterinary Surgeons Act 1966 (functions...
(1) Section 29E (evidence) is amended as follows.
In section 199 (bulk personal datasets: interpretation), for subsection (2)...
In section 202(4) (restriction on use of class BPD warrants),...
In section 206 (additional safeguards for health records), for subsection...
(1) Section 237 (information gateway) is amended as follows.
(1) Section 49 of the Police Services Ombudsman Act (Northern...
(1) Section 1 of the Health and Social Care (Control...
In section 306(1) of the Mental Capacity Act (Northern Ireland)...
The Justice Act (Northern Ireland) 2016 is amended as follows....
(1) Section 17 (disclosure of information) is amended as follows....
In section 44(3) (disclosure of information)— (a) in paragraph (a),...
(1) Section 35A (General Medical Council's power to require disclosure...
(1) Section 50 of the Policing and Crime Act 2017...
In Schedule 5 to the Children and Social Work Act...
The Higher Education and Research Act 2017 is amended as...
(1) Section 63 (cooperation and information sharing by the Office...
(1) Section 112 (cooperation and information sharing between the Office...
The Digital Economy Act 2017 is amended as follows.
(1) Section 40 (further provisions about disclosures under sections 35...
(1) Section 43 (codes of practice) is amended as follows....
(1) Section 49 (further provision about disclosures under section 48)...
(1) Section 52 (code of practice) is amended as follows....
In section 49B(7) (Directive 2005/36: designation of competent authority etc.),...
(1) Section 57 (further provision about disclosures under section 56)...
(1) Section 60 (code of practice) is amended as follows....
(1) Section 65 (supplementary provision about disclosures under section 64)...
(1) Section 70 (code of practice) is amended as follows....
Omit sections 108 to 110 (charges payable to the Information...
(1) Section 60 of the Landfill Disposals Tax (Wales) Act...
(1) Section 4 of the Additional Learning Needs and Educational...
(1) Section 204 of this Act (meaning of “health professional”...
In the table in the Schedule to the Estate Agents...
(1) Article 4 of the Channel Tunnel (International Arrangements) Order...
In section 55(1) (interpretation), omit the definition of “Directive 95/46/EC”....
The Access to Health Records (Northern Ireland) Order 1993 is...
In Article 4 (health professionals), for paragraph (1) substitute—
In Article 5(4)(a) (fees for access to health records), for...
In article 4 of the Channel Tunnel (Miscellaneous Provisions) Order...
The European Primary and Specialist Dental Qualifications Regulations 1998 are...
(1) Regulation 2(1) (interpretation) is amended as follows.
(1) The table in Schedule A1 (functions of the GDC...
For article 7 of the Scottish Parliamentary Corporate Body (Crown...
For article 9 of the Northern Ireland Assembly Commission (Crown...
The Data Protection (Corporate Finance Exemption) Order 2000 is revoked....
(1) Paragraph 9B of Schedule 1 (incidental powers of the...
The Data Protection (Conditions under Paragraph 3 of Part II...
The Data Protection (Functions of Designated Authority) Order 2000 is...
The Data Protection (International Co-operation) Order 2000 is revoked.
The Data Protection (Subject Access) (Fees and Miscellaneous Provisions) Regulations...
In the Consumer Credit (Credit Reference Agency) Regulations 2000, regulation...
The Data Protection (Subject Access Modification) (Health) Order 2000 is...
The Data Protection (Subject Access Modification) (Education) Order 2000 is...
The Data Protection (Subject Access Modification) (Social Work) Order 2000...
The Data Protection (Crown Appointments) Order 2000 is revoked.
The Data Protection (Processing of Sensitive Personal Data) Order 2000...
(1) Paragraph 5A of Schedule 4 (professional performance assessments and...
The Data Protection (Miscellaneous Subject Access Exemptions) Order 2000 is...
The Data Protection (Designated Codes of Practice) (No. 2) Order...
The Representation of the People (England and Wales) Regulations 2001...
In regulation 3(1) (interpretation), at the appropriate places insert— “Article...
In regulation 26(3)(a) (applications for registration), for “the Data Protection...
In regulation 26A(2)(a) (application for alteration of register in respect...
In regulation 32ZA(3)(f) (annual canvass), for “the Data Protection Act...
