- Latest available (Revised)
- Original (As enacted)
Data Protection Act 2018, CHAPTER 2 is up to date with all changes known to be in force on or before 31 August 2024. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations.
Revised legislation carried on this site may not be fully up to date. Changes and effects are recorded by our editorial team in lists which can be found in the ‘Changes to Legislation’ area. Where those effects have yet to be applied to the text of the legislation by the editorial team they are also listed alongside the legislation in the affected provisions. Use the ‘more’ link to open the changes and effects relevant to the provision you are viewing.
Whole provisions yet to be inserted into this Act (including any effects on those provisions):
Textual Amendments
F1Pt. 2 Ch. 2 heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 7 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
Textual Amendments
F2Words in s. 6 cross-heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 8 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
(1)The definition of “controller” in Article 4(7) of the [F3UK GDPR] has effect subject to—
(a)subsection (2),
(b)section 209, and
(c)section 210.
(2)For the purposes of the [F4UK GDPR], where personal data is processed only—
(a)for purposes for which it is required by an enactment to be processed, and
(b)by means by which it is required by an enactment to be processed,
the person on whom the obligation to process the data is imposed by the enactment (or, if different, one of the enactments) is the controller.
Textual Amendments
F3Words in s. 6(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 9 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F4Words in s. 6(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 9 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
(1)For the purposes of the [F5UK GDPR], the following (and only the following) are “public authorities” and “public bodies” F6...—
(a)a public authority as defined by the Freedom of Information Act 2000,
(b)a Scottish public authority as defined by the Freedom of Information (Scotland) Act 2002 (asp 13),
[F7(ba)the Advanced Research and Invention Agency,] and
(c)an authority or body specified or described by the Secretary of State in regulations,
subject to subsections (2), (3) and (4).
(2)An authority or body that falls within subsection (1) is only a “public authority” or “public body” for the purposes of the [F8UK GDPR] when performing a task carried out in the public interest or in the exercise of official authority vested in it.
(3)The references in subsection (1)(a) and (b) to public authorities and Scottish public authorities as defined by the Freedom of Information Act 2000 and the Freedom of Information (Scotland) Act 2002 (asp 13) do not include any of the following that fall within those definitions—
(a)a parish council in England;
(b)a community council in Wales;
(c)a community council in Scotland;
(d)a parish meeting constituted under section 13 of the Local Government Act 1972;
(e)a community meeting constituted under section 27 of that Act;
(f)charter trustees constituted—
(i)under section 246 of that Act,
(ii)under Part 1 of the Local Government and Public Involvement in Health Act 2007, or
(iii)by the Charter Trustees Regulations 1996 (S.I. 1996/263).
(4)The Secretary of State may by regulations provide that a person specified or described in the regulations that is a public authority [F9described or mentioned in subsection (1)(a), (b) or (ba)] is not a “public authority” or “public body” for the purposes of the [F10UK GDPR].
(5)Regulations under this section are subject to the affirmative resolution procedure.
Textual Amendments
F5Words in s. 7(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 10(2)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F6Words in s. 7(1) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 10(2)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F7S. 7(1)(ba) inserted (25.1.2023) by Advanced Research and Invention Agency Act 2022 (c. 4), s. 13(1), Sch. 3 para. 14(a); S.I. 2023/58, reg. 2
F8Words in s. 7(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 10(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F9Words in s. 7(4) substituted (25.1.2023) by Advanced Research and Invention Agency Act 2022 (c. 4), s. 13(1), Sch. 3 para. 14(b); S.I. 2023/58, reg. 2
F10Words in s. 7(4) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 10(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
Commencement Information
I1S. 7 in force at Royal Assent for specified purposes, see s. 212(2)(f)
In Article 6(1) of the [F11UK GDPR] (lawfulness of processing), the reference in point (e) to processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of the controller's official authority includes processing of personal data that is necessary for—
(a)the administration of justice,
(b)the exercise of a function of either House of Parliament,
(c)the exercise of a function conferred on a person by an enactment or rule of law,
(d)the exercise of a function of the Crown, a Minister of the Crown or a government department, or
(e)an activity that supports or promotes democratic engagement.
