OpenLegislation

Data Protection Act 2018

2018 c. 12 · Enacted 23 May 2018 · Extends to United Kingdom

Not fully up to date. 7 changes made by later legislation have not yet been written into this text, which is revised to 30 September 2026.

See the changes not yet applied
ProvisionChangeMade by
Sch. 3 para. 8(1)(q)(ii)words substitutedAdoption and Children Act (Northern Ireland) 2022 Sch. 3 para. 78(2)(a)
Sch. 3 para. 8(1)(q)(ii)words substitutedAdoption and Children Act (Northern Ireland) 2022 Sch. 3 para. 78(2)(b)
Sch. 3 para. 8(1)(y)addedAdoption and Children Act (Northern Ireland) 2022 Sch. 3 para. 78(3)
Sch. 4 para. 3(4)(a)substututedAdoption and Children Act (Northern Ireland) 2022 Sch. 3 para. 79(2)
Sch. 4 para. 5(4)(a)words substitutedAdoption and Children Act (Northern Ireland) 2022 Sch. 3 para. 79(3)(a)
Sch. 4 para. 5(4)(a)words substitutedAdoption and Children Act (Northern Ireland) 2022 Sch. 3 para. 79(3)(b)
Sch. 3 para. 2(1)words substitutedVeterans Advisory and Pensions Committees Act 2023 s. 2(1)(l)
An Act to make provision for the regulation of the processing of information relating to individuals; to make provision in connection with the Information Commissioner's functions under certain regulations relating to information; to make provision for a direct marketing code of practice; and for connected purposes.[23rd May 2018]

Be it enacted by the Queen's most Excellent Majesty, by and with the advice and consent of the Lords Spiritual and Temporal, and Commons, in this present Parliament assembled, and by the authority of the same, as follows:—C1C2C3C4C5C6C7C8

Annotations to the whole text

Modifications

C1

Act modified (23.5.2019) by The Buckinghamshire (Structural Changes) Order 2019 (S.I. 2019/957), arts. 1, 15(2)

C2

Act modified (14.2.2020) by The Northamptonshire (Structural Changes) Order 2020 (S.I. 2020/156), arts. 1, 17(2)(e)

C3

Act excluded (30.9.2020) by The Channel Tunnel (Arrangements with the Kingdom of the Netherlands) Order 2020 (S.I. 2020/916), arts. 1(2)(b)4(4)

C4

Act applied (30.9.2020) by The Channel Tunnel (Arrangements with the Kingdom of the Netherlands) Order 2020 (S.I. 2020/916), arts. 1(2)(b), 4(3)

C5

Act applied (31.12.2020) by Regulation (EU) No. 625/2017, Art. 143 (as substituted by The Official Controls (Animals, Feed and Food, Plant Health etc.) (Amendment) (EU Exit) Regulations 2020 (S.I. 2020/1481), regs. 1, 27(3) (with reg. 46))

C6

Act applied (18.3.2022) by The Cumbria (Structural Changes) Order 2022 (S.I. 2022/331), arts. 1(1), 18(2)(e)

C7

Act modified (6.6.2022) by Dormant Assets Act 2022 (c. 5), ss. 25, 34(3); S.I. 2022/582, reg. 2

C8

Act modified (10.3.2026) by The Surrey (Structural Changes) Order 2026 (S.I. 2026/264), arts. 1(1), 28(2)(e), 40(2)(e)

