UK Statutory Instrument
2019
United Kingdom
The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019
These Regulations make amendments to legislation in relation to the regulation of the processing of personal data.
At a glance
What this Act requires
Sections that create concrete duties on businesses or carry penalties. Procedural and definitional sections are folded into the “Browse other sections” expander at the bottom of each group. Click any section title to read the source text on legislation.gov.uk.
Schedules
Browse 297 other Schedules — structural / supplementary
(1) Article 10 is amended as follows.
Chapter 3 (rights of the data subject)
(1) Article 13 is amended as follows.
(1) Article 14 is amended as follows.
In Article 15(1)(f), for “a supervisory authority” substitute “ the...
(1) Article 17 is amended as follows.
In Article 18(2), omit “of the Union or of a...
In Article 21(5)— (a) omit “and notwithstanding Directive 2002/58/EC ,”;...
(1) Article 22 is amended as follows.
(1) Article 23 is amended as follows.
In the title of the Regulation, for “, and repealing...
Chapter 4 (controller and processor)
(1) Article 27 is amended as follows.
(1) Article 28 is amended as follows.
In Article 29, for “Union or Member State law” substitute...
(1) Article 30 is amended as follows.
(1) Article 31 is amended as follows.
In Article 32(4), for “Union or Member State law” substitute...
(1) Article 33 is amended as follows.
In Article 34(4), for “the supervisory authority” substitute “ the...
(1) Article 35 is amended as follows.
Chapter 1 (general provisions)
(1) Article 36 is amended as follows.
(1) Article 37 is amended as follows.
In Article 38(5), for “Union or Member State law” substitute...
(1) Article 39 is amended as follows.
(1) Article 40 is amended as follows.
(1) Article 41 is amended as follows.
(1) Article 42 is amended as follows.
(1) Article 43 is amended as follows.
Chapter 5 (transfers of personal data to third countries or international organisations)
(1) Article 46 is amended as follows.
(1) Article 2 is amended as follows.
(1) Article 47 is amended as follows.
Omit Article 48.
(1) Article 49 is amended as follows.
In Article 50, for “the Commission and supervisory authorities” substitute...
Chapter 6 (independent supervisory authorities)
(1) Article 51 is amended as follows.
(1) Article 52 is amended as follows.
Omit Article 53.
Omit Article 54.
In the heading of section 2 of Chapter 6, for...
(1) Article 3 is amended as follows.
Omit Article 55.
Omit Article 56.
(1) Article 57 is amended as follows.
(1) Article 58 is amended as follows.
In Article 59— (a) for “Each supervisory authority” substitute “...
Chapter 7 (cooperation and consistency)
Chapter 8 (remedies, liability and penalties)
(1) Article 78 is amended as follows.
(1) Article 79 is amended as follows.
(1) Article 80 is amended as follows.
(1) Article 4 is amended as follows.
Omit Article 81.
In Article 82, omit paragraph 6.
(1) Article 83 is amended as follows.
In Article 84, for paragraphs 1 and 2 substitute— Part...
Chapter 9 (provisions relating to specific processing situations)
(1) Article 86 is amended as follows.
After Article 86 insert— Article 86A Processing and national security...
Omit Article 87.
Omit Article 88.
(1) Article 89 is amended as follows.
Chapter 2 (principles)
Omit Article 90.
Omit Article 91.
Chapter 10 (delegated acts and implementing acts)
Chapter 11 (final provisions)
(1) Article 95 is amended as follows.
(1) Article 96 is amended as follows.
Omit Article 97.
Omit Article 98.
Omit Article 99.
Omit the sentence following Article 99.
(1) Article 8 is amended as follows.
Supplementary
(1) Article 9 is amended as follows.
Introduction
(1) Section 7 is amended as follows.
(1) Schedule 19 is amended as follows.
(1) Schedule 20 is amended as follows.
After Schedule 20 insert— SCHEDULE 21 Further transitional provision etc Section...
In section 8, for “GDPR” substitute “ UK GDPR ”....
Omit section 9.
(1) Section 10 is amended as follows.
In section 11, in subsection (1) (in both places) and...
In section 12(1)(a) and (b), for “GDPR” substitute “ UK...
In section 13(2) and (3), for “GDPR” substitute “ UK...