Textual Amendments
F11Words in s. 8 substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 11 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Textual Amendments
F12S. 9 omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 12 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
(1)Subsections (2) and (3) make provision about the processing of personal data described in Article 9(1) of the [F13UK GDPR] (prohibition on processing of special categories of personal data) in reliance on an exception in one of the following points of Article 9(2)—
(a)point (b) (employment, social security and social protection);
(b)point (g) (substantial public interest);
(c)point (h) (health and social care);
(d)point (i) (public health);
(e)point (j) (archiving, research and statistics).
(2)The processing meets the requirement in point (b), (h), (i) or (j) of Article 9(2) of the [F14UK GDPR] for authorisation by, or a basis in, the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 1 of Schedule 1.
(3)The processing meets the requirement in point (g) of Article 9(2) of the [F15UK GDPR] for a basis in the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 2 of Schedule 1.
(4)Subsection (5) makes provision about the processing of personal data relating to criminal convictions and offences or related security measures that is not carried out under the control of official authority.
(5)The processing meets the requirement in Article [F1610(1) of the UK GDPR] for authorisation by the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 1, 2 or 3 of Schedule 1.
(6)The Secretary of State may by regulations—
(a)amend Schedule 1—
(i)by adding or varying conditions or safeguards, and
(ii)by omitting conditions or safeguards added by regulations under this section, and
(b)consequentially amend this section.
(7)Regulations under this section are subject to the affirmative resolution procedure.
Textual Amendments
F13Words in s. 10(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 13(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F14Words in s. 10(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 13(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F15Words in s. 10(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 13(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F16Words in s. 10(5) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 13(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
Commencement Information
I2S. 10 in force at Royal Assent for specified purposes, see s. 212(2)(f)
(1)For the purposes of Article 9(2)(h) of the [F17UK GDPR] (processing for health or social care purposes etc), the circumstances in which the processing of personal data is carried out subject to the conditions and safeguards referred to in Article 9(3) of the [F17UK GDPR] (obligation of secrecy) include circumstances in which it is carried out—
(a)by or under the responsibility of a health professional or a social work professional, or
(b)by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law.
(2)In Article 10 of the [F18UK GDPR] and section 10, references to personal data relating to criminal convictions and offences or related security measures include personal data relating to—
(a)the alleged commission of offences by the data subject, or
(b)proceedings for an offence committed or alleged to have been committed by the data subject or the disposal of such proceedings, including sentencing.
Textual Amendments
F17Words in s. 11(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 14 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F18Words in s. 11(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 14 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
(1)The Secretary of State may by regulations specify limits on the fees that a controller may charge in reliance on—
(a)Article 12(5) of the [F19UK GDPR] (reasonable fees when responding to manifestly unfounded or excessive requests), or
(b)Article 15(3) of the [F20UK GDPR] (reasonable fees for provision of further copies).
(2)The Secretary of State may by regulations—
(a)require controllers of a description specified in the regulations to produce and publish guidance about the fees that they charge in reliance on those provisions, and
(b)specify what the guidance must include.
(3)Regulations under this section are subject to the negative resolution procedure.
Textual Amendments
F19Words in s. 12(1)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 15 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F20Words in s. 12(1)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 15 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
Commencement Information
I3S. 12 in force at Royal Assent for specified purposes, see s. 212(2)(f)
(1)This section applies where a controller is a credit reference agency (within the meaning of section 145(8) of the Consumer Credit Act 1974).
(2)The controller's obligations under Article 15(1) to (3) of the [F21UK GDPR] (confirmation of processing, access to data and safeguards for third country transfers) are taken to apply only to personal data relating to the data subject's financial standing, unless the data subject has indicated a contrary intention.
(3)Where the controller discloses personal data in pursuance of Article 15(1) to (3) of the [F22UK GDPR], the disclosure must be accompanied by a statement informing the data subject of the data subject's rights under section 159 of the Consumer Credit Act 1974 (correction of wrong information).