Contents

  1. Part 1: Preliminary
  2. 1Overview
  3. 2Protection of personal data
  4. 3Terms relating to the processing of personal data
  5. Part 2: General processing
  6. Chapter 1: Scope and definitions
  7. 4Processing to which this Part applies
  8. 5Definitions
  9. Chapter 2: The UK GDPR
  10. Meaning of certain terms used in the UK GDPR
  11. 6Meaning of “controller”
  12. 7Meaning of “public authority” and “public body”
  13. Lawfulness of processing
  14. 8Lawfulness of processing: public interest etc
  15. 9Child's consent in relation to information society services Repealed
  16. Relevant international law
  17. 9AProcessing in reliance on relevant international law
  18. Special categories of personal data
  19. 10Special categories of personal data and criminal convictions etc data
  20. 11Special categories of personal data etc: supplementary
  21. Rights of the data subject
  22. 12Limits on fees that may be charged by controllers
  23. 13Obligations of credit reference agencies
  24. 13AMeaning of “relevant offence” for purpose of right to erasure
  25. 14Automated decision-making authorised by law: safeguards Repealed
  26. Exemptions etc
  27. 15Exemptions etc
  28. 16Power to make further exemptions etc by regulations
  29. Certification
  30. 17Accreditation of certification providers
  31. ...
  32. 17ATransfers based on adequacy regulations Repealed
  33. 17BTransfers based on adequacy regulations: review etc Repealed
  34. 17CStandard data protection clauses Repealed
  35. 18Transfers of personal data to third countries etc : public interest Repealed
  36. ...
  37. 19Processing for archiving, research and statistical purposes: safeguards Repealed
  38. Minor definition
  39. 20Meaning of “court” Repealed
  40. Chapter 3: Exemptions for manual unstructured processing and for national security and defence purposes
  41. Definitions
  42. 21Definitions
  43. ...
  44. 22Application of the GDPR to processing to which this Chapter applies Repealed
  45. 23Power to make provision in consequence of regulations related to the GDPR Repealed
  46. Exemptions etc
  47. 24Manual unstructured data held by FOI public authorities
  48. 25Manual unstructured data used in longstanding historical research
  49. 26National security and defence exemption
  50. 27National security: certificate
  51. 28National security and defence: modifications to Articles 9 and 32 of the UK GDPR
  52. Part 3: Law enforcement processing
  53. Chapter 1: Scope and definitions
  54. Scope
  55. 29Processing to which this Part applies
  56. Definitions
  57. 30Meaning of “competent authority”
  58. 31“The law enforcement purposes”
  59. 32Meaning of “controller” and “processor”
  60. 33Other definitions
  61. Chapter 2: Principles
  62. 34Overview and general duty of controller
  63. 35The first data protection principle
  64. 36The second data protection principle
  65. 37The third data protection principle
  66. 38The fourth data protection principle
  67. 39The fifth data protection principle
  68. 40The sixth data protection principle
  69. 40AConditions for consent
  70. 41Safeguards: archiving
  71. 42Safeguards: sensitive processing
  72. 42AFurther provision about sensitive processing
  73. Chapter 3: Rights of the data subject
  74. Overview and scope
  75. 43Overview and scope
  76. Data subject’s rights to information
  77. 44... Controller's general duties
  78. ...
  79. 45Right of access by the data subject
  80. 45AExemption from sections 44 and 45: legal professional privilege
  81. Data subject's rights to rectification or erasure etc
  82. 46Right to rectification
  83. 47Right to erasure or restriction of processing
  84. 48Rights under section 46 or 47: supplementary
  85. Automated individual decision-making
  86. 49Right not to be subject to automated decision-making Repealed
  87. 50Automated decision-making authorised by law: safeguards Repealed
  88. 50AAutomated processing and significant decisions
  89. 50BRestrictions on automated decision-making based on sensitive processing
  90. 50CSafeguards for automated decision-making
  91. 50DFurther provision about automated decision-making
  92. Supplementary
  93. 51Exercise of rights through the Commission
  94. 52Form of provision of information etc
  95. 53Manifestly unfounded or excessive requests by the data subject
  96. 54Meaning of “applicable time period”
  97. Chapter 4: Controller and processor
  98. Overview and scope
  99. 55Overview and scope
  100. General obligations
  101. 56General obligations of the controller
  102. 57Data protection by design and default
  103. 58Joint controllers
  104. 59Processors
  105. 60Processing under the authority of the controller or processor
  106. 61Records of processing activities
  107. 62Logging
  108. 63Co-operation with the Commission
  109. 64Data protection impact assessment
  110. 65Prior consultation with the Commission
  111. Obligations relating to security
  112. 66Security of processing
  113. Obligations relating to personal data breaches
  114. 67Notification of a personal data breach to the Commission
  115. 68Communication of a personal data breach to the data subject
  116. Data protection officers
  117. 69Designation of a data protection officer
  118. 70Position of data protection officer
  119. 71Tasks of data protection officer
  120. Codes of conduct
  121. 71ACodes of conduct
  122. Chapter 5: Transfers of personal data to third countries etc
  123. Overview and interpretation
  124. 72Overview and interpretation
  125. General principles for transfers
  126. 73General principles for transfers of personal data
  127. 74Transfers on the basis of an adequacy decision Repealed
  128. 74ATransfers based on adequacy regulations Repealed
  129. 74AATransfers approved by regulations
  130. 74ABThe data protection test
  131. 74BTransfers approved by regulations: monitoring
  132. 75Transfers subject to appropriate safeguards
  133. 76Transfers based on special circumstances
  134. Additional conditions
  135. 77Additional conditions for transfers in reliance on section 73(4)(b)
  136. Subsequent transfers
  137. 78Subsequent transfers
  138. Chapter 6: Supplementary
  139. 78ANational security exemption
  140. 79National security: certificate
  141. 80Special processing restrictions
  142. 81Reporting of infringements
  143. Part 4: Intelligence services processing
  144. Chapter 1: Scope and definitions
  145. Scope
  146. 82Processing to which this Part applies
  147. 82ADesignation of processing by a qualifying competent authority
  148. 82BDuration of designation notice
  149. 82CReview and withdrawal of designation notice
  150. 82DRecords of designation notices
  151. 82EAppeal against designation notice
  152. Definitions
  153. 83Meaning of “controller” and “processor”
  154. 84Other definitions
  155. Chapter 2: Principles
  156. Overview
  157. 85Overview
  158. The data protection principles
  159. 86The first data protection principle
  160. 87The second data protection principle
  161. 88The third data protection principle
  162. 89The fourth data protection principle
  163. 90The fifth data protection principle
  164. 91The sixth data protection principle
  165. 91AFurther provision about sensitive processing
  166. Chapter 3: Rights of the data subject
  167. Overview
  168. 92Overview
  169. Rights
  170. 93Right to information
  171. 94Right of access
  172. 95Right of access: supplementary
  173. 96Right not to be subject to automated decision-making
  174. 97Right to intervene in automated decision-making
  175. 98Right to information about decision-making
  176. 99Right to object to processing
  177. 100Rights to rectification and erasure
  178. Chapter 4: Controller and processor
  179. Overview
  180. 101Overview
  181. General obligations
  182. 102General obligations of the controller
  183. 103Data protection by design
  184. 104Joint controllers
  185. 105Processors
  186. 106Processing under the authority of the controller or processor
  187. Obligations relating to security
  188. 107Security of processing
  189. Obligations relating to personal data breaches
  190. 108Communication of a personal data breach
  191. Chapter 5: Transfers of personal data outside the United Kingdom
  192. 109Transfers of personal data outside the United Kingdom
  193. Chapter 6: Exemptions
  194. 110National security
  195. 111National security: certificate
  196. 112Other exemptions
  197. 113Power to make further exemptions
  198. Part 5: The Information Commission
  199. ...
  200. 114The Information Commissioner Repealed
  201. The Information Commission
  202. 114AThe Information Commission
  203. General functions
  204. 115General functions under the UK GDPR and safeguards
  205. 116Other general functions
  206. 117Competence in relation to courts etc
  207. International role
  208. 118Co-operation between parties to the Data Protection Convention
  209. 119Inspection of personal data in accordance with international obligations
  210. 119AStandard clauses for transfers to third countries etc
  211. 120Further international role
  212. Duties in carrying out functions
  213. 120APrincipal objective
  214. 120BDuties in relation to functions under the data protection legislation
  215. 120CStrategy
  216. 120DDuty to consult other regulators
  217. Codes of practice
  218. 121Data-sharing code
  219. 122Direct marketing code
  220. 123Age-appropriate design code
  221. 124Data protection and journalism code
  222. 124AOther codes of practice
  223. 124BPanels to consider codes of practice
  224. 124CImpact assessments for codes of practice
  225. 125Approval of codes prepared under sections 121 to 124A
  226. 126Publication and review of codes issued under section 125(4)
  227. 127Effect of codes issued under section 125(4)