In regulation 61A (conditions on the use, supply and inspection...
(1) Regulation 92(2) (interpretation and application of Part VI etc)...
In regulation 96(2A)(b)(i) (restriction on use of the full register),...
(1) The table in Schedule 4A (functions of the General...
In regulation 97(5) and (6) (supply of free copy of...
In regulation 97A(7) and (8) (supply of free copy of...
In regulation 99(6) and (7) (supply of free copy of...
In regulation 109A(9) and (10) (supply of free copy of...
In regulation 119(2) (conditions on the use, supply and disclosure...
The Representation of the People (Scotland) Regulations 2001 are amended...
In regulation 3(1) (interpretation), at the appropriate places, insert— “Article...
In regulation 26(3)(a) (applications for registration), for “the Data Protection...
In regulation 26A(2)(a) (application for alteration of register in respect...
In regulation 32ZA(3)(f) (annual canvass), for “the Data Protection Act...
The Dentists Act 1984 is amended as follows.
In regulation 61(3) (records and lists kept under Schedule 4),...
In regulation 61A (conditions on the use, supply and inspection...
(1) Regulation 92(2) (interpretation of Part VI etc) is amended...
In regulation 95(3)(b)(i) (restriction on use of the full register),...
In regulation 96(5) and (6) (supply of free copy of...
In regulation 98(6) and (7) (supply of free copy of...
In regulation 108A(9) and (10) (supply of full register to...
In regulation 119(2) (conditions on the use, supply and disclosure...
(1) Article 9 of the Financial Services and Markets 2000...
The Nursing and Midwifery Order 2001 is amended as follows....
(1) Section 33B (the General Dental Council's power to require...
(1) Article 3 (the Nursing and Midwifery Council and its...
(1) Article 25 (the Council's power to require disclosure of...
In article 39B (European professional card), after paragraph (2) insert—...
In article 40(6) (Directive 2005/36/EC: designation of competent authority etc),...
(1) Schedule 2B (Directive 2005/36/EC: European professional card) is amended...
(1) The table in Schedule 3 (functions of the Council...
In Schedule 4 (interpretation), omit the definition of “Directive 95/46/EC”....
Regulation 3 of the Electronic Commerce (EC Directive) Regulations 2002...
In paragraph (1)(b) for “the Data Protection Directive and the...
In paragraph (3)— (a) omit the definitions of “Data Protection...
In section 36ZA(6) (Directive 2005/36: designation of competent authority etc),...
The Data Protection (Processing of Sensitive Personal Data) (Elected Representatives)...
The Privacy and Electronic Communications (EC Directive) Regulations 2003 are...
In regulation 2(1) (interpretation), in the definition of “the Information...
(1) Regulation 4 (relationship between these Regulations and the Data...
The Nationality, Immigration and Asylum Act 2002 (Juxtaposed Controls) Order...
In article 8(2) (exercise of powers by French officers in...
In article 11(4) (exercise of powers by UK immigration officers...
The Pupils' Educational Records (Scotland) Regulations 2003 are amended as...
(1) Regulation 2 (interpretation) is amended as follows.
(1) Regulation 6 (circumstances where information should not be disclosed)...
In section 11AA(1) of the Parliamentary Commissioner Act 1967 (disclosure...
(1) Section 36Y (the General Dental Council's power to require...
In regulation 9 (fees), for paragraph (1) substitute—
Schedule 1 to the European Parliamentary Elections (Northern Ireland) Regulations...
(1) Paragraph 74(1) (interpretation) is amended as follows.
In paragraph 77(2)(b) (conditions on the use, supply and disclosure...
In regulation 3(1) of the Freedom of Information and Data...
The Environmental Information Regulations 2004 are amended as follows.
(1) Regulation 2 (interpretation) is amended as follows.
(1) Regulation 13 (personal data) is amended as follows.
In regulation 14 (refusal to disclose information), in paragraph (3)(b),...
In regulation 18 (enforcement and appeal provisions), in paragraph (5),...
In section 53(1) (interpretation), omit the definition of “Directive 95/46/EC”....
The Environmental Information (Scotland) Regulations 2004 are amended as follows....