(1) Section 14 is amended as follows.
For the italic heading before section 15 substitute “ Exemptions...
(1) Section 15 is amended as follows.
Part 1 (preliminary)
(1) Section 16 is amended as follows.
For the italic heading before section 17 substitute “ Certification...
(1) Section 17 is amended as follows.
Before section 18 (but after the italic heading before it)...
(1) Section 18 is amended as follows.
In section 19(2), for “GDPR” substitute “ UK GDPR ”....
In section 20— (a) for “this Chapter” (in both places)...
For the heading of Chapter 3 substitute “ Exemptions for...
For the italic heading before section 21 substitute “ Definitions...
(1) Section 21 is amended as follows.
In section 2(1) and (2), for “GDPR, the applied GDPR”...
Omit section 22 and the italic heading before it.
Omit section 23.
(1) Section 24 is amended as follows.
(1) Section 25 is amended as follows.
(1) Section 26 is amended as follows.
In section 27(5), for “the applied GDPR” substitute “ the...
(1) Section 28 is amended as follows.
Part 3 (law enforcement processing) (other than Schedules 7 and 8)
In section 48, omit subsection (8).
In section 67, omit subsection (8).
(1) Section 3 is amended as follows.
(1) Section 73 is amended as follows.
Omit section 74.
After section 74 insert— Transfers based on adequacy regulations (1) The Secretary of State may by regulations specify any...
In section 76(1)(c), omit “a member State or”.
Section 77(8), for “member States” substitute “ the United Kingdom...
(1) Section 78 is amended as follows.
(1) Section 80 is amended as follows.
Part 5 (Information Commissioner) (other than Schedules 12 to 14)
(1) Section 116 is amended as follows.
(1) Section 117 is amended as follows.
Part 2 (general processing) (other than Schedules 1 to 6)
(1) Section 118 is amended as follows.
After section 119 insert— Standard clauses for transfers to third...
(1) Section 120 is amended as follows.
In section 123(7), for “GDPR” (in both places) substitute “...
In section 129(1), for “GDPR” substitute “ UK GDPR ”....
In section 132(2), omit paragraph (d).
In section 135(4), for “GDPR” substitute “ UK GDPR ”....
In section 136(1)(b), for “GDPR” substitute “ UK GDPR ”....
In section 139(2), for “GDPR” substitute “ UK GDPR ”....
Part 6 (enforcement) (other than Schedules 15 to 17)
(1) Section 5 is amended as follows.
In section 143(9), for “GDPR” substitute “ UK GDPR ”....
In section 149(2)(a), (b), (c) and (e), (3) and (4)(b)...
In section 151(1)(b) and (8)(a), for “GDPR” substitute “ UK...
In section 155(2)(a), for “GDPR” (in both places) substitute “...
(1) Section 157 is amended as follows.
In section 159(1) and (2), for “GDPR” substitute “ UK...
(1) Section 165 is amended as follows.
In section 166(1), for “GDPR” substitute “ UK GDPR ”....
In section 167(4), for “GDPR” substitute “ UK GDPR ”....
(1) Section 168 is amended as follows.
For the heading of Chapter 2 substitute “ The UK...
In section 169(1), for “GDPR” substitute “ UK GDPR ”....
In section 170(7), for “GDPR” substitute “ UK GDPR ”....
In section 171(8)(a), for “GDPR” substitute “ UK GDPR ”....
In section 173(2)(a) and (b), for “GDPR” substitute “ UK...
In section 174(2)(a) and (b), for “GDPR” substitute “ UK...
In section 180(2)(d) and (e), for “GDPR” substitute “ UK...
In section 181, in the definition of “representative”, for “GDPR”...
Part 7 (supplementary and final provision) (other than Schedules 18 to 20)
(1) Section 183 is amended as follows.
In section 185(4)(a) and (b), for “GDPR” substitute “ UK...
In the italic heading before section 6, for “GDPR” substitute...
(1) Section 186 is amended as follows.
(1) Section 187 is amended as follows.
In section 188(2), for “GDPR” substitute “ UK GDPR ”....
(1) Section 189 is amended as follows.
In section 190(1), for “GDPR” (in each place) substitute “...
(1) Section 205 is amended as follows.
(1) The Table in section 206 is amended as follows....