  228. 128Other codes of practice Repealed
  229. Consensual audits
  230. 129Consensual audits
  231. Records of national security certificates
  232. 130Records of national security certificates
  233. Information provided to the Commission
  234. 131Disclosure of information to the Commission
  235. 132Confidentiality of information
  236. 133Guidance about privileged communications
  237. Fees
  238. 134Fees for services
  239. 135Manifestly unfounded or excessive requests by data subjects etc
  240. 136Guidance about fees
  241. Charges
  242. 137Charges payable to the Commission by controllers
  243. 138Regulations under section 137: supplementary
  244. Reports etc
  245. 139Reporting to Parliament
  246. 139AAnalysis of performance
  247. Documents and notices
  248. 140Publication by the Commission
  249. 141Notices from the Commissioner Repealed
  250. 141ANotices from the Commission
  251. Part 6: Enforcement
  252. Information notices
  253. 142Information notices
  254. 143Information notices: restrictions
  255. 144False statements made in response to information notices
  256. 145Information orders
  257. Assessment notices
  258. 146Assessment notices
  259. 146AAssessment notices: approval of person to prepare report etc
  260. 147Assessment notices: restrictions
  261. Information notices and assessment notices: destruction of documents etc
  262. 148Destroying or falsifying information and documents etc
  263. Interview notices
  264. 148AInterview notices
  265. 148BInterview notices: restrictions
  266. 148CFalse statements made in response to interview notices
  267. Enforcement notices
  268. 149Enforcement notices
  269. 150Enforcement notices: supplementary
  270. 151Enforcement notices: rectification and erasure of personal data etc
  271. 152Enforcement notices: restrictions
  272. 153Enforcement notices: cancellation and variation
  273. Powers of entry and inspection
  274. 154Powers of entry and inspection
  275. Penalties
  276. 155Penalty notices
  277. 156Penalty notices: restrictions
  278. 157Maximum amount of penalty
  279. 158Fixed penalties for non-compliance with charges regulations
  280. 159Amount of penalties: supplementary
  281. Guidance and report
  282. 160Guidance about regulatory action
  283. 161Approval of first guidance about regulatory action
  284. 161AAnnual report on regulatory action
  285. Appeals etc
  286. 162Rights of appeal
  287. 163Determination of appeals
  288. 164Applications in respect of urgent notices
  289. Complaints
  290. 164AComplaints by data subjects to controllers
  291. 164BControllers to notify the Commission of the number of complaints
  292. 165Complaints by data subjects to the Commission
  293. 166Orders to progress complaints to the Commission
  294. Remedies in the court
  295. 167Compliance orders
  296. 168Compensation for contravention of the UK GDPR
  297. 169Compensation for contravention of other data protection legislation
  298. Offences relating to personal data
  299. 170Unlawful obtaining etc of personal data
  300. 171Re-identification of de-identified personal data
  301. 172Re-identification: effectiveness testing conditions
  302. 173Alteration etc of personal data to prevent disclosure to data subject
  303. The special purposes
  304. 174The special purposes
  305. 175Provision of assistance in special purposes proceedings
  306. 176Staying special purposes proceedings
  307. 177Guidance about how to seek redress against media organisations
  308. 178Review of processing of personal data for the purposes of journalism
  309. 179Effectiveness of the media's dispute resolution procedures
  310. Jurisdiction and court procedure
  311. 180Jurisdiction
  312. 180AProcedure in connection with subject access requests
  313. Definitions
  314. 181Interpretation of Part 6
  315. Part 7: Supplementary and final provision
  316. Regulations under this Act
  317. 182Regulations and consultation
  318. Changes to the Data Protection Convention
  319. 183Power to reflect changes to the Data Protection Convention
  320. Prohibitions and restrictions etc on processing
  321. 183AProtection of prohibitions and restrictions etc on processing: relevant enactments
  322. 183BProtection of prohibitions and restrictions etc on processing: other enactments
  323. Rights of the data subject
  324. 184Prohibition of requirement to produce relevant records
  325. 185Avoidance of certain contractual terms relating to health records
  326. 186Protection of data subject’s rights
  327. 186AProtection of data subject’s rights: further provision
  328. Representation of data subjects
  329. 187Representation of data subjects with their authority
  330. 188Representation of data subjects with their authority: collective proceedings
  331. 189Duty to review provision for representation of data subjects
  332. 190Post-review powers to make provision about representation of data subjects
  333. Framework for Data Processing by Government
  334. 191Framework for Data Processing by Government
  335. 192Approval of the Framework
  336. 193Publication and review of the Framework
  337. 194Effect of the Framework
  338. Data-sharing: HMRC and reserve forces
  339. 195Reserve forces: data-sharing by HMRC
  340. Offences
  341. 196Penalties for offences
  342. 197Prosecution
  343. 198Liability of directors etc
  344. 199Recordable offences
  345. 200Guidance about PACE codes of practice
  346. The Tribunal
  347. 201Disclosure of information to the Tribunal
  348. 202Proceedings in the First-tier Tribunal: contempt
  349. 203Tribunal Procedure Rules
  350. Interpretation
  351. 204Meaning of “health professional” and “social work professional”
  352. 205General interpretation
  353. 206Index of defined expressions
  354. Territorial application
  355. 207Territorial application of this Act
  356. General
  357. 208Children in Scotland
  358. 209Application to the Crown
  359. 210Application to Parliament
  360. 211Minor and consequential provision
  361. Final
  362. 212Commencement
  363. 213Transitional provision
  364. 214Extent
  365. 215Short title
  366. Schedule A1: Processing in reliance on relevant international law
  367. Schedule 1: Special categories of personal data and criminal convictions etc data
  368. Part 1: Conditions relating to employment, health and research etc
  369. Employment, social security and social protection
  370. 1Paragraph 1
  371. Health or social care purposes
  372. 2Paragraph 2
  373. Public health
  374. 3Paragraph 3
  375. Research etc
  376. 4Paragraph 4
  377. Part 2: Substantial public interest conditions
  378. Requirement for an appropriate policy document when relying on conditions in this Part
  379. 5Paragraph 5
  380. Statutory etc and government purposes
  381. 6Paragraph 6
  382. Administration of justice and parliamentary purposes
  383. 7Paragraph 7
  384. Equality of opportunity or treatment
  385. 8Paragraph 8
  386. Racial and ethnic diversity at senior levels of organisations
  387. 9Paragraph 9
  388. Preventing etc unlawful acts
  389. 10Paragraph 10
  390. Protecting the public against dishonesty etc
  391. 11Paragraph 11
  392. Regulatory requirements relating to unlawful acts and dishonesty etc
  393. 12Paragraph 12
  394. Journalism etc in connection with unlawful acts and dishonesty etc
  395. 13Paragraph 13
  396. Preventing fraud
  397. 14Paragraph 14
  398. Suspicion of terrorist financing or money laundering
  399. 15Paragraph 15
  400. Support for individuals with a particular disability or medical condition
  401. 16Paragraph 16
  402. Counselling etc
  403. 17Paragraph 17
  404. Safeguarding of children and of individuals at risk
  405. 18Paragraph 18
  406. Safeguarding of economic well-being of certain individuals
  407. 19Paragraph 19
  408. Insurance
  409. 20Paragraph 20
  410. Occupational pensions
  411. 21Paragraph 21
  412. Political parties
  413. 22Paragraph 22
  414. Elected representatives responding to requests
  415. 23Paragraph 23
  416. Disclosure to elected representatives
  417. 24Paragraph 24
  418. Informing elected representatives about prisoners
  419. 25Paragraph 25
  420. Publication of legal judgments
  421. 26Paragraph 26
  422. Anti-doping in sport
  423. 27Paragraph 27
  424. Standards of behaviour in sport
  425. 28Paragraph 28
  426. Part 3: Additional conditions relating to criminal convictions etc
  427. Consent
  428. 29Paragraph 29
  429. Protecting individual's vital interests
  430. 30Paragraph 30
  431. Processing by not-for-profit bodies
  432. 31Paragraph 31
  433. Personal data in the public domain
  434. 32Paragraph 32
  435. Legal claims
  436. 33Paragraph 33
  437. Judicial acts
  438. 34Paragraph 34
  439. Administration of accounts used in commission of indecency offences involving children
  440. 35Paragraph 35
  441. Extension of conditions in Part 2 of this Schedule referring to substantial public interest
  442. 36Paragraph 36
  443. Extension of insurance conditions
  444. 37Paragraph 37
  445. Part 4: Appropriate policy document and additional safeguards
  446. Application of this Part of this Schedule
  447. 38Paragraph 38
  448. Requirement to have an appropriate policy document in place
  449. 39Paragraph 39
  450. Additional safeguard: retention of appropriate policy document
  451. 40Paragraph 40
  452. Additional safeguard: record of processing
  453. 41Paragraph 41
  454. Schedule 2: Exemptions etc from the UK GDPR
  455. Part 1: Adaptations and restrictions as described in Articles 6(3) and 23(1)
  456. UK GDPR provisions to be adapted or restricted: “the listed GDPR provisions”
  457. 1Paragraph 1
  458. Crime and taxation: general
  459. 2Paragraph 2
  460. Crime and taxation: risk assessment systems
  461. 3Paragraph 3
  462. Immigration
  463. 4Paragraph 4
  464. Immigration: safeguards: immigration exemption decisions