(1) Regulation 2 (interpretation) is amended as follows.
(1) Regulation 11 (personal data) is amended as follows.
(1) Regulation 7 of the Licensing Act 2003 (Personal Licences)...
The Education (Pupil Information) (England) Regulations 2005 are amended as...
In regulation 3(5) (meaning of educational record) for “section 1(1)...
(1) Regulation 5 (disclosure of curricular and educational records) is...
(1) Regulation 45 of the Civil Contingencies Act 2004 (Contingency...
In regulation 3 of the Register of Judgments, Orders and...
The Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005...
(1) The table in Schedule 4ZA (Directive 2005/36: functions of...
(1) Regulation 39 (sensitive information) is amended as follows.
The Data Protection (Processing of Sensitive Personal Data) Order 2006...
(1) Paragraph 14 of Schedule 1 to the National Assembly...
In regulation 3 of the Mental Capacity Act 2005 (Loss...
For article 5 of the National Assembly for Wales Commission...
In regulation 3 of the Mental Capacity Act 2005 (Loss...
(1) Regulation 18 of the Representation of the People (Absent...
In regulation 5 of the Representation of the People (Post-Local...
The Education (Pupil Records and Reporting) (Transitional) Regulations (Northern Ireland)...
In regulation 2 (interpretation), at the appropriate place insert— “the...
In section 449(11) of the Companies Act 1985 (provision for...
In regulation 10(2) (duties of Boards of Governors), for “documents...
In regulation 118 of the Representation of the People (Northern...
In paragraph 1(c) of the Schedule to the Companies Act...
The Controlled Drugs (Supervision of Management and Use) (Wales) Regulations...
In regulation 2(1) (interpretation)— (a) at the appropriate place in...
(1) Regulation 25 (duty to co-operate by disclosing information as...
(1) Regulation 26 (responsible bodies requesting additional information be disclosed...
(1) Regulation 29 (occurrence reports) is amended as follows.
(1) Regulation 5 of the Energy Order 2003 (Supply of...
(1) Paragraph 6 of Schedule 2 to the Companies (Disclosure...
In section 2(1) of the Access to Medical Reports Act...
(1) Paragraph 6 of Schedule 2 to the Overseas Companies...
The Data Protection (Processing of Sensitive Personal Data) Order 2009...
In regulation 25 of the Provision of Services Regulations 2009...
(1) Regulation 9 of the INSPIRE Regulations 2009 (public access...
(1) Regulation 10 of the INSPIRE (Scotland) Regulations 2009 (public...
The Controlled Drugs (Supervision of Management and Use) Regulations (Northern...
In regulation 2(2) (interpretation), at the appropriate place insert— “the...
(1) Regulation 25 (duty to co-operate by disclosing information as...
(1) Regulation 26 (responsible bodies requesting additional information be disclosed...
(1) Regulation 29 (occurrence reports) is amended as follows.
(1) Section 13B of the Opticians Act 1989 (the Council's...
The Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations...
The Pharmacy Order 2010 is amended as follows.
In article 3(1) (interpretation), omit the definition of “Directive 95/46/EC”....
(1) Article 9 (inspection and enforcement) is amended as follows....
In article 33A (European professional card), after paragraph (2) insert—...
(1) Article 49 (disclosure of information: general) is amended as...
(1) Article 55 (professional performance assessments) is amended as follows....
In article 67(6) (Directive 2005/36/EC: designation of competent authority etc.),...
(1) Schedule 2A (Directive 2005/36/EC: European professional card) is amended...
(1) The table in Schedule 3 (Directive 2005/36/EC: designation of...
The Access to Health Records Act 1990 is amended as...
The Data Protection (Monetary Penalties) Order 2010 is revoked.
The National Employment Savings Trust Order 2010 is amended as...
In article 2 (interpretation)— (a) omit the definition of “data”...
(1) Article 10 (disclosure of requested data to the Secretary...
(1) Schedule 3 to the Local Elections (Northern Ireland) Order...
(1) Regulation 5 of the Pupil Information (Wales) Regulations 2011...
In Schedule 4 to the Debt Arrangement Scheme (Scotland) Regulations...
The Police and Crime Commissioner Elections Order 2012 is amended...