Textual Amendments
F21Words in s. 13(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 16 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F22Words in s. 13(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 16 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
(1)This section makes provision for the purposes of Article 22(2)(b) of the [F23UK GDPR] (exception from Article 22(1) of the [F23UK GDPR] for significant decisions based solely on automated processing that are [F24required or authorised under the law of the United Kingdom or a part of the United Kingdom] and subject to safeguards for the data subject's rights, freedoms and legitimate interests).
(2)A decision is a “significant decision” for the purposes of this section if, in relation to a data subject, it—
(a)produces legal effects concerning the data subject, or
(b)similarly significantly affects the data subject.
(3)A decision is a “qualifying significant decision” for the purposes of this section if—
(a)it is a significant decision in relation to a data subject,
(b)it is required or authorised by law, and
(c)it does not fall within Article 22(2)(a) or (c) of the [F25UK GDPR] (decisions necessary to a contract or made with the data subject's consent).
(4)Where a controller takes a qualifying significant decision in relation to a data subject based solely on automated processing—
(a)the controller must, as soon as reasonably practicable, notify the data subject in writing that a decision has been taken based solely on automated processing, and
(b)the data subject may, before the end of the period of 1 month beginning with receipt of the notification, request the controller to—
(i)reconsider the decision, or
(ii)take a new decision that is not based solely on automated processing.
(5)If a request is made to a controller under subsection (4), the controller must, within the period described in Article 12(3) of the [F26UK GDPR]—
(a)consider the request, including any information provided by the data subject that is relevant to it,
(b)comply with the request, and
(c)by notice in writing inform the data subject of—
(i)the steps taken to comply with the request, and
(ii)the outcome of complying with the request.
(6)In connection with this section, a controller has the powers and obligations under Article 12 of the [F27UK GDPR] (transparency, procedure for extending time for acting on request, fees, manifestly unfounded or excessive requests etc) that apply in connection with Article 22 of the [F27UK GDPR].
(7)The Secretary of State may by regulations make such further provision as the Secretary of State considers appropriate to provide suitable measures to safeguard a data subject's rights, freedoms and legitimate interests in connection with the taking of qualifying significant decisions based solely on automated processing.
(8)Regulations under subsection (7)—
(a)may amend this section, and
(b)are subject to the affirmative resolution procedure.
Textual Amendments
F23Words in s. 14(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 17(2)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F24Words in s. 14(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 17(2)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F25Words in s. 14(3)(c) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 17(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F26Words in s. 14(5) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 17(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F27Words in s. 14(6) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 17(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
Commencement Information
I4S. 14 in force at Royal Assent for specified purposes, see s. 212(2)(f)
Textual Amendments
F28 S. 15 cross-heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 18 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
(1)Schedules 2, 3 and 4 make provision for exemptions from, and restrictions and adaptations of the application of, rules of the [F29UK GDPR].
(2)In Schedule 2—
(a)Part 1 makes provision adapting or restricting the application of rules contained in Articles 13 to 21 and 34 of the [F30UK GDPR] in specified circumstances [F31(of a kind described in] Article 6(3) and Article 23(1) of the [F32UK GDPR)];
(b)Part 2 makes provision restricting the application of rules contained in Articles 13 to 21 and 34 of the [F33UK GDPR] in specified circumstances [F34(of a kind described in] Article 23(1) of the [F35UK GDPR)];
(c)Part 3 makes provision restricting the application of Article 15 of the [F36UK GDPR] where this is necessary to protect the rights of others [F37(of a kind described in] Article 23(1) of the [F38UK GDPR)];
(d)Part 4 makes provision restricting the application of rules contained in Articles 13 to 15 of the [F39UK GDPR] in specified circumstances [F40(of a kind described in] Article 23(1) of the [F41UK GDPR)];
(e)Part 5 makes provision containing exemptions or derogations from Chapters II, III, IV [F42and V of the UK GDPR] for reasons relating to freedom of expression [F43(of a kind described in Article 85(2) of the UK GDPR)];
(f)Part 6 makes provision containing derogations from rights contained in Articles 15, 16, 18, 19, 20 and 21 of the [F44UK GDPR] for scientific or historical research purposes, statistical purposes and archiving purposes F45....