  465. 4AParagraph 4A
  466. Immigration: safeguard: record of decision that exemption applies
  467. 4BParagraph 4B
  468. Information required to be disclosed by law etc or in connection with legal proceedings
  469. 5Paragraph 5
  470. Part 2: Restrictions as described in Article 23(1): restrictions of rules in Articles 13 to 21 and 34
  471. UK GDPR provisions to be restricted: “the listed GDPR provisions”
  472. 6Paragraph 6
  473. Functions designed to protect the public etc
  474. 7Paragraph 7
  475. Audit functions
  476. 8Paragraph 8
  477. Functions of the Bank of England
  478. 9Paragraph 9
  479. Regulatory functions relating to legal services, the health service and children's services
  480. 10Paragraph 10
  481. Regulatory functions of certain other persons
  482. 11Paragraph 11
  483. 12Paragraph 12
  484. Parliamentary privilege
  485. 13Paragraph 13
  486. Judicial appointments, judicial independence and judicial proceedings
  487. 14Paragraph 14
  488. Crown honours, dignities and appointments
  489. 15Paragraph 15
  490. Part 3: Restriction for the protection of rights of others
  491. Protection of the rights of others: general
  492. 16Paragraph 16
  493. Assumption of reasonableness for health workers, social workers and education workers
  494. 17Paragraph 17
  495. Part 4: Restrictions as described in Article 23(1): restrictions of rules in Articles 13 to 15
  496. UK GDPR provisions to be restricted: “the listed GDPR provisions”
  497. 18Paragraph 18
  498. Legal professional privilege
  499. 19Paragraph 19
  500. Self incrimination
  501. 20Paragraph 20
  502. Corporate finance
  503. 21Paragraph 21
  504. Management forecasts
  505. 22Paragraph 22
  506. Negotiations
  507. 23Paragraph 23
  508. Confidential references
  509. 24Paragraph 24
  510. Exam scripts and exam marks
  511. 25Paragraph 25
  512. Part 5: Exemptions etc ... for reasons of freedom of expression and information
  513. Journalistic, academic, artistic and literary purposes
  514. 26Paragraph 26
  515. Part 6: Derogations etc ... for research, statistics and archiving
  516. Research and statistics
  517. 27Paragraph 27
  518. Archiving in the public interest
  519. 28Paragraph 28
  520. Schedule 3: Exemptions etc from the UK GDPR: health, social work, education and child abuse data
  521. Part 1: UK GDPR provisions to be restricted
  522. 1Paragraph 1
  523. Part 2: Health data
  524. Definitions
  525. 2Paragraph 2
  526. Exemption from the listed GDPR provisions: data processed by a court
  527. 3Paragraph 3
  528. Exemption from the listed GDPR provisions: data subject's expectations and wishes
  529. 4Paragraph 4
  530. Exemption from Article 15 of the UK GDPR: serious harm
  531. 5Paragraph 5
  532. Restriction of Article 15 of the UK GDPR: prior opinion of appropriate health professional
  533. 6Paragraph 6
  534. Part 3: Social work data
  535. Definitions
  536. 7Paragraph 7
  537. 8Paragraph 8
  538. Exemption from the listed GDPR provisions: data processed by a court
  539. 9Paragraph 9
  540. Exemption from the listed GDPR provisions: data subject's expectations and wishes
  541. 10Paragraph 10
  542. Exemption from Article 15 of the UK GDPR: serious harm
  543. 11Paragraph 11
  544. Restriction of Article 15 of the UK GDPR: prior opinion of Principal Reporter
  545. 12Paragraph 12
  546. Part 4: Education data
  547. Educational records
  548. 13Paragraph 13
  549. 14Paragraph 14
  550. 15Paragraph 15
  551. 16Paragraph 16
  552. Other definitions
  553. 17Paragraph 17
  554. Exemption from the listed GDPR provisions: data processed by a court
  555. 18Paragraph 18
  556. Exemption from Article 15 of the UK GDPR: serious harm
  557. 19Paragraph 19
  558. Restriction of Article 15 of the UK GDPR: prior opinion of Principal Reporter
  559. 20Paragraph 20
  560. Part 5: Child abuse data
  561. Exemption from Article 15 of the UK GDPR: child abuse data
  562. 21Paragraph 21
  563. Schedule 4: Exemptions etc from the UK GDPR: disclosure prohibited or restricted by an enactment
  564. UK GDPR provisions to be restricted: “the listed GDPR provisions”
  565. 1Paragraph 1
  566. Human fertilisation and embryology information
  567. 2Paragraph 2
  568. Adoption records and reports
  569. 3Paragraph 3
  570. Statements of special educational needs
  571. 4Paragraph 4
  572. Parental order records and reports
  573. 5Paragraph 5
  574. Information provided by Principal Reporter for children's hearing
  575. 6Paragraph 6
  576. Schedule 5: Accreditation of certification providers: reviews and appeals
  577. Introduction
  578. 1Paragraph 1
  579. Review
  580. 2Paragraph 2
  581. Right to appeal
  582. 3Paragraph 3
  583. Appeal panel
  584. 4Paragraph 4
  585. Hearing
  586. 5Paragraph 5
  587. Decision following referral to appeal panel
  588. 6Paragraph 6
  589. Meaning of “working day”
  590. 7Paragraph 7
  591. Schedule 6: The applied GDPR and the applied Chapter 2 Repealed
  592. Part 1: Modifications to the GDPR Repealed
  593. Introductory Repealed
  594. 1Paragraph 1 Repealed
  595. References to the GDPR and its provisions Repealed
  596. 2Paragraph 2 Repealed
  597. References to Union law and Member State law Repealed
  598. 3Paragraph 3 Repealed
  599. References to the Union and to Member States Repealed
  600. 4Paragraph 4 Repealed
  601. References to supervisory authorities Repealed
  602. 5Paragraph 5 Repealed
  603. References to the national parliament Repealed
  604. 6Paragraph 6 Repealed
  605. Chapter I of the GDPR (general provisions) Repealed
  606. 7Paragraph 7 Repealed
  607. 8Paragraph 8 Repealed
  608. 9Paragraph 9 Repealed
  609. Chapter II of the GDPR (principles) Repealed
  610. 10Paragraph 10 Repealed
  611. 11Paragraph 11 Repealed
  612. 12Paragraph 12 Repealed
  613. 13Paragraph 13 Repealed
  614. Section 1 of Chapter III of the GDPR (rights of the data subject: transparency and modalities) Repealed
  615. 14Paragraph 14 Repealed
  616. Section 2 of Chapter III of the GDPR (rights of the data subject: information and access to personal data) Repealed
  617. 15Paragraph 15 Repealed
  618. 16Paragraph 16 Repealed
  619. Section 3 of Chapter III of the GDPR (rights of the data subject: rectification and erasure) Repealed
  620. 17Paragraph 17 Repealed
  621. 18Paragraph 18 Repealed
  622. Section 4 of Chapter III of the GDPR (rights of the data subject: right to object and automated individual decision-making) Repealed
  623. 19Paragraph 19 Repealed
  624. 20Paragraph 20 Repealed
  625. Section 5 of Chapter III of the GDPR (rights of the data subject: restrictions) Repealed
  626. 21Paragraph 21 Repealed
  627. Section 1 of Chapter IV of the GDPR (controller and processor: general obligations) Repealed
  628. 22Paragraph 22 Repealed
  629. 23Paragraph 23 Repealed
  630. 24Paragraph 24 Repealed
  631. 25Paragraph 25 Repealed
  632. 26Paragraph 26 Repealed
  633. Section 3 of Chapter IV of the GDPR (controller and processor: data protection impact assessment and prior consultation) Repealed
  634. 27Paragraph 27 Repealed
  635. 28Paragraph 28 Repealed
  636. Section 4 of Chapter IV of the GDPR (controller and processor: data protection officer) Repealed
  637. 29Paragraph 29 Repealed
  638. 30Paragraph 30 Repealed
  639. Section 5 of Chapter IV of the GDPR (controller and processor: codes of conduct and certification) Repealed
  640. 31Paragraph 31 Repealed
  641. 32Paragraph 32 Repealed
  642. 33Paragraph 33 Repealed
  643. 34Paragraph 34 Repealed
  644. Chapter V of the GDPR (transfers of data to third countries or international organisations) Repealed
  645. 35Paragraph 35 Repealed
  646. 36Paragraph 36 Repealed
  647. 37Paragraph 37 Repealed
  648. 38Paragraph 38 Repealed
  649. 39Paragraph 39 Repealed
  650. Section 1 of Chapter VI of the GDPR (independent supervisory authorities: independent status) Repealed
  651. 40Paragraph 40 Repealed
  652. 41Paragraph 41 Repealed
  653. 42Paragraph 42 Repealed
  654. 43Paragraph 43 Repealed
  655. Section 2 of Chapter VI of the GDPR (independent supervisory authorities: competence, tasks and powers) Repealed
  656. 44Paragraph 44 Repealed
  657. 45Paragraph 45 Repealed
  658. 46Paragraph 46 Repealed
  659. 47Paragraph 47 Repealed
  660. 48Paragraph 48 Repealed
  661. Chapter VII of the GDPR (co-operation and consistency) Repealed
  662. 49Paragraph 49 Repealed
  663. Chapter VIII of the GDPR (remedies, liability and penalties) Repealed
  664. 50Paragraph 50 Repealed
  665. 51Paragraph 51 Repealed
  666. 52Paragraph 52 Repealed
  667. 53Paragraph 53 Repealed
  668. 54Paragraph 54 Repealed
  669. 55Paragraph 55 Repealed
  670. 56Paragraph 56 Repealed
  671. 57Paragraph 57 Repealed
  672. Chapter IX of the GDPR (provisions relating to specific processing situations) Repealed
  673. 58Paragraph 58 Repealed
  674. 59Paragraph 59 Repealed
  675. 60Paragraph 60 Repealed
  676. 61Paragraph 61 Repealed
  677. 62Paragraph 62 Not yet in force
  678. 63Paragraph 63 Repealed
  679. 64Paragraph 64 Repealed
  680. Chapter X of the GDPR (delegated acts and implementing acts) Repealed
  681. 65Paragraph 65 Repealed
  682. 66Paragraph 66 Repealed
  683. Chapter XI of the GDPR (final provisions) Repealed
  684. 67Paragraph 67 Repealed
  685. 68Paragraph 68 Repealed
  686. 69Paragraph 69 Repealed
  687. 70Paragraph 70 Repealed
  688. 71Paragraph 71 Repealed
  689. 72Paragraph 72 Repealed
  690. Part 2: Modifications to Chapter 2 of Part 2 Repealed
  691. Introductory Repealed
  692. 73Paragraph 73 Repealed
  693. General modifications Repealed
  694. 74Paragraph 74 Repealed
  695. Exemptions Repealed
  696. 75Paragraph 75 Repealed
  697. Schedule 7: Competent authorities
  698. 1Paragraph 1
  699. 2Paragraph 2
  700. 3Paragraph 3
  701. 4Paragraph 4
  702. Chief officers of police and other policing bodies