(1) Schedule 2 (absent voting in Police and Crime Commissioner...
(1) Schedule 10 (access to marked registers and other documents...
For section 2 substitute— Health professionals In this Act, “health professional” has the same meaning as...
The Data Protection (Processing of Sensitive Personal Data) Order 2012...
Schedule 6 to the Neighbourhood Planning (Referendums) Regulations 2012 (registering...
(1) Paragraph 29(1) (interpretation of Part 8) is amended as...
In paragraph 32(3)(b)(i), for “section 11(3) of the Data Protection...
In paragraph 33(6) and (7) (supply of copy of business...
In paragraph 34(6) and (7) (supply of copy of business...
In paragraph 39(8) and (97) (supply of copy of business...
In paragraph 45(2) (conditions on the use, supply and disclosure...
(1) Regulation 20 of the Controlled Drugs (Supervision of Management...
(1) Article 3 of the Communications Act 2003 (Disclosure of...
(1) Section 3 (right of access to health records) is...
In the Criminal Justice and Data Protection (Protocol No. 36)...
The Data Protection (Assessment Notices) (Designation of National Health Service...
In regulation 6 of the Control of Explosives Precursors etc...
In regulation 3 of the Control of Poisons and Explosives...
(1) Paragraph 6 of Schedule 2 to the Companies (Disclosure...
The Small and Medium Sized Business (Credit Information) Regulations 2015...
(1) Regulation 12 (criteria for the designation of a credit...
(1) Regulation 15 (access to and correction of information for...
The European Union (Recognition of Professional Qualifications) Regulations 2015 are...
(1) Regulation 2(1) (interpretation) is amended as follows.
(1) Section 33D of the Human Fertilisation and Embryology Act...
In regulation 5(5) (functions of competent authorities in the United...
In regulation 45(3) (processing and access to data regarding the...
In regulation 46(1) (processing and access to data regarding the...
In regulation 48(2) (processing and access to data regarding the...
In regulation 66(3) (exchange of information), for “Directives 95/46/EC” substitute...
The Scottish Parliament (Elections etc) Order 2015 is amended as...
(1) Schedule 3 (absent voting) is amended as follows.
(1) Schedule 8 (access to marked registers and other documents...
In paragraph 1(3) of Schedule 3 to the Recall of...
Schedule 4 to the Register of People with Significant Control...
The Local Government Act 1974 is amended as follows.
(1) Section 251B of the Trade Union and Labour Relations...
(1) Paragraph 6 (disclosure to a credit reference agency) is...
In paragraph 12A (disclosure to a credit institution or a...
In Part 3 (interpretation), after paragraph 13 insert— In this Schedule, “data protection obligations”, in relation to a...
The Electronic Identification and Trust Services for Electronic Transactions Regulations...
In regulation 2(1) (interpretation), omit the definition of “the 1998...
In regulation 3(3) (supervision), omit “under the 1998 Act”.
For Schedule 2 substitute— SCHEDULE 2 Information Commissioner's enforcement powers...
The Court Files Privileged Access Rules (Northern Ireland) 2016 are...
In rule 5 (information that may released) for “Schedule 1...
In rule 7(2) (provision of information) for “Schedule 1 of...
In the table in Part 1 of Schedule 1 to...
The Money Laundering, Terrorist Financing and Transfer of Funds (Information...
In regulation 3(1) (interpretation), at the appropriate places insert— “the...
In regulation 16(8) (risk assessment by the Treasury and Home...
In regulation 17(9) (risk assessment by supervisory authorities), for “the...
For regulation 40(9)(c) (record keeping) substitute— (c) “data subject” has...
(1) Regulation 41 (data protection) is amended as follows.
(1) Regulation 84 (publication: the Financial Conduct Authority) is amended...
(1) Regulation 85 (publication: the Commissioners) is amended as follows....
For regulation 106(a) (general restrictions) substitute— (a) a disclosure in...
After paragraph 27 of Schedule 3 (relevant offences) insert— An offence under the Data Protection Act 2018, apart from...
(1) Article 90B of the Industrial Relations (Northern Ireland) Order...
(1) Paragraph 6 of Schedule 5 to the Scottish Partnerships...
In regulation 1(2) of the Data Protection (Charges and Information)...