(3)Schedule 3 makes provision restricting the application of rules contained in Articles 13 to 21 of the [F46UK GDPR] to health, social work, education and child abuse data [F47(of a kind described in] Article 23(1) of the [F48UK GDPR)].
(4)Schedule 4 makes provision restricting the application of rules contained in Articles 13 to 21 of the [F49UK GDPR] to information the disclosure of which is prohibited or restricted by an enactment [F50(of a kind described in] Article 23(1) of the [F51UK GDPR)].
[F52(4A)In connection with the manual unstructured processing of personal data held by an FOI public authority, see Chapter 3 of this Part (sections 21, 24 and 25).]
(5)In connection with the safeguarding of national security and with defence, see Chapter 3 of this Part [F53(sections 26 to 28)].
Textual Amendments
F29Words in s. 15(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F30Words in s. 15(2)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(3)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F31Words in s. 15(2)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(3)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F32Words in s. 15(2)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(3)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F33Words in s. 15(2)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(4)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F34Words in s. 15(2)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(4)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F35Words in s. 15(2)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(4)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F36Words in s. 15(2)(c) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(5)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F37Words in s. 15(2)(c) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(5)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F38Words in s. 15(2)(c) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(5)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F39Words in s. 15(2)(d) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(6)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F40Words in s. 15(2)(d) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(6)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F41Words in s. 15(2)(d) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(6)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F42Words in s. 15(2)(e) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(7)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F43Words in s. 15(2)(e) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(7)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F44Words in s. 15(2)(f) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(8)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F45Words in s. 15(2)(f) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(8)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F46Words in s. 15(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(9)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F47Words in s. 15(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(9)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F48Words in s. 15(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(9)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F49Words in s. 15(4) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(10)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F50Words in s. 15(4) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(10)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F51Words in s. 15(4) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(10)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F52S. 15(4A) inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(11) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F53Words in s. 15(5) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 19(12) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
(1)The following powers to make provision altering the application of the [F54UK GDPR] may be exercised by way of regulations made by the Secretary of State under this section—
(a)the power in Article 6(3) F55... to lay down a legal basis containing specific provisions to adapt the application of rules of the [F56UK GDPR] where processing is necessary for compliance with a legal obligation, for the performance of a task in the public interest or in the exercise of official authority;
(b)the power in Article 23(1) to make [F57provision] restricting the scope of the obligations and rights mentioned in that Article where necessary and proportionate to safeguard certain objectives of general public interest;
(c)the power in Article 85(2) to provide for exemptions or derogations from certain Chapters of the [F58UK GDPR] where necessary to reconcile the protection of personal data with the freedom of expression and information.
(2)Regulations under this section may—
(a)amend Schedules 2 to 4—
(i)by adding or varying provisions, and
(ii)by omitting provisions added by regulations under this section, F59...
(b)consequentially amend section 15 [F60, and
(c)consequentially amend the UK GDPR by adding, varying or omitting a reference to section 15, Schedule 2, 3 or 4, this section or regulations under this section.]
(3)Regulations under this section are subject to the affirmative resolution procedure.
Textual Amendments
F54Words in s. 16(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 20(2)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F55Words in s. 16(1)(a) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 20(2)(b)(i) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F56Words in s. 16(1)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 20(2)(b)(ii) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F57Word in s. 16(1)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 20(2)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F58Words in s. 16(1)(c) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 20(2)(d) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F59Word in s. 16(2)(a)(ii) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 20(3)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F60S. 16(2)(c) and word inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 20(3)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
Commencement Information
I5S. 16 in force at Royal Assent for specified purposes, see s. 212(2)(f)
Textual Amendments
F61S. 17 cross-heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 21 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
(1)Accreditation of a person as a certification provider is only valid when carried out by—
(a)the Commissioner, or
(b)the [F62UK national accreditation body].