  703. 5Paragraph 5
  704. 6Paragraph 6
  705. 7Paragraph 7
  706. 8Paragraph 8
  707. 9Paragraph 9
  708. 10Paragraph 10
  709. 11Paragraph 11
  710. 12Paragraph 12
  711. 13Paragraph 13
  712. 14Paragraph 14
  713. 15Paragraph 15
  714. 15AParagraph 15A
  715. 16Paragraph 16
  716. 17Paragraph 17
  717. 18Paragraph 18
  718. 18AParagraph 18A
  719. 19Paragraph 19
  720. 20Paragraph 20
  721. Other authorities with investigatory functions
  722. 21Paragraph 21
  723. 22Paragraph 22
  724. 23Paragraph 23
  725. 24Paragraph 24
  726. 25Paragraph 25
  727. 26Paragraph 26
  728. 27Paragraph 27
  729. 28Paragraph 28
  730. 29Paragraph 29
  731. 30Paragraph 30
  732. 31Paragraph 31
  733. 32Paragraph 32
  734. 33Paragraph 33
  735. 34Paragraph 34
  736. 35Paragraph 35
  737. Authorities with functions relating to offender management
  738. 36Paragraph 36
  739. 37Paragraph 37
  740. 38Paragraph 38
  741. 39Paragraph 39
  742. 40Paragraph 40
  743. 41Paragraph 41
  744. 42Paragraph 42
  745. 43Paragraph 43
  746. 44Paragraph 44
  747. 45Paragraph 45
  748. 46Paragraph 46
  749. Other authorities
  750. 47Paragraph 47
  751. 48Paragraph 48
  752. 49Paragraph 49
  753. 50Paragraph 50
  754. 51Paragraph 51
  755. 51AParagraph 51A
  756. 52Paragraph 52 Repealed
  757. 53Paragraph 53
  758. 54Paragraph 54
  759. 55Paragraph 55
  760. 56Paragraph 56
  761. 57Paragraph 57
  762. Schedule 8: Conditions for sensitive processing under Part 3
  763. Statutory etc purposes
  764. 1Paragraph 1
  765. Administration of justice
  766. 2Paragraph 2
  767. Protecting individual's vital interests
  768. 3Paragraph 3
  769. Safeguarding of children and of individuals at risk
  770. 4Paragraph 4
  771. Personal data already in the public domain
  772. 5Paragraph 5
  773. Legal claims
  774. 6Paragraph 6
  775. Judicial acts
  776. 7Paragraph 7
  777. Preventing fraud
  778. 8Paragraph 8
  779. Archiving etc
  780. 9Paragraph 9
  781. Schedule 9: Conditions for processing under Part 4
  782. 1Paragraph 1
  783. 2Paragraph 2
  784. 3Paragraph 3
  785. 4Paragraph 4
  786. 5Paragraph 5
  787. 6Paragraph 6
  788. Schedule 10: Conditions for sensitive processing under Part 4
  789. Consent to particular processing
  790. 1Paragraph 1
  791. Right or obligation relating to employment
  792. 2Paragraph 2
  793. Vital interests of a person
  794. 3Paragraph 3
  795. Safeguarding of children and of individuals at risk
  796. 4Paragraph 4
  797. Data already published by data subject
  798. 5Paragraph 5
  799. Legal proceedings etc
  800. 6Paragraph 6
  801. Administration of justice, parliamentary, statutory etc and government purposes
  802. 7Paragraph 7
  803. Medical purposes
  804. 8Paragraph 8
  805. Equality
  806. 9Paragraph 9
  807. Schedule 11: Other exemptions under Part 4
  808. Preliminary
  809. 1Paragraph 1
  810. Crime
  811. 2Paragraph 2
  812. Information required to be disclosed by law etc or in connection with legal proceedings
  813. 3Paragraph 3
  814. Parliamentary privilege
  815. 4Paragraph 4
  816. Judicial proceedings
  817. 5Paragraph 5
  818. Crown honours and dignities
  819. 6Paragraph 6
  820. Armed forces
  821. 7Paragraph 7
  822. Economic well-being
  823. 8Paragraph 8
  824. Legal professional privilege
  825. 9Paragraph 9
  826. Negotiations
  827. 10Paragraph 10
  828. Confidential references given by the controller
  829. 11Paragraph 11
  830. Exam scripts and marks
  831. 12Paragraph 12
  832. Research and statistics
  833. 13Paragraph 13
  834. Archiving in the public interest
  835. 14Paragraph 14
  836. Schedule 12: The Information Commissioner Repealed
  837. Status and capacity Repealed
  838. 1Paragraph 1 Repealed
  839. Appointment Repealed
  840. 2Paragraph 2 Repealed
  841. Resignation and removal Repealed
  842. 3Paragraph 3 Repealed
  843. Salary etc Repealed
  844. 4Paragraph 4 Repealed
  845. Officers and staff Repealed
  846. 5Paragraph 5 Repealed
  847. Carrying out of the Commissioner's functions by officers and staff Repealed
  848. 6Paragraph 6 Repealed
  849. Authentication of the seal of the Commissioner Repealed
  850. 7Paragraph 7 Repealed
  851. Presumption of authenticity of documents issued by the Commissioner Repealed
  852. 8Paragraph 8 Repealed
  853. Money Repealed
  854. 9Paragraph 9 Repealed
  855. Fees etc and other sums Repealed
  856. 10Paragraph 10 Repealed
  857. Accounts Repealed
  858. 11Paragraph 11 Repealed
  859. Scotland Repealed
  860. 12Paragraph 12 Repealed
  861. Schedule 12A: The Information Commission
  862. 1Status
  863. 2Number of members
  864. 3Membership: general
  865. 4Membership: non-executive members to outnumber executive members
  866. 5Membership: selection on merit etc
  867. 6Membership: conflicts of interests
  868. 7Tenure of the chair
  869. 8Tenure of deputy chair
  870. 9Tenure of the other non-executive members
  871. 10Remuneration and pensions of non-executive members
  872. 11Executive members: terms and conditions
  873. 12Other staff: appointment, terms and conditions
  874. 13Committees
  875. 14Delegation of functions
  876. 15Advice from committees
  877. 16Proceedings
  878. 17Records of proceedings
  879. 18Disqualification for acting in relation to certain matters
  880. 19Validity of proceedings
  881. 20Money
  882. 21Fees etc and other sums
  883. 22Accounts
  884. 23Authentication of seal and presumption of authenticity of documents
  885. 24Supplementary powers
  886. 25Transitional provision: interim chief executive
  887. 26Interpretation
  888. Schedule 13: Other general functions of the Commission
  889. General tasks
  890. 1Paragraph 1
  891. General powers
  892. 2Paragraph 2
  893. Definitions
  894. 3Paragraph 3
  895. Schedule 14: Co-operation and mutual assistance
  896. Part 1: Law Enforcement Directive Repealed
  897. Co-operation Repealed
  898. 1Paragraph 1 Repealed
  899. Requests for information and assistance from LED supervisory authorities Repealed
  900. 2Paragraph 2 Repealed
  901. Fees Repealed
  902. 3Paragraph 3 Repealed
  903. Restrictions on use of information Repealed
  904. 4Paragraph 4 Repealed
  905. LED supervisory authority Repealed
  906. 5Paragraph 5 Repealed
  907. Part 2: Data Protection Convention
  908. Co-operation between the Commission and foreign designated authorities
  909. 6Paragraph 6
  910. Assisting persons resident outside the UK with requests under Article 14 of the Convention
  911. 7Paragraph 7
  912. Assisting UK residents with requests under Article 8 of the Convention
  913. 8Paragraph 8
  914. Restrictions on use of information
  915. 9Paragraph 9
  916. Foreign designated authority
  917. 10Paragraph 10
  918. Schedule 15: Powers of entry and inspection
  919. Issue of warrants in connection with non-compliance and offences
  920. 1Paragraph 1
  921. Issue of warrants in connection with assessment notices
  922. 2Paragraph 2
  923. Restrictions on issuing warrants: processing for the special purposes
  924. 3Paragraph 3
  925. Restrictions on issuing warrants: procedural requirements
  926. 4Paragraph 4
  927. Content of warrants
  928. 5Paragraph 5
  929. Copies of warrants
  930. 6Paragraph 6
  931. Execution of warrants: reasonable force
  932. 7Paragraph 7
  933. Execution of warrants: time when executed
  934. 8Paragraph 8
  935. Execution of warrants: occupier of premises
  936. 9Paragraph 9
  937. Execution of warrants: seizure of documents etc
  938. 10Paragraph 10
  939. Matters exempt from inspection and seizure: privileged communications
  940. 11Paragraph 11
  941. Matters exempt from inspection and seizure: Parliamentary privilege
  942. 12Paragraph 12
  943. Partially exempt material
  944. 13Paragraph 13
  945. Return of warrants
  946. 14Paragraph 14
  947. Offences
  948. 15Paragraph 15
  949. Self-incrimination
  950. 16Paragraph 16
  951. Vessels, vehicles etc
  952. 17Paragraph 17
  953. Scotland
  954. 18Paragraph 18
  955. Northern Ireland
  956. 19Paragraph 19
  957. Schedule 16: Penalties
  958. Meaning of “penalty”
  959. 1Paragraph 1
  960. Notice of intent to impose penalty
  961. 2Paragraph 2
  962. Contents of notice of intent
  963. 3Paragraph 3
  964. Giving a penalty notice
  965. 4Paragraph 4
  966. Contents of penalty notice
  967. 5Paragraph 5
  968. Period for payment of penalty
  969. 6Paragraph 6
  970. Variation of penalty
  971. 7Paragraph 7
  972. Cancellation of penalty
  973. 8Paragraph 8
  974. Enforcement of payment
  975. 9Paragraph 9
  976. Schedule 17: Review of processing of personal data for the purposes of journalism
  977. Interpretation
  978. 1Paragraph 1
  979. Information notices
  980. 2Paragraph 2
  981. Assessment notices
  982. 3Paragraph 3
  983. Interview notices
  984. 3AParagraph 3A
  985. Applications in respect of urgent notices
  986. 4Paragraph 4
  987. Schedule 18: Relevant records
  988. Relevant records
  989. 1Paragraph 1
  990. Relevant health records
  991. 2Paragraph 2
  992. Relevant records relating to a conviction or caution
  993. 3Paragraph 3
  994. Relevant records relating to statutory functions
  995. 4Paragraph 4
  996. Data subject access right
  997. 5Paragraph 5
  998. Records stating that personal data is not processed
  999. 6Paragraph 6
  1000. Power to amend
  1001. 7Paragraph 7
  1002. Schedule 19: Minor and consequential amendments
  1003. Part 1: Amendments of primary legislation
  1004. Registration Service Act 1953 (c. 37)
  1005. 1Paragraph 1
  1006. Veterinary Surgeons Act 1966 (c. 36)
  1007. 2Paragraph 2
  1008. Parliamentary Commissioner Act 1967 (c. 13)
  1009. 3Paragraph 3
  1010. Local Government Act 1974 (c. 7)
  1011. 4Paragraph 4
  1012. 5Paragraph 5
  1013. 6Paragraph 6
  1014. Consumer Credit Act 1974 (c. 39)
  1015. 7Paragraph 7
  1016. 8Paragraph 8
  1017. 9Paragraph 9
  1018. 10Paragraph 10