The National Health Service (General Medical Services Contracts) (Scotland) Regulations...
(1) Regulation 1 (citation and commencement) is amended as follows....
In regulation 3(1) (interpretation)— (a) omit the definition of “the...
(1) Schedule 6 (other contractual terms) is amended as follows....
The National Health Service (Primary Medical Services Section 17C Agreements)...
(1) Regulation 1 (citation and commencement) is amended as follows....
In regulation 3(1) (interpretation)— (a) omit the definition of “the...
(1) Schedule 1 (content of agreements) is amended as follows....
In section 18A(1) of the Health Service Commissioners Act 1993...
(1) Unless the context otherwise requires, legislation described in sub-paragraph...
(1) References to a particular provision of, or made under,...
(1) References to personal data, and to the processing of...
Section 3(14) does not apply to this Schedule.
Provision inserted into subordinate legislation by this Schedule may be...
The Data Protection Act 1998 is repealed, with the exception...
In section 17A(4) of the Crime and Disorder Act 1998...
(1) Section 19 of the Food Standards Act 1999 (publication...
(1) Section 13 of the Immigration and Asylum Act 1999...
The Financial Services and Markets Act 2000 is amended as...
In section 86(9) (exempt offers to the public), for “the...
In section 33A(1) (disclosure of information by Local Commissioner to...
In section 391A(6)(b) (publication: special provisions relating to the capital...
In section 391C(7)(a) (publication: special provisions relating to the UCITS...
In section 391D(9)(a) (publication: special provisions relating to the markets...
In section 417 (definitions), at the appropriate place insert— “the...
In section 21F(2)(d) of the Terrorism Act 2000 (other permitted...
The Freedom of Information Act 2000 is amended as follows....
In section 2(3) (absolute exemptions), for paragraph (f) substitute—
In section 18 (the Information Commissioner), omit subsection (1).
(1) Section 40 (personal information) is amended as follows.
Omit section 49 (reports to be laid before Parliament).
In section 34O(1) (disclosure of information by Local Commissioner to...
For section 61 (appeal proceedings) substitute— Appeal proceedings (1) Tribunal Procedure Rules may make provision for regulating the...
In section 76(1) (disclosure of information between Commissioner and ombudsmen),...
After section 76A insert— Disclosure of information to Tribunal (1) No enactment or rule of law prohibiting or restricting...
In section 77(1)(b) (offence of altering etc records with intent...
In section 84 (interpretation), at the appropriate place insert— “the...
(1) Paragraph 28 of Schedule 19C to the Political Parties,...
The Public Finance and Accountability (Scotland) Act 2000 is amended...
In section 26B(3)(a) (voluntary disclosure of data to Audit Scotland),...
In section 26C(3)(a) (power to require disclosure of data), for...
In section 29(1) (interpretation), at the appropriate place insert— “the...
The Consumer Credit Act 1974 is amended as follows.
The Criminal Justice and Police Act 2001 is amended as...
In section 57(1) (retention of seized items)—
In section 65(7) (meaning of “legal privilege”)—
In Schedule 1 (powers of seizure)— (a) omit paragraph 65,...
The Anti-terrorism, Crime and Security Act 2001 is amended as...
(1) Section 19 (disclosure of information held by revenue departments)...
(1) Part 1 of Schedule 4 (extension of existing disclosure...
(1) Section 7A of the Health and Personal Social Services...
(1) Section 5A of the Justice (Northern Ireland) Act 2002...
The Proceeds of Crime Act 2002 is amended as follows....
In section 157(2A) (duty to disclose name etc of agency)—...
In section 333C(2)(d) (other permitted disclosures between institutions etc), for...
In section 436(3)(a) (disclosure of information to certain Directors), for...
In section 438(8)(a) (disclosure of information by certain Directors), for...
In section 439(3)(a) (disclosure of information to Lord Advocate and...
In section 441(7)(a) (disclosure of information by Lord Advocate and...
After section 442 insert— Data protection legislation In this Part, “the data protection legislation” has the same...
(1) Section 237 of the Enterprise Act 2002 (general restriction...
(1) In Schedule 5 to the Scottish Public Services Ombudsman...
The Freedom of Information (Scotland) Act 2002 is amended as...