(1) Section 207 is amended as follows.
In section 209(2), (3) and (4), for “GDPR” substitute “...
In section 210(2) and (3), for “GDPR” substitute “ UK...
In section 6(1) and (2), for “GDPR” substitute “ UK...
(1) Section 213 is amended as follows.
Schedules
(1) Schedule 2 is amended as follows.
(1) Schedule 3 is amended as follows.
(1) Schedule 4 is amended as follows.
In Schedule 5, in the following provisions, for “national accreditation...
Omit Schedule 6.
(1) Schedule 13 is amended as follows.
In Schedule 14, omit Part 1.
(1) Schedule 18 is amended as follows.
Revocation of Regulations and Decisions
(1) Section 35A (General Medical Council's power to require disclosure...
In Schedule 8 (access to marked registers and other documents...
Electronic Identification and Trust Services for Electronic Transactions Regulations 2016
Court Files Privileged Access Rules (Northern Ireland) 2016
In rule 2 (interpretation), at the appropriate place insert— “the...
In rule 5(a) (information that may be released), for “GDPR”...
In rule 7(2)(a) (provision of information), for “GDPR” substitute “...
Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017
In regulation 3(1) (interpretation)— (a) omit the words from “...
In regulation 16(8)(b) (risk assessment by the Treasury and Home...
In regulation 17(9)(b) (risk assessment by supervisory authorities), for “GDPR”...
In section 55(1) (interpretation), at the appropriate place insert— “the...
In regulation 41 (data protection), in paragraphs (3)(a), (6), (7),...
References to the GDPR
Interpretation of references to enactments
In paragraph 9B of Schedule 1 (incidental powers of the...
In paragraph 5A of Schedule 4 (professional performance assessments and...
Dentists Act 1984
(1) Section 33B (the General Dental Council's power to require...
(1) Section 36Y (the General Dental Council's power to require...
In section 53(1) (interpretation), at the appropriate place insert— “the...
Opticians Act 1989
Immigration and Asylum Act 1999
Revocation of provisions of EEA agreement
Freedom of Information Act 2000
Health and Personal Social Services Act (Northern Ireland) 2001
Freedom of Information (Scotland) Act 2002
Mental Health (Care and Treatment) (Scotland) Act 2003
Crime and Courts Act 2013
Small Business, Enterprise and Employment Act 2015
Social Security (Scotland) Act 2018
Channel Tunnel (International Arrangements) Order 1993
Channel Tunnel (Miscellaneous Provisions) Order 1994
Scottish Parliamentary Corporate Body (Crown Status) Order 1999
Consumer Credit Act 1974
Northern Ireland Assembly Commission (Crown Status) Order 1999
Representation of the People (England and Wales) Regulations 2001
(1) Regulation 3(1) (interpretation) is amended as follows.
In regulation 92(2)(ba) (interpretation and application of Part VI etc),...
Representation of the People (Scotland) Regulations 2001
(1) Regulation 3(1) (interpretation) is amended as follows.
In regulation 92(2)(ba) (interpretation of Part VI etc), for “the...
Financial Services and Markets Act 2000 (Disclosure of Confidential Information) Regulations 2001
Nursing and Midwifery Order 2001
(1) Article 3 (the Nursing and Midwifery Council and its...
In section 157(2A)(a) (duty to disclose name etc of agency),...
(1) Article 25 (the Council's power to require disclosure of...
In article 40(6) (Directive 2005/36/EC: designation of competent authority etc),...
In Schedule 4 (interpretation), at the appropriate place insert— “the...
Electronic Commerce (EC Directive) Regulations 2002
Privacy and Electronic Communications (EC Directive) Regulations 2003
Nationality, Immigration and Asylum Act 2002 (Juxtaposed Controls) Order 2003
(1) Article 8 (exercise of powers by French officers in...
(1) Article 11 (exercise of powers by UK immigration officers...
Pupils' Educational Records (Scotland) Regulations 2003
In regulation 2 (interpretation)— (a) omit the definition of “the...
In section 159(1)(a) (correction of wrong information), for “GDPR” substitute...
In regulation 6(aa) and (ab) (circumstances where information should not...
In regulation 9(1A) (in both places) and (1B), for “GDPR”...