(2)The Commissioner may only accredit a person as a certification provider where the Commissioner—
(a)has published a statement that the Commissioner will carry out such accreditation, and
(b)has not published a notice withdrawing that statement.
(3)The [F63UK national accreditation body] may only accredit a person as a certification provider where the Commissioner—
(a)has published a statement that the body may carry out such accreditation, and
(b)has not published a notice withdrawing that statement.
(4)The publication of a notice under subsection (2)(b) or (3)(b) does not affect the validity of any accreditation carried out before its publication.
(5)Schedule 5 makes provision about reviews of, and appeals from, a decision relating to accreditation of a person as a certification provider.
(6)The [F64UK national accreditation body] may charge a reasonable fee in connection with, or incidental to, the carrying out of the body's functions under this section, Schedule 5 and Article 43 of the [F65UK GDPR].
(7)The [F66UK national accreditation body] must provide the Secretary of State with such information relating to its functions under this section, Schedule 5 and Article 43 of the [F67UK GDPR] as the Secretary of State may reasonably require.
(8)In this section—
“certification provider” means a person who issues certification for the purposes of Article 42 of the [F68UK GDPR];
“the [F69UK national accreditation body]” means the [F69UK national accreditation body] for the purposes of Article 4(1) of Regulation (EC) No 765/2008 of the European Parliament and of the Council of 9 July 2008 setting out the requirements for accreditation and market surveillance relating to the marketing of products and repealing Regulation (EEC) No 339/93.
Textual Amendments
F62Words in s. 17(1)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 22(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F63Words in s. 17(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 22(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F64Words in s. 17(6) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 22(4)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F65Words in s. 17(6) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 22(4)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F66Words in s. 17(7) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 22(5)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F67Words in s. 17(7) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 22(5)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F68Words in s. 17(8) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 22(6)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F69Words in s. 17(8) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 22(6)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
(1)The Secretary of State may by regulations specify any of the following which the Secretary of State considers ensures an adequate level of protection of personal data—
(a)a third country,
(b)a territory or one or more sectors within a third country,
(c)an international organisation, or
(d)a description of such a country, territory, sector or organisation.
(2)For the purposes of the UK GDPR and this Part of this Act, a transfer of personal data to a third country or an international organisation is based on adequacy regulations if, at the time of the transfer, regulations made under this section are in force which specify, or specify a description which includes—
(a)in the case of a third country, the country or a relevant territory or sector within the country, or
(b)in the case of an international organisation, the organisation.
(3)Regulations under this section may specify that the Secretary of State considers that an adequate level of protection of personal data is ensured only for a transfer specified or described in the regulations and, if they do so, only such a transfer may rely on those regulations for the purposes of subsection (2).
(4)Article 45(2) of the UK GDPR makes provision about the assessment of the adequacy of the level of protection for the purposes of this section and section 17B.
(5)Regulations under this section—
(a)where they relate to a third country, must specify their territorial and sectoral application;
(b)where applicable, must specify the independent supervisory authority or authorities referred to in Article 45(2)(b) of the UK GDPR.
(6)Regulations under this section may, among other things—
(a)provide that in relation to a country, territory, sector, organisation or transfer specified, or falling within a description specified, in the regulations, section 17B(1) has effect as if it required the reviews described there to be carried out at such shorter intervals as are specified in the regulations;
(b)identify a transfer of personal data by any means, including by reference to the controller or processor, the recipient, the personal data transferred or the means by which the transfer is made or by reference to relevant legislation, lists or other documents, as they have effect from time to time;
(c)confer a discretion on a person.
(7)Regulations under this section are subject to the negative resolution procedure.]