In section 2(2)(e)(ii) (absolute exemptions), omit “by virtue of subsection...
In section 159(1)(a) (correction of wrong information) for “section 7...
(1) Section 38 (personal information) is amended as follows.
Schedule 5 to the Courts Act 2003 (collection of fines)...
(1) Paragraph 9C (disclosure of information in connection with making...
(1) Paragraph 10A (attachment of earnings orders (Justice Act (Northern...
(1) Section 94 of the Sexual Offences Act 2003 (Part...
The Criminal Justice Act 2003 is amended as follows.
In section 327A(9) (disclosure of information about convictions etc of...
In section 327B (disclosure of information about convictions etc of...
(1) Section 279 of the Mental Health (Care and Treatment)...
(1) Section 64C of the Public Audit (Wales) Act 2004...
(1) In this Schedule— “the 1984 Act” means the Data...
(1) In Schedule 18 to this Act, references to a...
In section 185 of this Act, references to a record...
In paragraph 20(2) of Schedule 2 to this Act (self-incrimination),...
Until the first regulations under section 24(8) of this Act...
(1) In relation to an automated processing system set up...
Nothing in this Schedule, read with the revocation of regulation...
Until the first regulations under section 94(4)(b) of this Act...
(1) The repeal of section 28(2) to (12) of the...
(1) This paragraph applies to a certificate issued under section...
(1) On and after the relevant day, the individual who...
(1) The repeal of sections 7 to 9A of the...
(1) The repeal of paragraph 10 of Schedule 5 to...
(1) The repeal of section 52(1) of the 1998 Act...
(1) The repeal of Schedule 5 to the 1998 Act...
Paragraph 10 of Schedule 12 to this Act applies only...
(1) The repeal of section 54(2) of the 1998 Act...
(1) The repeal of section 54(3) of the 1998 Act...
(1) The Data Protection (Charges and Information) Regulations 2018 (S.I....
(1) The repeal of section 42 of the 1998 Act...
(1) The repeal of section 52E of the 1998 Act...
(1) In this Part of this Schedule, references to contravention...
(1) The repeal of section 10 of the 1998 Act...
(1) The repeal of section 43 of the 1998 Act...
(1) The repeal of section 44 of the 1998 Act...
(1) The repeal of sections 41A and 41B of the...
(1) The repeal of sections 40 and 41 of the...
(1) The repeal of section 45 of the 1998 Act...
(1) The repeal of section 46 of the 1998 Act...
(1) The repeal of sections 47, 60 and 61 of...
(1) The repeal of sections 50, 60 and 61 of,...
(1) The repeal of sections 55A, 55B, 55D and 55E...
(1) The repeal of sections 48 and 49 of the...
(1) The repeal of section 11 of the 1998 Act...
(1) The repeal of section 28 of the 1998 Act...
(1) The repeal of paragraph 7 of Schedule 6 to...
(1) The repeal of paragraph 8 of Schedule 6 to...
(1) The references in the preceding paragraphs of this Part...
In section 143 of this Act— (a) the reference to...
In paragraph 16 of Schedule 15 to this Act (powers...
(1) Tribunal Procedure Rules made under paragraph 7(1)(a) of Schedule...
(1) The following provisions (as amended by Schedule 19 to...
(1) This paragraph applies in relation to the code of...
(1) This paragraph applies in relation to the original statement...
(1) The repeal of section 12 of the 1998 Act...
In section 159(1)(a) of the Consumer Credit Act 1974 (correction...
Paragraphs 52 to 55 make provision about the Freedom of...
(1) This paragraph applies where a request for information was...
(1) Tribunal Procedure Rules made under paragraph 7(1)(b) of Schedule...
(1) The repeal of paragraph 8 of Schedule 6 to...
(1) The amendment of section 77 of the 2000 Act...
(1) This paragraph applies where a request for information was...
Until the first regulations under Article 5(4)(a) of the Access...
(1) The repeal of a provision of the 1998 Act...
Part 3 of Schedule 19 to this Act (modifications) does...
(1) The repeal of section 13 of the 1998 Act...
(1) This paragraph applies where a request for information was...
(1) This paragraph applies where a request for information was...
(1) The repeal of section 14(1) to (3) and (6)...