Environmental Information Regulations 2004
(1) Regulation 2 (interpretation) is amended as follows.
In regulation 13 (personal data), in paragraphs (2B)(a), (3A)(a), (5B)(b)...
Environmental Information (Scotland) Regulations 2004
(1) Regulation 2 (interpretation) is amended as follows.
In regulation 11 (personal data), in paragraphs (3B), (4A)(a) and...
Licensing Act 2003 (Personal Licences) Regulations 2005
Education (Pupil Information) (England) Regulations 2005
In section 189(1) (definitions)— (a) omit the definition of “the...
Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005
Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005
Register of Judgments, Orders and Fines Regulations 2005
National Assembly for Wales (Representation of the People) Order 2007
National Assembly for Wales Commission (Crown Status) Order 2007
Representation of the People (Absent Voting at Local Elections) (Scotland) Regulations 2007
Representation of the People (Post-Local Government Elections Supply and Inspection of Documents) (Scotland) Regulations 2007
Education (Pupil Records and Reporting) (Transitional) Regulations (Northern Ireland) 2007
In regulation 2 (interpretation)— (a) omit the definition of “the...
In regulation 10(2) (duties of Boards of Governors), for “GDPR”...
Pharmacy (Northern Ireland) Order 1976
Representation of the People (Northern Ireland) Regulations 2008
Controlled Drugs (Supervision of Management and Use) (Wales) Regulations 2008
(1) Regulation 2(1) (interpretation) is amended as follows.
In regulation 25(7) (duty to co-operate by disclosing information as...
In regulation 26(6) (responsible bodies requesting additional information be disclosed...
In regulation 29(3) (occurrence reports) — (a) in the English...
Energy Order 2003 (Supply of Information) Regulations (Northern Ireland) 2008
INSPIRE Regulations 2009
INSPIRE (Scotland) Regulations 2009
Controlled Drugs (Supervision of Management and Use) Regulations (Northern Ireland) 2009
Medical Act 1983
In regulation 2(2) (interpretation)— (a) omit the words from “...
In regulation 25(7) (duty to co-operate by disclosing information as...
In regulation 26(6) (responsible bodies requesting additional information be disclosed...
In regulation 29(3) (occurrence reports), for “GDPR” substitute “ UK...
Pharmacy Order 2010
In article 3(1) (interpretation), at the appropriate place insert— “the...
In article 9(5) (inspection and enforcement), for “and references to...
(1) Article 49 (disclosure of information: general) is amended as...
(1) Article 55 (professional performance assessments) is amended as follows....
Local Elections (Northern Ireland) Order 2010
(1) Section 29E (evidence) is amended as follows.
Pupil Information (Wales) Regulations 2011
(1) In paragraph (5)(a) and (b) —
Police and Crime Commissioner Elections Order 2012
(1) Schedule 2 (absent voting in Police and Crime Commissioner...
(1) Schedule 10 (access to marked registers and other documents...
Neighbourhood Planning (Referendums) Regulations 2012
Controlled Drugs (Supervision of Management and Use) Regulations 2013
Small and Medium Sized Business (Credit Information) Regulations 2015
Scottish Parliament (Elections etc) Order 2015
(1) Schedule 3 (absent voting) is amended as follows.
Anti-terrorism, Crime and Security Act 2001
Investigatory Powers Act 2016
Data Protection Act 2018
Browse 8 other sections — procedural / definitional / commencement
Citation, commencement and extent
Interpretation
Amendment of the UK GDPR
Amendment of the Data Protection Act 2018
GDPR merger modifications
Consequential amendments of other legislation
Amendments consequential on provisions of the 2018 Act
Amendment of the Privacy and Electronic Communications Regulations 2003
Enforcement and responsible bodies
The regulators that administer or enforce this legislation.
ICO
PrimaryInformation Commissioner's Office
Data protection, freedom of information, privacy and electronic communications regulation. Enforces UK GDPR and Data Protection Act 2018. Issues fines for breaches. …
General Pharmaceutical Council
Statutory regulator for pharmacists, pharmacy technicians, and pharmacy premises in Great Britain. Sets standards for pharmacy education, ethics, and practice. Inspects registered …
Explore more
Browse legislation
Find other UK business legislation with related guidance.
Regulators
Learn more about the bodies that enforce this legislation.