Textual Amendments
F70Ss. 17A-17C inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 23 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
(1)For so long as regulations under section 17A are in force which specify, or specify a description which includes, a third country, a territory or sector within a third country or an international organisation, the Secretary of State must carry out a review of whether the country, territory, sector or organisation ensures an adequate level of protection of personal data at intervals of not more than 4 years.
(2)Each review under subsection (1) must take into account all relevant developments in the third country or international organisation.
(3)The Secretary of State must, on an ongoing basis, monitor developments in third countries and international organisations that could affect decisions to make regulations under section 17A or to amend or revoke such regulations.
(4)Where the Secretary of State becomes aware that a country, territory, sector or organisation specified, or falling within a description specified, in regulations under section 17A no longer ensures an adequate level of protection of personal data, whether as a result of a review under this section or otherwise, the Secretary of State must, to the extent necessary, amend or revoke the regulations.
(5)Where regulations under section 17A are amended or revoked in accordance with subsection (4), the Secretary of State must enter into consultations with the third country or international organisation concerned with a view to remedying the lack of an adequate level of protection.
(6)The Secretary of State must publish—
(a)a list of the third countries, territories and specified sectors within a third country and international organisations, and the descriptions of such countries, territories, sectors and organisations, which are for the time being specified in regulations under section 17A, and
(b)a list of the third countries, territories and specified sectors within a third country and international organisations, and the descriptions of such countries, territories, sectors and organisations, which have been but are no longer specified in such regulations.
(7)In the case of regulations under section 17A which specify that an adequate level of protection of personal data is ensured only for a transfer specified or described in the regulations—
(a)the duty under subsection (1) is only to carry out a review of the level of protection ensured for such a transfer, and
(b)the lists published under subsection (6) must specify or describe the relevant transfers.]
Textual Amendments
F70Ss. 17A-17C inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 23 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
(1)The Secretary of State may by regulations specify standard data protection clauses which the Secretary of State considers provide appropriate safeguards for the purposes of transfers of personal data to a third country or an international organisation in reliance on Article 46 of the UK GDPR (and see also section 119A).
(2)The Secretary of State must keep under review the standard data protection clauses specified in regulations under this section that are for the time being in force.
(3)Regulations under this section are subject to the negative resolution procedure.]
Textual Amendments
F70Ss. 17A-17C inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 23 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
(1)The Secretary of State may by regulations specify, for the purposes of Article 49(1)(d) of the [F72UK GDPR]—
(a)circumstances in which a transfer of personal data to a third country or international organisation is to be taken to be necessary for important reasons of public interest, and
(b)circumstances in which a transfer of personal data to a third country or international organisation which is not required by an enactment is not to be taken to be necessary for important reasons of public interest.
(2)The Secretary of State may by regulations restrict the transfer of a category of personal data to a third country or international organisation where—
[F73(a)the transfer cannot take place based on adequacy regulations (see section 17A),] and
(b)the Secretary of State considers the restriction to be necessary for important reasons of public interest.
(3)Regulations under this section—
(a)are subject to the made affirmative resolution procedure where the Secretary of State has made an urgency statement in respect of them;
(b)are otherwise subject to the affirmative resolution procedure.
(4)For the purposes of this section, an urgency statement is a reasoned statement that the Secretary of State considers it desirable for the regulations to come into force without delay.
Textual Amendments
F71Words in s. 18 heading inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 24(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F72Words in s. 18(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 24(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F73S. 18(2)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 24(4) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
Commencement Information
I6S. 18 in force at Royal Assent for specified purposes, see s. 212(2)(f)
(1)This section makes provision about—
(a)processing of personal data that is necessary for archiving purposes in the public interest,
(b)processing of personal data that is necessary for scientific or historical research purposes, and
(c)processing of personal data that is necessary for statistical purposes.
(2)Such processing does not satisfy the requirement in Article 89(1) of the [F74UK GDPR] for the processing to be subject to appropriate safeguards for the rights and freedoms of the data subject if it is likely to cause substantial damage or substantial distress to a data subject.
(3)Such processing does not satisfy that requirement if the processing is carried out for the purposes of measures or decisions with respect to a particular data subject, unless the purposes for which the processing is necessary include the purposes of approved medical research.
