21In Article 23 (restrictions), in paragraph 1—
(a)for “Union or Member State law to which the data controller or processor is subject” substitute “In addition to the provision made by section 15 of and Schedules 2, 3 and 4 to the 2018 Act, the Secretary of State”;
(b)in point (e), for “of the Union or of a Member State”, in both places, substitute “of the United Kingdom”;
(c)after point (j) insert—
“See section 16 of the 2018 Act.”