The repeal of section 15 of the 1998 Act (jurisdiction...
(1) The repeal of Part 4 of the 1998 Act...
The applied GPDR
Part 3 (law enforcement processing): transfers approved by regulations
(1) The following are specified for the purposes of paragraph...
(1) In sections 74B and 76(A1)— (a) references to regulations...
Applied GDPR: power to make provision in consequence of GDPR regulations
Applied GDPR: national security certificates
Confidentiality of information
GDPR: maximum amount of penalties
GDPR: right to an effective remedy against the Commissioner
Merger of the directly applicable GDPR and the applied GDPR
(1) Anything done in connection with the EU GDPR as...
UK GDPR: transfers approved by regulations
(1) The following are specified for the purposes of paragraph...
(1) In the provisions listed in sub-paragraph (2)—
UK GDPR: transfers subject to appropriate safeguards provided by standard data protection clauses
(1) Paragraph 7 does not apply to the extent that...
UK GDPR: transfers subject to appropriate safeguards provided by binding corporate rules
Other sections — not classified into a Part
These sections sit outside the numbered Parts — usually provisions added or moved by later amendments.
Browse 1 other section
Processing in reliance on relevant international law
Official guidance
Authoritative sources published by regulators or government explaining this legislation.
- Sell veterinary medicines on the internet (opens in a new tab) from VMD Detailed Guidance
- The Gambling Commission’s betting integrity decision making framework (opens in a new tab) from Gambling Commission Detailed Guidance
- Betting Integrity Support for Major Sporting Events (opens in a new tab) from Gambling Commission Detailed Guidance
- Emerging money laundering and terrorist financing risks from June 2022 (opens in a new tab) from Gambling Commission Detailed Guidance
- Ensuring self-excluded customers do not receive marketing materials (opens in a new tab) from Gambling Commission Detailed Guidance
- Regulatory returns guidance - How we handle your data (opens in a new tab) from Gambling Commission Detailed Guidance
- Lottery submissions guidance - How we handle your data (opens in a new tab) from Gambling Commission Detailed Guidance
- LCCP Information requirements - LCCP notifications (other reportable events) (opens in a new tab) from Gambling Commission Detailed Guidance
- Employers' liability insurance guidance (opens in a new tab) from HSE Detailed Guidance
- CQC — register as a new provider (opens in a new tab) Detailed Guidance
- ... and 374 more
Enforcement and responsible bodies
The regulators that administer or enforce this legislation.
ICO
PrimaryInformation Commissioner's Office
Data protection, freedom of information, privacy and electronic communications regulation. Enforces UK GDPR and Data Protection Act 2018. Issues fines for breaches. …
Solicitors Regulation Authority
Regulates solicitors and law firms in England and Wales. Sets standards, authorises firms, investigates misconduct, and can impose sanctions including fines and …
Legal Services Board
Oversight regulator for legal services in England and Wales. Supervises approved regulators including SRA, Bar Standards Board, and CILEx. Ensures regulation serves …
Regulation and Quality Improvement Authority
Independent regulator for health and social care services in Northern Ireland. Registers and inspects hospitals, care homes, dental practices, and other care …
Government department responsible for protecting, expanding, and promoting the sustainable management of woodlands in England. Issues felling licences, administers woodland creation grants, …
Connected legislation
9 statutory instruments
These instruments amend, apply, or refer to this Act. They may not all create direct business obligations.
Secondary legislation (9)
- The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2022 2022
- The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024 2024
- The Data Protection Act 2018 (Commencement No. 2) Regulations 2019 2019
- The Data Protection Act 2018 (Commencement No. 3) Regulations 2019 2019
- The Data Protection Act 2018 (Transitional Provision) Regulations 2023 2023
- The Data Protection (Charges and Information) (Amendment) Regulations 2019 2019
- The Data Protection (Charges and Information) (Amendment) Regulations 2025 2025
- The Data Protection (Fundamental Rights and Freedoms) (Amendment) Regulations 2023 2023
- The Privacy and Electronic Communications (Amendment) Regulations 2018 2018
Explore more
Browse legislation
Find other UK business legislation with related guidance.
Regulators
Learn more about the bodies that enforce this legislation.