  1019. Pharmacy (Northern Ireland) Order 1976 (S.I. 1976/1213 (N.I. 22))
  1020. 11Paragraph 11
  1021. 12Paragraph 12
  1022. 13Paragraph 13
  1023. 14Paragraph 14
  1024. 15Paragraph 15
  1025. 16Paragraph 16
  1026. 17Paragraph 17
  1027. Representation of the People Act 1983 (c. 2)
  1028. 18Paragraph 18
  1029. Medical Act 1983 (c. 54)
  1030. 19Paragraph 19
  1031. 20Paragraph 20
  1032. 21Paragraph 21
  1033. 22Paragraph 22
  1034. 23Paragraph 23
  1035. 24Paragraph 24
  1036. 25Paragraph 25
  1037. 26Paragraph 26
  1038. Dentists Act 1984 (c. 24)
  1039. 27Paragraph 27
  1040. 28Paragraph 28
  1041. 29Paragraph 29
  1042. 30Paragraph 30
  1043. 31Paragraph 31
  1044. 32Paragraph 32
  1045. Companies Act 1985 (c. 6)
  1046. 33Paragraph 33
  1047. Access to Medical Reports Act 1988 (c. 28)
  1048. 34Paragraph 34
  1049. Opticians Act 1989 (c. 44)
  1050. 35Paragraph 35
  1051. Access to Health Records Act 1990 (c. 23)
  1052. 36Paragraph 36
  1053. 37Paragraph 37
  1054. 38Paragraph 38
  1055. Human Fertilisation and Embryology Act 1990 (c. 37)
  1056. 39Paragraph 39
  1057. Trade Union and Labour Relations (Consolidation) Act 1992 (c. 52)
  1058. 40Paragraph 40
  1059. Tribunals and Inquiries Act 1992 (c. 53)
  1060. 41Paragraph 41
  1061. Industrial Relations (Northern Ireland) Order 1992 (S.I. 1992/807 (N.I. 5))
  1062. 42Paragraph 42
  1063. Health Service Commissioners Act 1993 (c. 46)
  1064. 43Paragraph 43
  1065. Data Protection Act 1998 (c. 29)
  1066. 44Paragraph 44
  1067. Crime and Disorder Act 1998 (c. 37)
  1068. 45Paragraph 45
  1069. Food Standards Act 1999 (c. 28)
  1070. 46Paragraph 46
  1071. Immigration and Asylum Act 1999 (c. 33)
  1072. 47Paragraph 47
  1073. Financial Services and Markets Act 2000 (c. 8)
  1074. 48Paragraph 48
  1075. 49Paragraph 49 Repealed
  1076. 50Paragraph 50
  1077. 51Paragraph 51
  1078. 52Paragraph 52
  1079. 53Paragraph 53
  1080. Terrorism Act 2000 (c. 11)
  1081. 54Paragraph 54
  1082. Freedom of Information Act 2000 (c. 36)
  1083. 55Paragraph 55
  1084. 56Paragraph 56
  1085. 57Paragraph 57
  1086. 58Paragraph 58
  1087. 59Paragraph 59
  1088. 60Paragraph 60
  1089. 61Paragraph 61
  1090. 62Paragraph 62
  1091. 63Paragraph 63
  1092. 64Paragraph 64
  1093. Political Parties, Elections and Referendums Act 2000 (c. 41)
  1094. 65Paragraph 65
  1095. Public Finance and Accountability (Scotland) Act 2000 (asp 1)
  1096. 66Paragraph 66
  1097. 67Paragraph 67
  1098. 68Paragraph 68
  1099. 69Paragraph 69
  1100. Criminal Justice and Police Act 2001 (c. 16)
  1101. 70Paragraph 70
  1102. 71Paragraph 71
  1103. 72Paragraph 72
  1104. 73Paragraph 73
  1105. Anti-terrorism, Crime and Security Act 2001 (c.24)
  1106. 74Paragraph 74
  1107. 75Paragraph 75
  1108. 76Paragraph 76 Not yet in force
  1109. Health and Personal Social Services Act (Northern Ireland) 2001 (c. 3 (N.I.))
  1110. 77Paragraph 77
  1111. Justice (Northern Ireland) Act 2002 (c. 26)
  1112. 78Paragraph 78
  1113. Proceeds of Crime Act 2002 (c. 29)
  1114. 79Paragraph 79
  1115. 80Paragraph 80
  1116. 81Paragraph 81
  1117. 82Paragraph 82
  1118. 83Paragraph 83
  1119. 84Paragraph 84
  1120. 85Paragraph 85
  1121. Enterprise Act 2002 (c. 40)
  1122. 86Paragraph 86
  1123. Scottish Public Services Ombudsman Act 2002 (asp 11)
  1124. 87Paragraph 87
  1125. Freedom of Information (Scotland) Act 2002 (asp 13)
  1126. 88Paragraph 88
  1127. 89Paragraph 89
  1128. 90Paragraph 90
  1129. Courts Act 2003 (c. 39)
  1130. 91Paragraph 91
  1131. 92Paragraph 92
  1132. 93Paragraph 93
  1133. Sexual Offences Act 2003 (c. 42)
  1134. 94Paragraph 94
  1135. Criminal Justice Act 2003 (c. 44)
  1136. 95Paragraph 95
  1137. 96Paragraph 96
  1138. 97Paragraph 97
  1139. Mental Health (Care and Treatment) (Scotland) Act 2003 (asp 13)
  1140. 98Paragraph 98
  1141. Public Audit (Wales) Act 2004 (c. 23)
  1142. 99Paragraph 99
  1143. Companies (Audit, Investigations and Community Enterprise) Act 2004 (c. 27)
  1144. 100Paragraph 100
  1145. 101Paragraph 101
  1146. 102Paragraph 102
  1147. Domestic Violence, Crime and Victims Act 2004 (c. 28)
  1148. 103Paragraph 103
  1149. Children Act 2004 (c. 31)
  1150. 104Paragraph 104
  1151. 105Paragraph 105
  1152. 106Paragraph 106
  1153. Constitutional Reform Act 2005 (c. 4)
  1154. 107Paragraph 107
  1155. Mental Capacity Act 2005 (c. 9)
  1156. 108Paragraph 108
  1157. Public Services Ombudsman (Wales) Act 2005 (c. 10)
  1158. 109Paragraph 109
  1159. Commissioners for Revenue and Customs Act 2005 (c. 11)
  1160. 110Paragraph 110
  1161. Gambling Act 2005 (c. 19)
  1162. 111Paragraph 111
  1163. Commissioner for Older People (Wales) Act 2006 (c. 30)
  1164. 112Paragraph 112
  1165. National Health Service Act 2006 (c. 41)
  1166. 113Paragraph 113
  1167. 114Paragraph 114
  1168. 115Paragraph 115
  1169. 116Paragraph 116
  1170. National Health Service (Wales) Act 2006 (c. 42)
  1171. 117Paragraph 117
  1172. 118Paragraph 118
  1173. 119Paragraph 119
  1174. Companies Act 2006 (c. 46)
  1175. 120Paragraph 120
  1176. 121Paragraph 121
  1177. 122Paragraph 122
  1178. 123Paragraph 123
  1179. 124Paragraph 124
  1180. 125Paragraph 125
  1181. 126Paragraph 126
  1182. 127Paragraph 127
  1183. 128Paragraph 128
  1184. 129Paragraph 129
  1185. Tribunals, Courts and Enforcement Act 2007 (c. 15)
  1186. 130Paragraph 130
  1187. 131Paragraph 131
  1188. 132Paragraph 132
  1189. Statistics and Registration Service Act 2007 (c. 18)
  1190. 133Paragraph 133
  1191. 134Paragraph 134
  1192. 135Paragraph 135
  1193. 136Paragraph 136
  1194. 137Paragraph 137
  1195. 138Paragraph 138
  1196. 139Paragraph 139
  1197. 140Paragraph 140
  1198. 141Paragraph 141
  1199. 142Paragraph 142
  1200. Serious Crime Act 2007 (c. 27)
  1201. 143Paragraph 143
  1202. 144Paragraph 144
  1203. 145Paragraph 145
  1204. 146Paragraph 146
  1205. Legal Services Act 2007 (c. 29)
  1206. 147Paragraph 147
  1207. Adoption and Children (Scotland) Act 2007 (asp 4)
  1208. 148Paragraph 148
  1209. Criminal Justice and Immigration Act 2008 (c. 4)
  1210. 149Paragraph 149
  1211. 150Paragraph 150
  1212. 151Paragraph 151
  1213. Regulatory Enforcement and Sanctions Act 2008 (c. 13)
  1214. 152Paragraph 152
  1215. Health and Social Care Act 2008 (c. 14)
  1216. 153Paragraph 153
  1217. Counter-Terrorism Act 2008 (c. 28)
  1218. 154Paragraph 154
  1219. Public Health etc. (Scotland) Act 2008 (asp 5)
  1220. 155Paragraph 155
  1221. Banking Act 2009 (c. 1)
  1222. 156Paragraph 156
  1223. Borders, Citizenship and Immigration Act 2009 (c. 11)
  1224. 157Paragraph 157
  1225. Marine and Coastal Access Act 2009 (c. 23)
  1226. 158Paragraph 158
  1227. 159Paragraph 159
  1228. 160Paragraph 160
  1229. Coroners and Justice Act 2009 (c. 25)
  1230. 161Paragraph 161
  1231. Broads Authority Act 2009 (c. i)
  1232. 162Paragraph 162
  1233. Health and Social Care (Reform) Act (Northern Ireland) 2009 (c. 1 (N.I.))
  1234. 163Paragraph 163
  1235. Terrorist Asset-Freezing etc. Act 2010 (c. 38)
  1236. 164Paragraph 164
  1237. Marine (Scotland) Act 2010 (asp 5)
  1238. 165Paragraph 165
  1239. Charities Act 2011 (c. 25)
  1240. 166Paragraph 166
  1241. Welsh Language (Wales) Measure 2011 (nawm 1)
  1242. 167Paragraph 167
  1243. 168Paragraph 168
  1244. 169Paragraph 169
  1245. Safeguarding Board Act (Northern Ireland) 2011 (c. 7 (N.I))
  1246. 170Paragraph 170
  1247. Health and Social Care Act 2012 (c. 7)
  1248. 171Paragraph 171
  1249. 172Paragraph 172
  1250. 173Paragraph 173
  1251. 174Paragraph 174
  1252. Protection of Freedoms Act 2012 (c. 9)
  1253. 175Paragraph 175
  1254. 176Paragraph 176
  1255. 177Paragraph 177
  1256. 178Paragraph 178
  1257. HGV Road User Levy Act 2013 (c. 7)
  1258. 179Paragraph 179
  1259. Crime and Courts Act 2013 (c. 22)
  1260. 180Paragraph 180
  1261. 181Paragraph 181
  1262. 182Paragraph 182
  1263. Marine Act (Northern Ireland) 2013 (c. 10 (N.I.))
  1264. 183Paragraph 183
  1265. Local Audit and Accountability Act 2014 (c. 2)
  1266. 184Paragraph 184
  1267. Anti-social Behaviour, Crime and Policing Act 2014 (c. 12)
  1268. 185Paragraph 185
  1269. Immigration Act 2014 (c. 22)
  1270. 186Paragraph 186
  1271. Care Act 2014 (c. 23)
  1272. 187Paragraph 187
  1273. Social Services and Well-being (Wales) Act 2014 (anaw 4)
  1274. 188Paragraph 188
  1275. Counter-Terrorism and Security Act 2015 (c. 6)
  1276. 189Paragraph 189
  1277. Small Business, Enterprise and Employment Act 2015 (c. 26)
  1278. 190Paragraph 190
  1279. Modern Slavery Act 2015 (c. 30)
  1280. 191Paragraph 191 Repealed
  1281. Human Trafficking and Exploitation (Criminal Justice and Support for Victims) Act (Northern Ireland) 2015 (c. 2 (N.I.))
  1282. 192Paragraph 192
  1283. 193Paragraph 193
  1284. 194Paragraph 194
  1285. 195Paragraph 195
  1286. Justice Act (Northern Ireland) 2015 (c. 9 (N.I.))
  1287. 196Paragraph 196
  1288. Immigration Act 2016 (c. 19)
  1289. 197Paragraph 197 Repealed
  1290. Investigatory Powers Act 2016 (c. 25)
  1291. 198Paragraph 198
  1292. 199Paragraph 199
  1293. 200Paragraph 200
  1294. 201Paragraph 201 Not yet in force
  1295. 202Paragraph 202
  1296. 203Paragraph 203
  1297. Public Services Ombudsman Act (Northern Ireland) 2016 (c. 4 (N.I.))
  1298. 204Paragraph 204
  1299. Health and Social Care (Control of Data Processing) Act (Northern Ireland) 2016 (c. 12 (N.I.))
  1300. 205Paragraph 205
  1301. Mental Capacity Act (Northern Ireland) 2016 (c. 18 (N.I.))
  1302. 206Paragraph 206
  1303. Justice Act (Northern Ireland) 2016 (c. 21 (N.I.))
  1304. 207Paragraph 207
  1305. 208Paragraph 208
  1306. 209Paragraph 209
  1307. Policing and Crime Act 2017 (c. 3)
  1308. 210Paragraph 210
  1309. Children and Social Work Act 2017 (c. 12)
  1310. 211Paragraph 211
  1311. Higher Education and Research Act 2017 (c. 29)
  1312. 212Paragraph 212
  1313. 213Paragraph 213
  1314. 214Paragraph 214
  1315. Digital Economy Act 2017 (c. 30)
  1316. 215Paragraph 215
  1317. 216Paragraph 216
  1318. 217Paragraph 217
  1319. 218Paragraph 218
  1320. 219Paragraph 219
  1321. 220Paragraph 220
  1322. 221Paragraph 221
  1323. 222Paragraph 222
  1324. 223Paragraph 223
  1325. 224Paragraph 224
  1326. Landfill Disposals Tax (Wales) Act 2017 (anaw 3)
  1327. 225Paragraph 225
  1328. Additional Learning Needs and Educational Tribunal (Wales) Act 2018 (anaw 2)
  1329. 226Paragraph 226
  1330. This Act
  1331. 227Paragraph 227
  1332. Part 2: Amendments of other legislation
  1333. Estate Agents (Specified Offences) (No. 2) Order 1991 (S.I. 1991/1091)
  1334. 228Paragraph 228
  1335. Channel Tunnel (International Arrangements) Order 1993 (S.I. 1993/1813)
  1336. 229Paragraph 229
  1337. Access to Health Records (Northern Ireland) Order 1993 (S.I. 1993/1250 (N.I. 4))
  1338. 230Paragraph 230
  1339. 231Paragraph 231
  1340. 232Paragraph 232
  1341. Channel Tunnel (Miscellaneous Provisions) Order 1994 (S.I. 1994/1405)
  1342. 233Paragraph 233
  1343. European Primary and Specialist Dental Qualifications Regulations 1998 (S.I. 1998/811)
  1344. 234Paragraph 234
  1345. 235Paragraph 235
  1346. 236Paragraph 236
  1347. Scottish Parliamentary Corporate Body (Crown Status) Order 1999 (S.I. 1999/677)
  1348. 237Paragraph 237
  1349. Northern Ireland Assembly Commission (Crown Status) Order 1999 (S.I. 1999/3145)
  1350. 238Paragraph 238
  1351. Data Protection (Corporate Finance Exemption) Order 2000 (S.I. 2000/184)
  1352. 239Paragraph 239
  1353. Data Protection (Conditions under Paragraph 3 of Part II of Schedule 1) Order 2000 (S.I. 2000/185)
  1354. 240Paragraph 240
  1355. Data Protection (Functions of Designated Authority) Order 2000 (S.I. 2000/186)
  1356. 241Paragraph 241
  1357. Data Protection (International Co-operation) Order 2000 (S.I. 2000/190)
  1358. 242Paragraph 242
  1359. Data Protection (Subject Access) (Fees and Miscellaneous Provisions) Regulations 2000 (S.I. 2000/191)
  1360. 243Paragraph 243
  1361. Consumer Credit (Credit Reference Agency) Regulations 2000 (S.I. 2000/290)
  1362. 244Paragraph 244
  1363. Data Protection (Subject Access Modification) (Health) Order 2000 (S.I. 2000/413)
  1364. 245Paragraph 245
  1365. Data Protection (Subject Access Modification) (Education) Order 2000 (S.I. 2000/414)
  1366. 246Paragraph 246
  1367. Data Protection (Subject Access Modification) (Social Work) Order 2000 (S.I. 2000/415)
  1368. 247Paragraph 247
  1369. Data Protection (Crown Appointments) Order 2000 (S.I. 2000/416)
  1370. 248Paragraph 248
  1371. Data Protection (Processing of Sensitive Personal Data) Order 2000 (S.I. 2000/417)
  1372. 249Paragraph 249
  1373. Data Protection (Miscellaneous Subject Access Exemptions) Order 2000 (S.I. 2000/419)
  1374. 250Paragraph 250
  1375. Data Protection (Designated Codes of Practice) (No. 2) Order 2000 (S.I. 2000/1864)
  1376. 251Paragraph 251
  1377. Representation of the People (England and Wales) Regulations 2001 (S.I. 2001/341)
  1378. 252Paragraph 252
  1379. 253Paragraph 253
  1380. 254Paragraph 254
  1381. 255Paragraph 255
  1382. 256Paragraph 256
  1383. 257Paragraph 257
  1384. 258Paragraph 258
  1385. 259Paragraph 259
  1386. 260Paragraph 260
  1387. 261Paragraph 261
  1388. 262Paragraph 262
  1389. 263Paragraph 263
  1390. 264Paragraph 264
  1391. Representation of the People (Scotland) Regulations 2001 (S.I. 2001/497)
  1392. 265Paragraph 265
  1393. 266Paragraph 266
  1394. 267Paragraph 267
  1395. 268Paragraph 268
  1396. 269Paragraph 269
  1397. 270Paragraph 270
  1398. 271Paragraph 271
  1399. 272Paragraph 272
  1400. 273Paragraph 273
  1401. 274Paragraph 274
  1402. 275Paragraph 275
  1403. 276Paragraph 276
  1404. 277Paragraph 277
  1405. Financial Services and Markets Act 2000 (Disclosure of Confidential Information) Regulations 2001 (S.I. 2001/2188)
  1406. 278Paragraph 278
  1407. Nursing and Midwifery Order 2001 (S.I. 2002/253)
  1408. 279Paragraph 279
  1409. 280Paragraph 280
  1410. 281Paragraph 281
  1411. 282Paragraph 282
  1412. 283Paragraph 283
  1413. 284Paragraph 284
  1414. 285Paragraph 285
  1415. 286Paragraph 286
  1416. Electronic Commerce (EC Directive) Regulations 2002 (S.I. 2002/2013)
  1417. 287Paragraph 287
  1418. 288Paragraph 288
  1419. 289Paragraph 289
  1420. Data Protection (Processing of Sensitive Personal Data) (Elected Representatives) Order 2002 (S.I. 2002/2905)
  1421. 290Paragraph 290
  1422. Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426)
  1423. 291Paragraph 291
  1424. 292Paragraph 292
  1425. 293Paragraph 293
  1426. Nationality, Immigration and Asylum Act 2002 (Juxtaposed Controls) Order 2003 (S.I. 2003/2818)
  1427. 294Paragraph 294
  1428. 295Paragraph 295
  1429. 296Paragraph 296
  1430. Pupils' Educational Records (Scotland) Regulations 2003 (S.S.I. 2003/581)
  1431. 297Paragraph 297
  1432. 298Paragraph 298
  1433. 299Paragraph 299
  1434. 300Paragraph 300
  1435. European Parliamentary Elections (Northern Ireland) Regulations 2004 (S.I. 2004/1267)
  1436. 301Paragraph 301
  1437. 302Paragraph 302
  1438. 303Paragraph 303
  1439. Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004 (S.I. 2004/3244)
  1440. 304Paragraph 304
  1441. Environmental Information Regulations 2004 (S.I. 2004/3391)
  1442. 305Paragraph 305
  1443. 306Paragraph 306
  1444. 307Paragraph 307
  1445. 308Paragraph 308
  1446. 309Paragraph 309
  1447. Environmental Information (Scotland) Regulations 2004 (S.S.I. 2004/520)
  1448. 310Paragraph 310
  1449. 311Paragraph 311
  1450. 312Paragraph 312
  1451. Licensing Act 2003 (Personal Licences) Regulations 2005 (S.I. 2005/41)
  1452. 313Paragraph 313
  1453. Education (Pupil Information) (England) Regulations 2005 (S.I. 2005/1437)
  1454. 314Paragraph 314
  1455. 315Paragraph 315
  1456. 316Paragraph 316
  1457. Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005 (S.I. 2005/2042)
  1458. 317Paragraph 317
  1459. Register of Judgments, Orders and Fines Regulations 2005 (S.I. 2005/3595)
  1460. 318Paragraph 318
  1461. Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005 (S.S.I. 2005/494)
  1462. 319Paragraph 319
  1463. 320Paragraph 320
  1464. Data Protection (Processing of Sensitive Personal Data) Order 2006 (S.I. 2006/2068)
  1465. 321Paragraph 321
  1466. National Assembly for Wales (Representation of the People) Order 2007 (S.I. 2007/236)
  1467. 322Paragraph 322
  1468. Mental Capacity Act 2005 (Loss of Capacity during Research Project) (England) Regulations 2007 (S.I. 2007/679)
  1469. 323Paragraph 323
  1470. National Assembly for Wales Commission (Crown Status) Order 2007 (S.I. 2007/1118)
  1471. 324Paragraph 324
  1472. Mental Capacity Act 2005 (Loss of Capacity during Research Project) (Wales) Regulations 2007 (S.I. 2007/837 (W.72))
  1473. 325Paragraph 325
  1474. Representation of the People (Absent Voting at Local Elections) (Scotland) Regulations 2007 (S.S.I. 2007/170)
  1475. 326Paragraph 326
  1476. Representation of the People (Post-Local Government Elections Supply and Inspection of Documents) (Scotland) Regulations 2007 (S.S.I. 2007/264)
  1477. 327Paragraph 327
  1478. Education (Pupil Records and Reporting) (Transitional) Regulations (Northern Ireland) 2007 (S.R. (N.I.) 2007 No. 43)
  1479. 328Paragraph 328
  1480. 329Paragraph 329
  1481. 330Paragraph 330
  1482. Representation of the People (Northern Ireland) Regulations 2008 (S.I. 2008/1741)
  1483. 331Paragraph 331
  1484. Companies Act 2006 (Extension of Takeover Panel Provisions) (Isle of Man) Order 2008 (S.I. 2008/3122)
  1485. 332Paragraph 332
  1486. Controlled Drugs (Supervision of Management and Use) (Wales) Regulations 2008 (S.I. 2008/3239 (W.286))
  1487. 333Paragraph 333
  1488. 334Paragraph 334
  1489. 335Paragraph 335
  1490. 336Paragraph 336
  1491. 337Paragraph 337
  1492. Energy Order 2003 (Supply of Information) Regulations (Northern Ireland) 2008 (S.R. (N.I.) 2008 No. 3)
  1493. 338Paragraph 338
  1494. Companies (Disclosure of Address) Regulations 2009 (S.I. 2009/214)
  1495. 339Paragraph 339
  1496. Overseas Companies Regulations 2009 (S.I. 2009/1801)
  1497. 340Paragraph 340
  1498. Data Protection (Processing of Sensitive Personal Data) Order 2009 (S.I. 2009/1811)
  1499. 341Paragraph 341
  1500. Provision of Services Regulations 2009 (S.I. 2009/2999)
  1501. 342Paragraph 342
  1502. INSPIRE Regulations 2009 (S.I. 2009/3157)
  1503. 343Paragraph 343
  1504. INSPIRE (Scotland) Regulations 2009 (S.S.I. 2009/440)
  1505. 344Paragraph 344
  1506. Controlled Drugs (Supervision of Management and Use) Regulations (Northern Ireland) 2009 (S.R (N.I.) 2009 No. 225)
  1507. 345Paragraph 345
  1508. 346Paragraph 346
  1509. 347Paragraph 347
  1510. 348Paragraph 348
  1511. 349Paragraph 349
  1512. Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010 (S.I. 2010/31)
  1513. 350Paragraph 350
  1514. Pharmacy Order 2010 (S.I. 2010/231)
  1515. 351Paragraph 351
  1516. 352Paragraph 352
  1517. 353Paragraph 353
  1518. 354Paragraph 354
  1519. 355Paragraph 355
  1520. 356Paragraph 356
  1521. 357Paragraph 357
  1522. 358Paragraph 358
  1523. 359Paragraph 359
  1524. Data Protection (Monetary Penalties) Order 2010 (S.I. 2010/910)
  1525. 360Paragraph 360
  1526. National Employment Savings Trust Order 2010 (S.I. 2010/917)
  1527. 361Paragraph 361
  1528. 362Paragraph 362
  1529. 363Paragraph 363
  1530. Local Elections (Northern Ireland) Order 2010 (S.I. 2010/2977)
  1531. 364Paragraph 364
  1532. Pupil Information (Wales) Regulations 2011 (S.I. 2011/1942 (W.209))
  1533. 365Paragraph 365
  1534. Debt Arrangement Scheme (Scotland) Regulations 2011 (S.S.I. 2011/141)
  1535. 366Paragraph 366
  1536. Police and Crime Commissioner Elections Order 2012 (S.I. 2012/1917)
  1537. 367Paragraph 367
  1538. 368Paragraph 368
  1539. 369Paragraph 369
  1540. Data Protection (Processing of Sensitive Personal Data) Order 2012 (S.I. 2012/1978)
  1541. 370Paragraph 370
  1542. Neighbourhood Planning (Referendums) Regulations 2012 (S.I. 2012/2031)
  1543. 371Paragraph 371
  1544. 372Paragraph 372
  1545. 373Paragraph 373
  1546. 374Paragraph 374
  1547. 375Paragraph 375
  1548. 376Paragraph 376
  1549. 377Paragraph 377
  1550. Controlled Drugs (Supervision of Management and Use) Regulations 2013 (S.I. 2013/373)
  1551. 378Paragraph 378
  1552. Communications Act 2003 (Disclosure of Information) Order 2014 (S.I. 2014/1825)
  1553. 379Paragraph 379
  1554. Criminal Justice and Data Protection (Protocol No. 36) Regulations 2014 (S.I. 2014/3141)
  1555. 380Paragraph 380
  1556. Data Protection (Assessment Notices) (Designation of National Health Service Bodies) Order 2014 (S.I. 2014/3282)
  1557. 381Paragraph 381
  1558. The Control of Explosives Precursors etc Regulations (Northern Ireland) 2014 (S.R. (N.I.) 2014 No. 224)
  1559. 382Paragraph 382
  1560. Control of Poisons and Explosives Precursors Regulations 2015 (S.I. 2015/966)
  1561. 383Paragraph 383
  1562. Companies (Disclosure of Date of Birth Information) Regulations 2015 (S.I. 2015/1694)
  1563. 384Paragraph 384
  1564. Small and Medium Sized Business (Credit Information) Regulations 2015 (S.I. 2015/1945)
  1565. 385Paragraph 385
  1566. 386Paragraph 386
  1567. 387Paragraph 387
  1568. European Union (Recognition of Professional Qualifications) Regulations 2015 (S.I. 2015/2059)
  1569. 388Paragraph 388
  1570. 389Paragraph 389
  1571. 390Paragraph 390
  1572. 391Paragraph 391
  1573. 392Paragraph 392
  1574. 393Paragraph 393
  1575. 394Paragraph 394
  1576. Scottish Parliament (Elections etc) Order 2015 (S.S.I. 2015/425)
  1577. 395Paragraph 395
  1578. 396Paragraph 396
  1579. 397Paragraph 397
  1580. Recall of MPs Act 2015 (Recall Petition) Regulations 2016 (S.I. 2016/295)
  1581. 398Paragraph 398
  1582. Register of People with Significant Control Regulations 2016 (S.I. 2016/339)
  1583. 399Paragraph 399
  1584. 400Paragraph 400
  1585. 401Paragraph 401
  1586. 402Paragraph 402
  1587. Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 (S.I. 2016/696)
  1588. 403Paragraph 403
  1589. 404Paragraph 404
  1590. 405Paragraph 405
  1591. 406Paragraph 406
  1592. Court Files Privileged Access Rules (Northern Ireland) 2016 (S.R. (N.I.) 2016 No. 123)
  1593. 407Paragraph 407
  1594. 408Paragraph 408
  1595. 409Paragraph 409
  1596. Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (S.I. 2017/692)
  1597. 410Paragraph 410
  1598. 411Paragraph 411
  1599. 412Paragraph 412
  1600. 413Paragraph 413
  1601. 414Paragraph 414
  1602. 415Paragraph 415
  1603. 416Paragraph 416
  1604. 417Paragraph 417
  1605. 418Paragraph 418
  1606. 419Paragraph 419
  1607. Scottish Partnerships (Register of People with Significant Control) Regulations 2017 (S.I. 2017/694)
  1608. 420Paragraph 420
  1609. Data Protection (Charges and Information) Regulations 2018 (S.I. 2018/480)
  1610. 421Paragraph 421
  1611. National Health Service (General Medical Services Contracts) (Scotland) Regulations 2018 (S.S.I. 2018/66)
  1612. 422Paragraph 422
  1613. 423Paragraph 423
  1614. 424Paragraph 424
  1615. 425Paragraph 425
  1616. National Health Service (Primary Medical Services Section 17C Agreements) (Scotland) Regulations 2018 (S.S.I. 2018/67)
  1617. 426Paragraph 426
  1618. 427Paragraph 427
  1619. 428Paragraph 428
  1620. 429Paragraph 429
  1621. Part 3: Modifications
  1622. Introduction
  1623. 430Paragraph 430
  1624. General modifications
  1625. 431Paragraph 431
  1626. Specific modification of references to terms used in the Data Protection Act 1998
  1627. 432Paragraph 432
  1628. Part 4: Supplementary
  1629. Definitions
  1630. 433Paragraph 433
  1631. Provision inserted in subordinate legislation by this Schedule
  1632. 434Paragraph 434
  1633. Schedule 20: Transitional provision etc
  1634. Part 1: General
  1635. Interpretation
  1636. 1Paragraph 1
  1637. Part 2: Rights of data subjects
  1638. Right of access to personal data under the 1998 Act
  1639. 2Paragraph 2
  1640. Right to prevent processing likely to cause damage or distress under the 1998 Act
  1641. 3Paragraph 3
  1642. Right to prevent processing for purposes of direct marketing under the 1998 Act
  1643. 4Paragraph 4
  1644. Automated processing under the 1998 Act
  1645. 5Paragraph 5
  1646. Compensation for contravention of the 1998 Act or Part 4 of the 2014 Regulations
  1647. 6Paragraph 6
  1648. Rectification, blocking, erasure and destruction under the 1998 Act
  1649. 7Paragraph 7
  1650. Jurisdiction and procedure under the 1998 Act
  1651. 8Paragraph 8
  1652. Exemptions under the 1998 Act
  1653. 9Paragraph 9
  1654. Prohibition by this Act of requirement to produce relevant records
  1655. 10Paragraph 10
  1656. Avoidance under this Act of certain contractual terms relating to health records
  1657. 11Paragraph 11
  1658. Part 3: The UK GDPR and Part 2 of this Act
  1659. Exemptions from the GDPR: restrictions of rules in Articles 13 to 15 of the GDPR
  1660. 12Paragraph 12
  1661. Manual unstructured data held by FOI public authorities
  1662. 13Paragraph 13
  1663. Part 4: Law enforcement and intelligence services processing
  1664. Logging
  1665. 14Paragraph 14
  1666. Regulation 50 of the 2014 Regulations (disapplication of the 1998 Act)
  1667. 15Paragraph 15
  1668. Maximum fee for data subject access requests to intelligence services
  1669. 16Paragraph 16
  1670. Part 5: National security certificates
  1671. National security certificates: processing of personal data under the 1998 Act
  1672. 17Paragraph 17
  1673. National security certificates: processing of personal data under the 2018 Act
  1674. 18Paragraph 18
  1675. Part 6: The Information Commissioner
  1676. Appointment etc
  1677. 19Paragraph 19
  1678. Accounts
  1679. 20Paragraph 20
  1680. Annual report
  1681. 21Paragraph 21
  1682. Fees etc received by the Commissioner
  1683. 22Paragraph 22
  1684. 23Paragraph 23
  1685. Functions in connection with the Data Protection Convention
  1686. 24Paragraph 24
  1687. Co-operation with the European Commission: transfers of personal data outside the EEA
  1688. 25Paragraph 25
  1689. Charges payable to the Commissioner by controllers
  1690. 26Paragraph 26
  1691. Requests for assessment
  1692. 27Paragraph 27
  1693. Codes of practice
  1694. 28Paragraph 28
  1695. Part 7: Enforcement etc under the 1998 Act
  1696. Interpretation of this Part
  1697. 29Paragraph 29
  1698. Information notices
  1699. 30Paragraph 30
  1700. Special information notices
  1701. 31Paragraph 31
  1702. Assessment notices
  1703. 32Paragraph 32
  1704. Enforcement notices
  1705. 33Paragraph 33
  1706. Determination by Commissioner as to the special purposes
  1707. 34Paragraph 34
  1708. Restriction on enforcement in case of processing for the special purposes
  1709. 35Paragraph 35
  1710. Offences
  1711. 36Paragraph 36
  1712. Powers of entry
  1713. 37Paragraph 37
  1714. Monetary penalties
  1715. 38Paragraph 38
  1716. Appeals
  1717. 39Paragraph 39
  1718. Exemptions
  1719. 40Paragraph 40
  1720. Tribunal Procedure Rules
  1721. 41Paragraph 41
  1722. Obstruction etc
  1723. 42Paragraph 42
  1724. Enforcement etc under the 2014 Regulations
  1725. 43Paragraph 43
  1726. Part 8: Enforcement etc under this Act
  1727. Information notices
  1728. 44Paragraph 44
  1729. Powers of entry
  1730. 45Paragraph 45
  1731. Tribunal Procedure Rules
  1732. 46Paragraph 46
  1733. Part 9: Other enactments
  1734. Powers to disclose information to the Commissioner
  1735. 47Paragraph 47
  1736. Codes etc required to be consistent with the Commissioner's data-sharing code
  1737. 48Paragraph 48
  1738. 49Paragraph 49
  1739. Consumer Credit Act 1974
  1740. 50Paragraph 50
  1741. Freedom of Information Act 2000
  1742. 51Paragraph 51
  1743. 52Paragraph 52
  1744. 53Paragraph 53
  1745. 54Paragraph 54
  1746. 55Paragraph 55
  1747. Freedom of Information (Scotland) Act 2002
  1748. 56Paragraph 56
  1749. Access to Health Records (Northern Ireland) Order 1993 (S.I. 1993/1250 (N.I. 4))
  1750. 57Paragraph 57
  1751. Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2450)
  1752. 58Paragraph 58
  1753. Health and Personal Social Services (Quality, Improvement and Regulation) (Northern Ireland) Order 2003 (S.I. 2003/431 (N.I. 9))
  1754. 59Paragraph 59
  1755. Environmental Information Regulations 2004 (S.I. 2004/3391)
  1756. 60Paragraph 60
  1757. Environmental Information (Scotland) Regulations 2004 (S.S.I. 2004/520)
  1758. 61Paragraph 61
  1759. Schedule 21: Further transitional provision etc
  1760. Part 1: Interpretation
  1761. 1The applied GPDR
  1762. Part 2: Continuation of existing acts etc
  1763. 2Merger of the directly applicable GDPR and the applied GDPR
  1764. 3Paragraph 3
  1765. Part 3: Transfers to third countries and international organisations
  1766. 4UK GDPR: transfers approved by regulations
  1767. 5Paragraph 5
  1768. 6Paragraph 6
  1769. 7UK GDPR: transfers subject to appropriate safeguards provided by standard data protection clauses Repealed
  1770. 8Paragraph 8 Repealed
  1771. 9UK GDPR: transfers subject to appropriate safeguards provided by binding corporate rules
  1772. 10Part 3 (law enforcement processing): transfers approved by regulations
  1773. 11Paragraph 11
  1774. 12Paragraph 12
  1775. Part 4: Repeal of provisions in Chapter 3 of Part 2
  1776. 13Applied GDPR: power to make provision in consequence of GDPR regulations
  1777. 14Applied GDPR: national security certificates
  1778. Part 5: The Information Commission
  1779. 15Confidentiality of information
  1780. Part 6: Enforcement
  1781. 16GDPR: maximum amount of penalties
  1782. 17GDPR: right to an effective remedy against the Commissioner