(4)In this section—
“approved medical research” means medical research carried out by a person who has approval to carry out that research from—
a research ethics committee recognised or established by the Health Research Authority under Chapter 2 of Part 3 of the Care Act 2014, or
a body appointed by any of the following for the purpose of assessing the ethics of research involving individuals—
the Secretary of State, the Scottish Ministers, the Welsh Ministers, or a Northern Ireland department;
a relevant NHS body;
United Kingdom Research and Innovation or a body that is a Research Council for the purposes of the Science and Technology Act 1965;
an institution that is a research institution for the purposes of Chapter 4A of Part 7 of the Income Tax (Earnings and Pensions) Act 2003 (see section 457 of that Act);
“relevant NHS body” means—
an NHS trust or NHS foundation trust in England,
an NHS trust or Local Health Board in Wales,
a Health Board or Special Health Board constituted under section 2 of the National Health Service (Scotland) Act 1978,
the Common Services Agency for the Scottish Health Service, or
any of the health and social care bodies in Northern Ireland falling within paragraphs (a) to (e) of section 1(5) of the Health and Social Care (Reform) Act (Northern Ireland) 2009 (c. 1 (N.I.)).
(5)The Secretary of State may by regulations change the meaning of “approved medical research” for the purposes of this section, including by amending subsection (4).
(6)Regulations under subsection (5) are subject to the affirmative resolution procedure.
Textual Amendments
F74Words in s. 19(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 25 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
Commencement Information
I7S. 19 in force at Royal Assent for specified purposes, see s. 212(2)(f)
Section 5(1) (terms used in [F75this Part] to have the same meaning as in the [F76UK GDPR]) does not apply to references in [F75this Part] to a court and, accordingly, such references do not include a tribunal.
Textual Amendments
F75Words in s. 20 substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 26(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F76Words in s. 20 substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 26(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
The Whole Act you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.
Would you like to continue?
The Whole Act you have selected contains over 200 provisions and might take some time to download.
Would you like to continue?
The Whole Act without Schedules you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.
Would you like to continue?
The Whole Act without Schedules you have selected contains over 200 provisions and might take some time to download.
Would you like to continue?
The Whole Act you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.
Would you like to continue?
The Whole Act without Schedules you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.
Would you like to continue?
The Schedules you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.
Would you like to continue?
Latest Available (revised):The latest available updated version of the legislation incorporating changes made by subsequent legislation and applied by our editorial team. Changes we have not yet applied to the text, can be found in the ‘Changes to Legislation’ area.
Original (As Enacted or Made): The original version of the legislation as it stood when it was enacted or made. No changes have been applied to the text.
Geographical Extent: Indicates the geographical area that this provision applies to. For further information see ‘Frequently Asked Questions’.
Show Timeline of Changes: See how this legislation has or could change over time. Turning this feature on will show extra navigation options to go to these specific points in time. Return to the latest available version by using the controls above in the What Version box.
Text created by the government department responsible for the subject matter of the Act to explain what the Act sets out to achieve and to make the Act accessible to readers who are not legally qualified. Explanatory Notes were introduced in 1999 and accompany all Public Acts except Appropriation, Consolidated Fund, Finance and Consolidation Acts.
Access essential accompanying documents and information for this legislation item from this tab. Dependent on the legislation item being viewed this may include:
This timeline shows the different points in time where a change occurred. The dates will coincide with the earliest date on which the change (e.g an insertion, a repeal or a substitution) that was applied came into force. The first date in the timeline will usually be the earliest date when the provision came into force. In some cases the first date is 01/02/1991 (or for Northern Ireland legislation 01/01/2006). This date is our basedate. No versions before this date are available. For further information see the Editorial Practice Guide and Glossary under Help.
Use this menu to access essential accompanying documents and information for this legislation item. Dependent on the legislation item being viewed this may include:
Click 'View More' or select 'More Resources' tab for additional information including: